Journal of Urgent Care Medicine

Practice Management

What Are the Reporting Obligations of Urgent Care Centers for COVID-19 Patients?

Published on

Alan A. Ayers, MBA, MAcc is Chief Executive Officer of Velocity Urgent Care and is Practice Management Editor for The Journal of Urgent Care Medicine. 

Urgent message: Many patients are deterred from getting a COVID-19 or antibody test because they fear being added to a government “surveillance list” or harassment (tracing) of their “contacts.” While urgent care centers or their third-party labs are required to report individual test results, they can assure patients that datasets are typically de-identified and aggregated when further analyzed or reported to the CDC.

Introduction

Some urgent care patients are concerned about getting a COVID-19 or antibody test because they fear the stigma of contact tracing, surveillance, or permanently being placed on some kind of list (ie, “immunity passports”).1 This concern is unfounded, as there are too many unknowns surrounding COVID-19 and many medical experts argue that these immunity passports could do more harm than good.2

Background

While personal health information (PHI) regarding the coronavirus must be reported to state or local health departments and the Centers for Disease Control and Prevention, those data are primarily de-identified or stripped of personal information when examined and analyzed.

The U.S. Department of Health and Human Services (HHS) recently reiterated this use of de-identified data in a new Laboratory Data Reporting Guidance for COVID-19 Testing3 and related Frequently Asked Questions.4 This new Guidance states that—in addition to providing the results of COVID-19 testing—laboratories will now be required to report demographic information, including the patient’s age, race, ethnicity, sex, residence zip code, and county.4

While the Guidance also recommends reporting the patient’s name, street address, date of birth, and address, and the phone number of the ordering provider to state and/or local public health departments, these data would not be collected by the CDC or HHS. Also, the data for each test completed must be submitted within 24 hours of the results being known or determined, providing public health officials with nearly real-time data.4,5

The COVID-19 testing data reporting is designed to address the outbreak, and an emphasis is placed on protecting the community by accurately locating origins to stop its spread. The Guidance also states that state and local privacy standards apply to the collection of these data elements.6 Further, the HHS says that “[n]othing in this guidance changes the existing requirements for HIPAA covered entities and business associates to comply with the applicable HIPAA Privacy, Security, and Breach Notification Rules.”6

Also, the Coronavirus Aid, Relief, and Economic Security (CARES) Act7 requires “every laboratory that performs or analyzes a test that is intended to detect SARSCoV-2 or to diagnose a possible case of COVID-19” to report the results from each such test to the Secretary of the Department of Health and Human Services (HHS).8 The CARES Act authorizes HHS to prescribe the form and manner, and timing and frequency, of such reporting.8

Reporting Requirements for Urgent Cares

An urgent care cannot see patients anonymously, and the threat of medical identity theft and insurance/Medicare/Medicaid fraud are real; thus, for audit purposes, a facility must maintain a copy of the patient’s ID in its electronic system to make certain that the person treated is the same as the person who is billed.

Because of these concerns and the need for accuracy in treatment, urgent care centers must understand their reporting requirements with regard to symptomatic COVID-19 patients, positive results for the test for the live virus, and antibody testing that shows past infection.

The AMA Code of Medical Ethics

The AMA Code of Medical Ethics provides the obligation that physicians “have an ethical obligation to preserve the confidentiality of information gathered in association with the care of the patient.”9 Further, the AMA guidelines require physicians to report their colleagues to the state licensing board when their conduct “poses an immediate threat to the health and safety of patients or violates state licensing provisions.”10 However, the AMA does warn that “[i]nappropriate disclosure of personal health information may expose the patient to risks of discrimination, stigmatization or other harm.”11 The AMA has provided resources to its members for all aspects of fighting the disease, including privacy and test result reporting.12

The HIPAA Privacy Rule

Urgent care owners and managers must apply a strict interpretation of HIPAA that enables them to release medical records or PHI only to the patient. In any other circumstance, a release from the patient is required for PHI to be provided to a family member, specialist, or a PCP.13

The HIPAA Privacy Rule protects the privacy of patients’ PHI but is “balanced to ensure that appropriate uses and disclosures of the information still may be made when necessary to treat a patient, to protect the nation’s public health, and for other critical purposes.”14,15

One exception to HIPAA includes public health reporting.16 The HIPAA Rule provides for an exception of sharing patient information to a public health authority, such as the CDC or a state or local health department, that is authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury or disability.16 HHS states that “a covered entity may disclose to the CDC protected health information on an ongoing basis as needed to report all prior and prospective cases of patients exposed to or suspected or confirmed to have Novel Coronavirus (2019-nCoV).”16 Further, HHS allows the disclosures of PHI to prevent a serious and imminent threat:

Healthcare providers may share patient information with anyone as necessary to prevent or lessen a serious and imminent threat to the health and safety of a person or the public – consistent with applicable law (such as state statutes, regulations, or case law) and the provider’s standards of ethical conduct.16

As a result, it is clear that urgent cares have an obligation and are protected in their efforts to report COVID-19 testing results.

The CDC advises that clinicians considering diagnostic testing of people with possible COVID-19 “should continue to work with their local and state health departments to coordinate testing through public health laboratories, or work with commercial or clinical laboratories using diagnostic tests authorized for emergency use by the U.S. Food and Drug Administration.”17

Reporting to State or Local Health Departments

The CDC has provided guidelines for diagnostic testing for COVID-19 and directs clinicians to report positive test results to their local or state health department only.18,19 Further, all U.S. hospital laboratories should submit their COVID-19 testing information electronically to their state or large local health department. That agency subsequently will deliver de-identified reports to the CDC, which then will submit the data to the federal Department of Health and Human Services’ HHS Protect System.20

De-identified data—which is aggregate statistical data or data stripped of individual identifiers—do not require individual privacy protections and are not covered by the Privacy Rule.21

The CDC has a COVID-19 Case Report Form that asks for information on COVID-19 case-patients. It includes a request for demographic, clinical, and epidemiologic characteristics; exposure and contact history; and the course of clinical illness and care received.22,23 State health agencies have also provided guidance for COVID-19 reporting. For example, COVID-19 is a notifiable condition under Texas statute. All suspected and confirmed cases are to be called immediately to the local health department.24

Takeaway

Urgent care centers, like other healthcare providers, must report PHI regarding coronavirus testing to state or local health departments and the CDC. However, employees can explain that these data are primarily de-identified or stripped of personal information, when examined and analyzed. These data sets are critical for fighting further disease outbreak and for a safe and phased reopening.25

Again, HIPAA expressly exempts public health reporting from its patient privacy requirements. It is only to address the pandemic that personal information is divulged. It is not to create an “immunity passport” or to in any way infringe on the freedoms of individuals.

References

  1. World Health Organization. Scientific Brief: “Immunity passports” in the context of COVID-19. April 24, 2020. Available at: https://www.who.int/news-room/commentaries/detail/immunity-passports-in-the-context-of-covid-19. Accessed June 17, 2020.
  2. Kofler N, Baylis F. Comment: ten reasons why immunity passports are a bad idea. Nature. May 21, 2020. Available at: https://www.nature.com/articles/d41586-020-01451-0. Accessed June 17, 2020.
  3. S. Department of Health and Human Services. COVID-19 Pandemic Response, Laboratory Data Reporting: CARES Act Section 18115. June 4, 2020. Available at: https://www.hhs.gov/sites/default/files/covid-19-laboratory-data-reporting-guidance.pdf. Accessed June 17, 2020.
  4. S. Department of Health and Human Services. frequently asked questions: laboratory data reporting for COVID-19 testing. Available at: https://www.hhs.gov/sites/default/files/laboratory-data-reporting-for-covid-19-testing-faqs.pdf. Accessed June 17, 2020.
  5. Dunham CC IV, Koepke CM. HHS laboratory data reporting guidance for COVID-19 testing. Nat Rev. June 6, 2020. Available at: https://www.natlawreview.com/article/hhs-laboratory-data-reporting-guidance-covid-19-testing. Accessed June 17, 2020.
  6. S. Department of Health and Human Services. COVID-19 pandemic response, laboratory data reporting: CARES Act section 18115.
  7. Public Law 116-136, § 18115(a).
  8. Public Law 116-136, § 4201.
  9. American Medical Association. Code of Medical Ethics Opinion2.1.
  10. American Medical Association. COVID-19: frequently asked questions. Updated April 30, 2020. Available at: https://www.ama-assn.org/delivering-care/public-health/covid-19-frequently-asked-questions. Accessed June 17, 2020.
  11. American Medical Association. Use of patient registries during public health emergencies. Updated April 13, 2020. Available at: https://www.ama-assn.org/delivering-care/ethics/use-patient-registries-during-public-health-emergencies. Accessed June 17, 2020.
  12. American Medical Association. COVID-19 (2019 novel coronavirus) resource center for physicians (2020). Available at: https://www.ama-assn.org/delivering-care/public-health/covid-19-2019-novel-coronavirus-resource-center-physicians. Accessed June 17, 2020.
  13. See S. Department of Health & Human Services, Office for Civil Rights. Press release. OCR issues bulletin on civil rights laws and HIPAA flexibilities that apply during the COVID-19 emergency. March 28, 2020. Available at: https://www.hhs.gov/about/news/2020/03/28/ocr-issues-bulletin-on-civil-rights-laws-and-hipaa-flexibilities-that-apply-during-the-covid-19-emergency.html. Accessed June 17, 2020.
  14. S. Department of Health & Human Services, Office for Civil Rights. Bulletin: HIPAA privacy and novel coronavirus. February 2020. Available at: https://www.hhs.gov/sites/default/files/february-2020-hipaa-and-novel-coronavirus.pdf. Accessed June 17, 2020.
  15. S. Department of Health & Human Services, Office for Civil Rights. Press release. OCR announces notification of enforcement discretion for community-based testing sites during the COVID-19 nationwide public health emergency. April 9, 2020. Available at: https://www.hhs.gov/about/news/2020/04/09/ocr-announces-notification-enforcement-discretion-community-based-testing-sites-during-covid-19.html. Accessed June 17, 2020.
  16. S. Department of Health & Human Services. Bulletin: HIPAA privacy and novel coronavirus. Available at: https://www.hhs.gov/sites/default/files/february-2020-hipaa-and-novel-coronavirus.pdf. Accessed June 17, 2020.
  17. Centers for Disease Control and Prevention. Evaluating and testing persons for coronavirus disease 2019 (COVID-19). Updated May 5, 2020. Available at: https://www.cdc.gov/coronavirus/2019-nCoV/hcp/clinical-criteria.html. Accessed June 17, 2020.
  18. Centers for Disease Control and Prevention. The interim guidelines for collecting, handling, and testing clinical specimens from PUIs for COVID-19. Available at: https://www.cdc.gov/coronavirus/2019-ncov/lab/guidelines-clinical-specimens.html. Accessed June 17, 2020.
  19. Centers for Disease Control and Prevention. Biosafety FAQs for handling and processing specimens from possible cases and PUIs. Available at: https://www.cdc.gov/coronavirus/2019-ncov/lab/biosafety-faqs.html. Accessed June 17, 2020.
  20. Centers for Disease Control and Prevention. Coronavirus disease 2019 (COVID-19), how to report COVID-19 laboratory data. May 20, 2020. Available at: https://www.cdc.gov/coronavirus/2019-ncov/lab/reporting-lab-data.html. Accessed June 17, 2020.
  21. Centers for Disease Control and Prevention. HIPAA privacy rule and public health, guidance from CDC and the U.S. Department of Health and Human Services. MMWR. 2020;52. Available at: https://www.cdc.gov/privacyrule/Guidance/Overview.htm.
  22. Centers for Disease Control and Prevention. Coronavirus disease 2019 (COVID-19), information for health departments on reporting cases of COVID-19. (Update May 5, 2020.) Available at: https://www.cdc.gov/coronavirus/2019-ncov/php/reporting-pui.html. Accessed June 17, 2020.
  23. Council of State and Territorial Epidemiologists. CSTE interim position statement: COVID-19 case definition and addition to the NNC list. April 9, 2020. Available at: https://www.cste.org/news/500750/CSTE-Interim-Position-Statement-COVID-19-Case-Definition-and-Addition-to-th.e-NNC-List.htm. Accessed June 17, 2020.
  24. Texas Health and Human Services. Infectious disease control, notifiable conditions. (Updated February 14, 2020.) Available at: https://www.dshs.texas.gov/idcu/investigation/conditions/. Accessed June 17, 2020.
  25. Pifer R. Months into pandemic, Trump admin mandates labs report demographic data of COVID-19 tests. Healthcare Dive. June 5, 2020. Available at: https://www.healthcaredive.com/news/months-into-pandemic-trump-admin-mandates-labs-report-demographic-data-of/579237/. Accessed June 17, 2020.

 

What Are the Reporting Obligations of Urgent Care Centers for COVID-19 Patients?

Alan A. Ayers, MBA, MAcc

President of Experity Consulting and is Practice Management Editor of The Journal of Urgent Care Medicine