Dear Colleagues:

The COVID-19 crisis represents an unprecedented national emergency. Regulators have relaxed certain HIPAA standards and expectations in connection with good faith provisions to enable the use of telehealth during the pandemic. Covered health care providers, however, are still required to comply with all other HIPAA Rules. We’ve provided the following reminders to ensure that we continue to employ best practices related to patient privacy.

General Guidelines

• Do not share protected health information (PHI) with others who shouldn’t have access, including co-workers or personal acquaintances. During this time of increased stress on the healthcare system and on us as individuals, it’s still important for us to avoid discussing patient cases except as part of the care plan.

• Avoid accessing a patient’s medical record unless it is needed for your work on the care team or you have written permission from the patient. During a time when the spread of rumors and gossip about infection rates can increase anxiety and panic, it’s even more important for us to focus only on the information we need to provide immediate care and treatment.

• Minimize the potential for unauthorized personnel to overhear patient information during conversations. All our teams are especially busy right now and the system is stressed. Please remember that our patients must still be treated with respect and that discussions about care and treatment should be managed appropriately.

Minimum Necessary

The “minimum necessary” standard still applies to ensure appropriate and limited distribution of PHI. Healthcare professionals must make reasonable efforts to ensure that any PHI disclosed is restricted to the minimum necessary information to achieve the purpose for which the information is being disclosed.

Social Media

Social media can be a powerful tool that offers health care providers new and efficient ways to share information, to debate health care policy and practice issues, to promote health behaviors, to engage with the public, and to educate and interact with patients, caregivers, students, and colleagues. When using social media platforms, we must balance the benefits of the medium against the importance of protecting patient privacy. 

As a reminder, the HIPAA Privacy Rule prohibits the distribution of PHI on social media networks. That includes information about specific patients as well as images or videos that could result in a patient being identified. PHI can only be included in social media posts if a patient has given their consent, in writing, to allow their PHI to be used and then only for the purpose specifically mentioned in the consent form. Social media channels can be used for posting health tips, details of events, new medical research, bios of staff, and for marketing messages, provided no PHI is included in the posts.

Telecommuting

We must exercise good judgement and caution when working remotely. In particular, records and discussions that include PHI should be handled in the same manner and with the same concern for privacy as they should have been within your office or clinical setting before the current healthcare crisis.  Hard copy, sensitive records should be secured both in the alternate work site and when being transported between that site and your office or clinic.

In the midst of the COVID-19 crisis, many of our units are adopting telehealth as a means to interact with patients. Reasonable steps should be taken to ensure that those patient interactions and the information discussed are not disclosed to those who do not have a need to know. 

During this unprecedented time, we appreciate your continued support in providing the best patient care while maintaining and respecting the privacy of our patients.

Privacy Liaisons/ Contacts

If you have any questions or concerns, please contact your unit’s privacy liaison or healthcare compliance officer.

Sincerely,

Brian L. Strom, MD, MPH
Executive Vice President for Health Affairs, Rutgers University
RBHS Chancellor

Vicente H. Gracias, MD 
Vice President for Health Affairs, Rutgers University
RBHS Senior Vice Chancellor for Clinical Affairs                                                                      
                                                                  
Timothy J. Fournier
Senior Vice President and Chief ERM, Ethics, Audit, and Compliance Officer