skip to main content


Health and Human Services Addresses Ebola and Other Public Health Emergencies

November 11, 2014

Last evening, the United States Department of Health and Human Services (DHHS), Office for Civil Rights (OCR) issued a Bulletin entitled “HIPAA Privacy in Emergency Situations”.  This Bulletin was released as a result of the recent Ebola outbreak.  According to OCR, the purpose of the Bulletin is to ensure that covered entities and their business associates understand what information may be shared in an emergency situation.  While there are no changes in the law, the Bulletin does provide some guidance to covered entities when dealing with disclosures involving public health emergencies.  We link the Bulletin for your review and provide a brief outline of the issues addressed by OCR.

  • Disclosures for Treatment Purposes - the current rules remain intact in that disclosures for treatment are permissible, including for health care coordination and referrals to other providers
  • Disclosures for Public Health Activities - the current rules remain intact and covered entities may disclose to federal, state and local public health authorities or to persons at risk of contracting or spreading a disease if permitted by law
  • Disclosures to Families, Friends and Others Involved in an Individual’s Care - the current rules remain intact and covered entities may disclose health information to persons identified by the patient as involved in the patient’s care
  • Disclosures to Prevent or Lessen Imminent Danger - the current rules remain intact and covered entities may share health information with anyone as necessary to prevent or lessen a serious and imminent threat to the health and safety of a person or the public
  • Disclosures to the Media - patient authorization still required to disclose specific information to the media

OCR uses the Bulletin to remind providers that HIPAA is not suspended during a public health or other emergency, unless the President and the Secretary of DHHS declare a public health emergency and the Secretary waives enforcement of HIPAA under limited circumstances.  Of course, in all instances, if state law is stricter, the state law will govern regarding the disclosure.

Shipman & Goodwin recommends that covered entities review the Bulletin to ensure compliance in the event of a public health emergency and or media inquiries.

If you have any questions, please contact any member of Shipman & Goodwin’s Health Law Practice Group.

© Shipman & Goodwin LLP 2020. All Rights Reserved.