By: HUB’s EB Compliance Team

To aid in the fight against COVID-19, the Department of Health and Human Services’ Office of Civil Rights (“OCR”) is now allowing health plans to contact members who previously had COVID-19 about donating plasma, as detailed in this guidance. Of course, there are some cautions, but overall the approach is pretty straightforward.

Background

In broad terms, convalescent plasma is using blood plasma from someone that has recovered from an illness to help others recover. In this case, the plasma of the recovered person is given to those with COVID-19. The plasma contains antibodies to help the recipient fight the virus.

Back in June, OCR issued guidance allowing doctors and other health providers to contact their patients who had recovered. That guidance did not address health plans. Revised guidance issued late in August now includes health plans.

The Guidance

The OCR guidance notes that health plans may disclose an individual’s protected health information (“PHI”) without an individual’s authorization for “health care operations” purposes (as defined by HIPAA). OCR says contacting former COVID-19 patients to ask them to donate plasma is a health care operation. 

In the process of making this contact, care should be taken to limit the disclosure of any PHI only to the minimum necessary to accomplish the purpose. In other words, if a health plan wanted to send a mailing to members who recovered from COVID-19, the plan should not disclose any more information about those individuals than their contact information and the fact they have recovered from COVID-19. Note that the vendor doing the mailing here would be considered a business associate of the health plan and would require a business associate agreement.

The guidance also cautions that plans cannot promote a particular product or service in doing so. For example, plans should not encourage members to make their donation at a specific plasma donation center, if the plan would receive a payment (directly or indirectly) as a result. This would be considered “marketing” and is not permitted without the individual’s authorization. Similarly, giving over a list of recovered COVID-19 members to a plasma donation center so it can promote its services would also be a HIPAA violation (unless the individual authorized the disclosure). As a best practice, it would be better to avoid suggesting particular plasma donations centers.

Practical Pointers

As a practical matter, most employers are unlikely to get involved directly in contacting these individuals. However, if they do, they should be aware of the above restrictions and review the guidance carefully to make sure they fit within it.

Additionally, employers may want to be aware of these restrictions in case their employees or their dependents are contacted by their health insurance carrier or third-party administrator. A general communication encouraging plasma donation likely fits within the scope of this guidance. A direction to visit a particular plasma donation center may not.

For the latest information on the COVID-19 crisis and its effect on employers, please keep visiting HUB’s Coronavirus Resource Center. If you have any questions, please contact your HUB Advisor. You can also view more compliance articles in our Compliance Directory.

NOTICE OF DISCLAIMER

The information herein is intended to be educational only and is based on information that is generally available. HUB International makes no representation or warranty as to its accuracy and is not obligated to update the information should it change in the future. The information is not intended to be legal or tax advice. Consult your attorney and/or professional advisor as to your organization’s specific circumstances and legal, tax or other requirements.