HIPAA Does NOT Apply To School Districts, Communicable Diseases

BOCA RATON, FL (BocaNewsNow.com) — Any one claiming the HIPAA — the Health Insurance Portability and Accountability Act — prevents them from releasing COVID-19 infection information should spend some time reading the law. HIPAA is enforced for healthcare providers. Not school districts. But even if a school district claimed that it’s a health care provider because there’s a school nurse to treat bumps and bruises, it still wouldn’t prevent the school district from releasing vital information.

From the National Institutes of Health:

What are the legal exceptions when health care professionals can breach confidentiality without permission?

• Gunshot wound
• Stab wound
• Injuries sustained in a crime
• Child/Elderly abuse
• Infectious, communicable or reportable diseases

COVID-19 is an infectious, communicable disease. So for leaders of the Palm Beach County School District — even area colleges and universities — to declare that they can’t or won’t release information due to HIPAA shows how truly uneducated, or scared, those leaders truly are.

The CDC even adds that the “protected” part of the act only applies to healthcare providers and medical data processors, while listing 12 exceptions to compliance. Among them, mitigating a threat to health or safety.

Here’s the CDC’s language:

A covered entity is permitted, but not required, to use and disclose protected health information, without an individual’s authorization, for the following purposes or situations:

• Disclosure to the individual (if the information is required for access or accounting of disclosures, the entity MUST disclose to the individual)
• Treatment, payment, and healthcare operations
• Opportunity to agree or object to the disclosure of PHI (Informal permission may be obtained by asking the individual outright, or by circumstances that clearly give the individual the opportunity to agree, acquiesce, or object)
• Incident to an otherwise permitted use and disclosure
• Public interest and benefit activities—The Privacy Rule permits use and disclosure of protected health information, without an individual’s authorization or permission:

1. When required by law
2. Public health activities
3. Victims of abuse or neglect or domestic violence
4. Health oversight activities
5. Judicial and administrative proceedings
6. Law enforcement
7. Functions (such as identification) concerning deceased persons
8. Cadaveric organ, eye, or tissue donation
9. Research, under certain conditions
10. To prevent or lessen a serious threat to health or safety
11. Essential government functions
12. Workers compensation

The next time someone claims that they can’t reveal COVID-19 infection information due to HIPAA, tell them that not only they can, but they must.