HHS updates HIPAA guidance for health information exchanges sharing PHI: 4 details

HHS issued new guidance on HIPAA to allow health information exchanges to share protected health information for public health purposes.

Four details:

1. The guidance defines HIEs as organizations that share electronic protected health information among multiple unaffiliated entities. The HIPAA Privacy Rule allows covered entities and business associates to share protected health information with an HIE so the HIE can report the information to a public health authority.

2. Hospitals, laboratories and other healthcare providers can now share the minimum necessary information with public health authorities, including state health departments on request. Covered entities don't need a specific request to share information if they know the public health authority is using the information for public health purposes.

3. During the pandemic, HIEs can provide protected health information from a business associate of covered entities to a public health authority, regardless of whether the business associate's agreement with the healthcare provider permits information disclosure.

4. Hospitals and healthcare providers are required to notify patients that their personal health information was shared for public health purposes.