Managing Privacy Issues and COVID-19 at Independent Living Facilities and Age-Restricted Housing Communities

As COVID-19 cases continue to spike, people are afraid, especially seniors who are more susceptible to the disease. Understandably, when an infection occurs, residents of independent living facilities and age-restricted housing communities want to have as much information as possible. Owners, operators, workers, agents and volunteers of independent living facilities and age-restricted housing communities, however, should strive to maintain confidentiality and remain cognizant of federal privacy laws.

The Health Insurance Portability and Accountability Act Privacy Rule (the “HIPAA Privacy Rule”) requires covered entities and their business associates to implement safeguards to protect the privacy of personal health information. As a general rule, personal health information may not be disclosed without patient authorization; however, limited exceptions may apply. Covered entities include healthcare providers, health plans and healthcare clearinghouses, as well as their respective business associates.

Although independent living facilities and age-restricted housing communities may not appear to be covered entities, the CDC advises that they maintain confidentiality in accordance with the HIPAA Privacy Rule. To inform the community that a fellow resident has the virus, the CDC recommends placing signage in common areas and at entrances/exits informing all residents, workers, volunteers and visitors of the possible COVID-19 exposure.

If you would like to provide more information to the residents, a letter can be sent to the community. Sending a letter can allow the community to inform the residents of the measures that have been taken to stop the spread of the virus. However, it is imperative that the personal information of those infected is not disseminated in these letters. In addition to protecting the person’s privacy, maintaining the confidentiality of those who may be infected helps to counter stigma and discrimination that is often associated with the virus.

As noted above, certain exceptions apply to the HIPAA Privacy Rule, which may allow a covered entity or their business associates to disclose personal health information without the patient’s authorization. None of these exceptions, however, would allow for the disclosure of personal health information to a private individual. Rather, these exceptions exist to allow for the disclosure of personal health information to a public health authority or health oversight agency.

On May 5, 2020, in light of the COVID-19 pandemic, the Health and Human Services Office for Civil Rights announced enforcement discretion to allow for the use and disclosure of protected health information by business associates . The enforcement discretion only applies to disclosures made to a public health authority, such as the CDC, or health oversight agency.

As a best practice, independent living facilities and age-restricted communities should strive to adhere to the HIPAA Privacy Rule. During times like these, it is important that all of us, especially our seniors, feel safe in our community. Maintaining trust and confidentiality with senior residents will only help to strengthen that safety.