Health Insurance Portability and Accountability Act (HIPAA)

Does HIPAA Privacy Rule allow a covered entity to share the name or other identifying information of an individual who has been infected with, or exposed to, the virus SARS-CoV-2, or the disease caused by the virus, Coronavirus Disease 2019 (COVID-19), with law enforcement, paramedics, other first responders, and public health authorities without an individual’s authorization?

Yes

U.S. Department of Health & Human Services

I’m not a lawyer or a doctor and this is neither legal nor medical advice, but for those curious about, for example, names being removed from the “medical” section of the sheets:

“[L]aw enforcement agencies, including the office of the State’s Attorney, are not covered entities under HIPAA.” People v. Beck, 2017 IL App (4th) 160654 (citing People v. Bauer, 931 N.E.2d 1283, 1291 (Ill. App. Ct. 2010)). Since law enforcement agencies are not “covered entities” they are not subject to HIPAA’s restraints. United States v. Prentice, 683 F. Supp. 2d 991, 1001-04 (D. Minn. 2010).

But HIPAA nonetheless permits “covered entities,” such as hospitals, to “share the name or other identifying information of an individual who has been infected with, or exposed to, [COVID-19], with law enforcement, paramedics, and public health authorities without [that] individual’s authorization” in certain circumstances. 45 CFR 164.512(b)(1)(iv) permits disclosure of personal health information by a covered entity to “a police officer or other person who may come into contact with a person who tested positive for COVID-19, for purposes of preventing or controlling the spread of COVID-19.”