Updated Guidance on HIPAA and Contacting Former COVID-19 Patients About Plasma Donation (August 2020) [open pdf - 249KB]
From the Document: "The HIPAA [Health Insurance Portability and Accountability Act] Privacy Rule permits HIPAA-covered entities (or their business associates on the covered entities' behalf) to use or disclose PHI [protected health information] for treatment, payment, and health care operations, among other purposes, without an individual's authorization. Health care operations include case management and care coordination activities that do not meet the definition of treatment (e.g., where a health plan undertakes case management or care coordination, or where a health care provider undertakes such activities in a manner that is not connected to the care of a specific individual). When using or disclosing PHI for health care operations, the covered entity must make reasonable efforts to limit the use or disclosure of PHI to the minimum necessary to accomplish the intended purpose of the use or disclosure."
U.S. Department of Health and Human Services: https://www.hhs.gov/