With the recent spread of coronavirus (2019-nCoV), it is an
important time to examine what information employers may share
under HIPAA’s Privacy Rule during an outbreak of infectious
disease or other emergency situation.
First, note that HIPAA applies only to “covered
entities” and “business associates.”
Specifically, the HIPAA Privacy Rule applies only to disclosures
made by employees, volunteers, and other members of a covered
entity’s or business associate’s workforce. Generally,
covered entities are health plans, health care clearinghouses, and
certain health care providers, while business associates perform
specific services for covered entities that provide access to
personal health information (“PHI”)—i.e.,
individually identifiable health information that is maintained or
transmitted by a covered entity.
