HIPAA Doesn’t Apply To The Media And Employers

Donald Trump Jr. has recently tested positive for Covid-19. (Photo by Paul Hennessy/SOPA … [+] Images/LightRocket via Getty Images)

SOPA Images/LightRocket via Getty Images

There appears to be some confusion about whether the media can report on a person having Covid-19. Sometimes it is erroneously assumed that all health information is protected, period. This has especially become an issue when someone well-known has contracted Covid-19, or when an employee has tested positive for it. The latest issue surrounds Donald Trump Jr.’s diagnosis of Covid-19 and the reporting of it by the media.

Donald Trump Jr.’s spokesperson provided the information on Mr. Trump’s diagnosis to the media, as confirmed by NBC News White House correspondent Peter Alexander.

Richard Grenell, the former Acting Director of U.S. National Intelligence, tweeted, “Reporters need to stop announcing protected health information. This is a violation of HIPAA rules.” This is an incorrect statement.

David Lytle, a writer and editor, responded to Grenell with correct information —journalists are not a covered entity under HIPAA and are within their rights to report health information. Grenell said in response to David Lytle, “Your industry is hated by the public because you justify disclosing someone’s personal health data,” repeating an oft-used theme in the Trump administration that journalists and media are “the enemy of the people.” Again, Lytle is correct in his statement, and Grenell gave false information.

The U.S. Health Insurance Portability and Accountability Act (HIPAA) must be followed by “covered entities,” including health insurance companies, Medicare, Medicaid, health care providers, and health care clearinghouses such as the Medical Information Bureau. That does not include the media. Other entities that must follow parts of HIPAA include medical billing companies, IT specialists, particularly those that work in healthcare, and companies that store and destroy medical records.

Who is not required to follow HIPAA? The list includes employers, school districts, state child protective services agencies, law enforcement agencies, and the media.

If medical staff disclosed health information to a reporter, and the medical staff did not have permission from the patient, the medical staff may have violated HIPAA, but the reporter has not. Reporters and journalists do have a code of ethics to follow. The Society of Professional Journalists (SPJ) states that ethical journalism is “accurate, fair, and thorough.”

In the case of Donald Trump Jr., the fact that Trump and other members of his family have refused to wear masks during a pandemic when surrounded by other people already make a Covid-19 diagnosis relevant news. Through their behavior, they have made a diagnosis of Covid-19 amongst their ranks relevant and newsworthy — particularly when they are holding rallies without masks.

Using the SPJ’s “accurate, fair, and thorough” test, reporting on Donald Trump Jr.’s diagnosis of Covid-19, especially when that diagnosis was disclosed by Trump’s spokesperson, passes all three prongs.

You may have noticed that employers are not required to abide by HIPAA. This means that if a coworker in your vicinity has tested positive for Covid-19, your employer is erroneous in stating that they can’t disclose cases of Covid-19 to employees “due to HIPAA regulations.”

Your employer is not barred from disclosing that a person on your floor or work area tested positive for Covid-19. Your employer can also require all employees to disclose that they have tested positive for Covid-19 or have been in contact with someone who has contracted it. Employers can also require you to report if you or anyone you’ve been in contact with has had symptoms of Covid-19, such as a fever or coughing.

You may wonder what role the Americans with Disabilities Act (ADA) has in Covid-19 diagnosis disclosure. According to the ADA, employers are allowed to ask employees for sensitive medical information if it constitutes a direct threat to others in the workplace. Covid-19 does qualify as a direct threat.

To reiterate, organizations and individuals who provide healthcare or process healthcare information are covered entities under HIPAA. The media and your employer are not covered entities. The media has the right to report on a person’s Covid-19 diagnosis, especially when it is a matter of national importance, and especially when the person has had contact with others while not wearing a mask. Keep in mind that some have only found out that they were in contact with an infected person after they saw it on the news.