Once patients contract an infectious respiratory disease like COVID-19, the immune system creates antibodies that supply protection if the pathogen appears again. The antibodies in the blood of patients who recover from an illness like this are key to fighting it. Those antibodies could also be used to treat other patients.
Through the donation of blood and plasma two preparations can be created: Convalescent plasma and hyperimmune immunoglobulin. Convalescent plasma and hyperimmune immunoglobulin have both been used to successfully treat patients who have contracted other viral respiratory diseases. Given the severity of COVID-19 and the high mortality rate, these treatments could be key for patients who are having trouble fighting the infection. Research studies are now being conducted to test whether antibody treatments are effective against COVID-19.
To take part in these programs, patients who have previously been diagnosed with COVID-19 will may be contacted and asked if they are willing to donate blood and plasma, but is this contact allowed by the HIPAA Privacy Rule?
On June 12, 2020, the Department of Health and Human Services’ Office for Civil Rights released guidance to healthcare providers on the HIPAA Privacy Rule and contacting COVID-19 patients to request blood and plasma donations.
OCR outlined that the HIPAA Privacy Rule does not forbid healthcare suppliers from contacting COVID-19 patients to request blood and plasma donations and prior authorization from the patient is not always necessary.
Healthcare suppliers can contact patients to advise them about the possibility of donating blood and plasma to support the response to COVID-19 to improve other patents’ chances of overcoming the disease.
HIPAA covered groups and business associates acting on their behalf can use or share PHI for the purpose of treatment, payment, and healthcare operations, without first receiving official permission to do so from a patient. Asking for a donation of blood or plasma does not fall into the category of treatment, as the blood/plasma will not be used to care for the patient medically, instead it is used for population-based health care operations to enhance health, case management, and care-coordination, which are included in the definition of healthcare operations.
There is some confusion over whether contacting patients to ask for blood donations would be considered a marketing communication, which are generally not allowed by the HIPAA Privacy Rule without prior authorization from the individual in question.
In this instance, an exception to the Privacy Rule’s Marketing provision applies. “A covered health care provider is permitted to make such communication for the covered entity’s population-based case management and related health care operations activities, provided that the covered entity receives no direct or indirect payment from, or on behalf of, the third party whose service is being described in the communication (e.g., a blood and plasma donation center),” according to the OCR guidance.
An authorization is required from a patient before PHI can be shared to a third party, such as a blood and plasma donation clinic, to permit a COVID-19 patient to be contacted to ask for blood and plasma donations for the donation center’s own aims.