As the Coronavirus continues to spread nationwide, we recognize that health care providers and other organizations (“Organizations”) are dealing with the virus on the “front lines.” We have provided the following advice for the many growing concerns surrounding your Organizations.

Privacy Considerations for Health Care Providers

Organizations need to ensure that they continue to observe legal and ethical obligations with respect to the privacy of patients, colleagues and employees including, but not limited to, their obligations under the Health Insurance Portability and Accountability Act (“HIPAA”). As such, you should observe the following:

  • Do not disclose an individual’s protected health information (“PHI”) to the media. During this crisis, you may receive media inquiries related to confirmed or suspected cases of the virus. Organizations generally may not disclose an individual’s PHI to the media even during a public health emergency unless you have written authorization.
  • Take care in responding to inquiries from “Public Health Authorities.” Under HIPAA, covered organizations are permitted to disclose needed PHI without individual authorization to “Public Health Authorities.” Such authority is an agency or authority of the United States government, a State, a territory, a political subdivision of a State or territory, or Indian tribe that is responsible for public health matters as part of its official mandate, as well as a person or entity acting under a grant of authority from, or under a contract with, a public health agency. For example, the Centers for Disease and Prevention Control (“CDC”) or the Connecticut Department of Health are Public Health Authorities and you may disclose PHI to them without an individual’s authorization. Therefore, confirm that the purported entity requesting or seeking information qualifies as a Public Health Authority or you may violate HIPAA.
  • Take care in disclosing PHI to an individual’s family, friends and others involved in their care. Generally, organizations may disclose an individual’s PHI to his or her family members, relatives, friends or other persons identified by the individual as involved in his or her care with verbal permission from the individual or without such permission, if the Organization can reasonably infer the person does not object. In this situation, organizations should take care to only disclose to family and friends who have been identified by the individual where possible. If the individual is incapacitated or not available, Organizations may share relevant information with family, friends, or others involved in the individual’s care or payment for care if it determines, based on professional judgment, that doing so is in the best interest of the patient.
  • Take care in notifying others of potential exposure. There will inevitably be circumstances under which an individual who tests positive for the Coronavirus may have exposed others to the virus. You may wish to notify an individual not named by the patient of the potential exposure. In this situation, the Organization may disclose the infected individual’s PHI to a person if there is a serious and imminent threat to the person. HIPAA laws defer to the professional judgment of health professionals in determining the severity of the threat to health and safety. However, please note that these determinations are evaluated on a case-by-case basis and, although the Coronavirus is serious, not every situation may meet the standard for disclosure. Currently, Organizations are not obligated to notify individuals of potential exposure.
  • Encourage employees to avoid gossiping and/or discussing PHI. Remind your employees of key HIPAA rules such as role-based access, confidentiality, and the authorized uses and disclosures of an individual’s PHI and that following such rules is critical in this time.

Safety In The Workplace

Organizations should be aware that all Occupational Safety and Health Administration (“OSHA”) standards apply. Of critical importance is OSHA’s general duty clause, which requires Organizations to provide a safe and healthy workplace. Further, Organizations should follow OSHA’s standards regarding bloodborne pathogens, hazard assessments and respirators. OSHA’s bloodborne pathogens standards prescribe the safeguards to protect workers against the hazards associated with the pathogens and can be found here. OSHA’s hazard assessments provide guidance on what personal protective equipment (“PPE”) should be used. Lastly, OSHA’s respirator standards apply to those who use masks, which are considered respirators. Organizations should ensure that anyone wearing or who is to wear a respirator can wear it properly. OSHA has provided general guidance on hospitals and respirators, which can be found here and also guidance in light of the Coronavirus, which can be found here.

Work Restrictions For Healthcare Personnel Exposed to Coronavirus

The CDC has also provided guidance for organizations on how to assess risk, monitor, and set work restrictions for Healthcare Personnel (“HCP”) who have been exposed to the Coronavirus. It has provided a table which provides recommendations for work restrictions and monitoring for COVID-19 symptoms depending on the severity and context of the exposure. In making assessments, the CDC recommends that Organizations take a conservative approach.

Epidemiologic risk factors Exposure category Recommended Monitoring for COVID-19 (until 14 days after last potential exposure) Work Restrictions for Asymptomatic HCP
Prolonged close contact with a COVID-19 patient who was wearing a facemask (i.e., source control)
HCP PPE: None Medium Active Exclude from work for 14 days after last exposure
HCP PPE: Not wearing a facemask or respirator Medium Active Exclude from work for 14 days after last exposure
HCP PPE: Not wearing eye protection Low Self with delegated supervision None
HCP PPE: Not wearing gown or glovesa Low Self with delegated supervision None
HCP PPE: Wearing all recommended PPE (except wearing a facemask instead of a respirator) Low Self with delegated supervision None
Prolonged close contact with a COVID-19 patient who was not wearing a facemask (i.e., no source control)
HCP PPE: None High Active Exclude from work for 14 days after last exposure
HCP PPE: Not wearing a facemask or respirator High Active Exclude from work for 14 days after last exposure
HCP PPE: Not wearing eye protectionb Medium Active Exclude from work for 14 days after last exposure
HCP PPE: Not wearing gown or glovesa,b Low Self with delegated supervision None
HCP PPE: Wearing all recommended PPE (except wearing a facemask instead of a respirator)b Low Self with delegated supervision None

HCP=healthcare personnel; PPE=personal protective equipment

aThe risk category for these rows would be elevated by one level if HCP had extensive body contact with the patients (e.g., rolling the patient).

bThe risk category for these rows would be elevated by one level if HCP performed or were present for a procedure likely to generate higher concentrations of respiratory secretions or aerosols (e.g., cardiopulmonary resuscitation, intubation, extubation, bronchoscopy, nebulizer therapy, sputum induction). For example, HCP who were wearing a gown, gloves, eye protection and a facemask (instead of a respirator) during an aerosol-generating procedure would be considered to have a medium-risk exposure.

Screening of Visitors

Governor Ned Lamont has issued several Executive Orders in response to the pandemic, including Executive Orders 7 and 7A, which address visitors to all Connecticut nursing home facilities, residence care homes, or chronic disease hospitals. Pursuant to Executive Order 7A, all Connecticut nursing home facilities, residence care homes or chronic disease hospitals must impose a complete ban on all visitors for a period of thirty days until April 13, 2020. However, there is an exception for reasonable access to the following individuals provided that certain criteria is met:

  •  First responders, including emergency medical services, law enforcement, firefighting and other emergency management personnel;
  • Family members, domestic partners or other persons designated by a patient only when the facility’s Medical Director, a licensed physician or advanced practice registered nurse has determined such patient to be at the end stage of life with death being imminent;
  • Any person authorized by law to oversee or investigate the provision of care and services; and
  • Service providers who are required to do maintenance or repair necessary without delay for the facility’s continued operation.

Before such visitor can be permitted entry, the Organization must first perform a risk screening of the visitor for Coronavirus, with the use of appropriate PPE in accordance with the CDC guidelines, if necessary. The risk screening should include, but not be limited to, recent travel history, contact with a person presumed or confirmed positive for Coronavirus, a fever of 100 degrees or greater, coughing, sore throat, sneezing, shortness of breath and recent travel by airplane. Organizations should deny entrance to any visitor who does not pass the screening or who it determines, in its discretion, meets one of the criteria described above.

Temporary Reciprocity of Health Care Practitioner Licenses

On March 23, 2020, the Connecticut Commissioner of the Department of Public Health issued an order permitting physicians, nurses, respiratory care practitioners, emergency medical services personnel and other health care practitioners who are licensed in another state to provide temporary assistance in Connecticut for a period of 60 days. The order is subject to the following conditions:

  • No practitioner may provide services beyond the scope of practice permitted under Connecticut law relating to the applicable profession; and
  • Each practitioner must maintain malpractice and other applicable insurance.