Spot the HIPAA Violation

SITUATION

Lab technician Khan Tajus reports to his manager that he’s just tested positive for COVID-19 coronavirus. The manager orders him to go home, talk to a doctor and stay in self-isolation for at least 14 days. He also asks Khan for the names of any lab employees with whom he’s had close contact, i.e., within six feet, in the past two days. He then calls every co-worker listed, lets them know that Khan has COVID-19 and orders them to also go into self-isolation for 14 days.

QUESTION

What, if anything, did the lab manager do wrong?

A. Order Khan to go home and self-isolate

B. Order Khan to reveal the names of co-workers with whom he had close contact

C. Tell the co-workers that Khan has COVID-19

D. Order the potentially exposed co-workers to go home

E. Nothing

ANSWER

C. The only thing the lab manager did wrong was disclose Khan’s illness to his co-workers.

EXPLANATION

The fact that Khan tested positive for COVID-19 is protected health information (PHI) that can’t be disclosed without Khan’s consent. However, consent isn’t required if the disclosure serves a legitimate employment purpose and the PHI disclosed is limited to the minimum necessary to accomplish that purpose.

The manager disclosed Khan’s diagnosis to his co-workers to protect their health and safety. And that’s a legitimate purpose, especially in time of pandemic. The problem is that the manager could have achieved that objective simply by notifying Khan’s colleagues that one of their co-workers tested positive. In mentioning Khan by name, the manager disclosed more PHI than necessary to accomplish his health and safety objective. So, C is the right answer.

WHY WRONG ANSWERS ARE WRONG

A is wrong because ordering employees and others who are confirmed to have (or even just exhibit symptoms of) COVID-19 is something employers are required to do under current public health guidelines.