COVID-19 and HIPAA - Law Enforcement, First Responders and Public Health Authorities Can Get PHI


We have already seen extensive regulatory responses to the COVID-19 public health emergency. On March 24, 2020, the Office for Civil Rights (“OCR”), a department of the U.S. Department of Health and Human Services (“HHS”) issued guidance clarifying when entities covered under HIPAA and the Privacy Rule can disclose the protected health information (“PHI”) of patients exposed to COVID-19 to first responders and other individuals.

The guidance reiterates that covered entities can disclose the PHI of individuals infected with, or exposed to, COVID-19, with law enforcement, paramedics, other first responders, and public health authorities without the patient’s HIPAA authorization in the following circumstances:

  • To provide treatment, such as when emergency medical transport personnel need to provide treatment during the transfer of a patient from a SNF to a hospital’s emergency room.
  • When required by law, such as mandatory reporting to public health officials, under applicable state law, of individuals testing positive for COVID-19.
  • To prevent or control spread of disease. HIPAA permits disclosure to public health authorities that are authorized to receive PHI for the purpose of controlling disease (like the CDC or local public health departments).
  • When first responders may be at risk. Covered entities may disclose PHI to first responders or others charged with protecting the health and safety of the public (such as firemen, police officers, child welfare workers, etc.) if disclosure is necessary to prevent or minimize the exposure threat of these individuals while they perform their duties.
  • If requested by a correctional facility, that has lawful custody of an inmate or other individual. A law enforcement official or correctional facility may receive PHI if:
    • Treating the individual;
    • For the public and safety of the inmate or other individuals at the correctional facility;
    • To law enforcement on the premises of a correctional facility; or
    • For the administration and maintenance of safety, security, and good order of the facility.

Covered entities disclosing PHI for the above reasons must still make reasonable efforts to limit the information provided to that which is the “minimum necessary” to accomplish the reason for disclosure.  

The full text of the guidance can be found here.



Sarah Churchill Llamas l 512.370.2889 l 

Corinne Smith | 512.370.2808 |

Kevin Wood | 512.370.2826 |

Disclaimer: Content contained within this news alert provides information on general legal issues and is not intended to provide advice on any specific legal matter or factual situation. This information is not intended to create, and receipt of it does not constitute, a lawyer-client relationship. Readers should not act upon this information without seeking professional counsel.

Media Contact

Stephen Hastings
Director of Communications & Media Relations  
713.650.2485 Direct
832.343.4228 Mobile

Search Tips:

You may use the wildcard symbol (*) as a root expander.  A search for "anti*" will find not only "anti", but also "anti-trust", "antique", etc.

Entering two terms together in a search field will behave as though an "OR" is being used.  For example, entering "Antique Motorcars" as a Client Name search will find results with either word in the Client Name.


AND and OR may be used in a search.  Note: they must be capitalized, e.g., "Project AND Finance." 

The + and - sign operators may be used.  The + sign indicates that the term immediately following is required, while the - sign indicates to omit results that contain that term. E.g., "+real -estate" says results must have "real" but not "estate".

To perform an exact phrase search, surround your search phrase with quotation marks.  For example, "Project Finance".

Searches are not case sensitive.

back to top