According to the New York Times, Bellevue Hospital Center patient Craig Spencer, the first New Yorker to be infected with Ebola, is scheduled to be released today. And while the intense reporting about Ebola has subsided, perhaps indicating a lowering of the perceived threat of Ebola spreading further in the U.S. (although many continue to be under surveillance) companies should remain vigilant and be sure they are prepared. To that end, the agency responsible for enforcing the HIPAA privacy and security regulations, the Office for Civil Rights, issued a bulletin – HIPAA Privacy in Emergency Situations.

In emergency situations, uncertainty and a lack of preparedness can inhibit a health care provider or health plan’s ability to act. That uncertainty can include concerns about whether certain information can be used or disclosed. The OCR’s Bulletin provides helpful guidance for providers and plans, as well as business associates, so that they can be prepared to act in accordance with the HIPAA privacy requirements, which the Bulletin affirms is not suspended during a public health or other emergency. The Bulletin reminds covered entities and business associates that “protected health information” CAN be disclosed in connection with treatment without the authorization of the individual. It also provides a short summary of the rules for making disclosures in connection with certain public health activities, such as disclosures to public health authorities.

Responding to media inquiries is a significant concern for providers, and the bulletin addresses that. It reiterates that a hospital or other health care facility can, upon request for information about a particular patient by name, disclose limited facility directory information to acknowledge an individual is a patient at the facility and provide basic information about the patient’s condition in general terms. This is the case so long as the patient has not objected to or restricted the release of such information or, if the patient is incapacitated, the disclosure is believed to be in the best interest of the patient and is consistent with any prior expressed preferences of the patient. However, except in limited cases, affirmative reporting to the media or the public at large about an identifiable patient, or the disclosure to the public or media of specific information about treatment of an identifiable patient, may not be done without the patient’s written authorization (or the written authorization of the patient’s personal representative).

The Bulletin also reminds the reader that HIPAA only applies to covered entities and business associates. It does not apply to employers. However, employers need to be mindful of other federal and state laws that protect the confidentiality of employee medical information, such as the Americans with Disabilities Act and the Genetic Information Nondiscrimination Act.

The Bulletin could provide a helpful training or refresher resource for covered entities and business associates to help their workforce members be prepared for all emergency situations, not just another Ebola case.