Contacting Former COVID-19 Patients about Blood and Plasma Donation-HIPAA Privacy Rule Guidance:

The HIPAA Privacy Rule permits HIPAA Covered Healthcare Providers to use Protected Health Information (PHI) to identify and contact their former patients who have recovered from COVID-19 and instruct them on how to donate their blood and plasma (Convalescent plasma), as it contains antibodies that can help treat other patients diagnosed with COVID-19.

Such use of those patients’ Protected Health Information (PHI) for such specific purposes is permitted as a population-based healthcare operations activity of the Covered Healthcare Providers: The facilitation of the supply of donated blood and plasma will improve their ability to conduct case management for patients’ populations susceptible to infection of COVID-19.

Patients’ signed authorization is not required as long as such activity is not for marketing purposes.

The Minimum Necessary Rule applies, as such specific use or disclosure is for healthcare operations.