In guidance issued today, DHHS’ Office for Civil Rights (OCR) explained that healthcare providers may use patient information to contact recovered COVID-19 patients and provide information about donating blood and plasma. OCR considers such a communication to be a population-based health care operations activity, as the blood products may help other COVID-19 patients, and therefore, no authorization is needed. If, however, the communication constitutes marketing of a product or service in which the provider has a direct or indirect financial interest, an authorization would be necessary. While the provider may contact patients for the above healthcare operations purpose or engage a business associate to do so, the provider may not simply give the contact information of recovered COVID-19 patients to a donation center without the patient’s written authorization.
