The information below provides COVID-19-related guidance to Nevada consumers.
Patient Privacy Laws
In order to protect public health and safety, there are state and federal laws in place regarding patient privacy. Though we are all concerned about our own health, we need to recognize that these laws are in place to protect private citizens and we should respect their personal information.
What Laws Govern a Patient’s Private Health Information?
NRS 441A.220 prohibits disclosing personal health information without the consent of the individual except in limited circumstances. This information cannot be disclosed even with a search warrant, subpoena or discovery proceeding in a lawsuit. The health authority can only disclose the information necessary to assist the public in controlling or preventing communicable disease without violating the rights of any individual to their own personal health information. Regulations and policies of local health districts further implement this law.
Additional federal laws, such as the Health Insurance Portability and Accountability Act (HIPAA), may also apply. The HIPAA Privacy Rule is a national standard to protect individuals’ medical records and other personal health information. Entities that must follow the HIPAA regulations include health insurance companies, government programs that pay for health care (Medicare and Medicaid), and health care providers (doctors, nurses, hospitals, etc.). Some local health districts and public health authorities provide direct health care services, so they also comply with HIPAA.
What Information Can the Health Authority Disclose About a Case or Suspected Case of COVID-19?
The public health authority can publicly provide statistical information as long as the information does not identify any person who has or has been exposed to COVID-19. [NRS 441A.220(2)]
The public health authority can disclose specific, limited personal health information to the following:
If an exception allows disclosure, it is limited. The health authority may only disclose information to those who have been exposed or are likely to be exposed sufficiently to acquire COVID-19. Only information which is necessary to protect another person’s health may be disclosed. [NAC 441A.300(2-3)]
The protection of first responders, including emergency medical service personnel, police officers, and firefighters, is critical to the protection of the community. Due to the recent spread of the disease, COVID-19 is not specifically listed as a communicable disease in the regulation which directly authorizes disclosure to first responders upon an exposure likely to cause transmission. [NAC 441A.305(1)(b) and (2)] First responders who have been exposed, however, fall under the exception as a person who has a medical need to know the information for their own protection or well-being. Whether someone has a medical need to know another person’s health information is determined by the relevant health authority and may be subject to federal privacy laws. [NRS 441A.220(6); NAC 441A.300(1)(a)]
Why do Public Health Authorities Protect the Personal Information of Individuals Who Have or May Have Been Exposed to COVID-19?
They must do so under the law. The public health authority must comply with the law to maintain the confidentiality of personal information.
It is critical that people are honest and accurate about where they have been and what they have done so that the public health authorities can identify all persons who may be exposed. Individuals would be less likely to cooperate with public health officials and provide personal information if they fear their personal information will be released to the public.
What is the Penalty for Unauthorized Disclosure of Personal Health Information?
Violating Nevada’s patient privacy laws is a crime punishable as a misdemeanor. [NRS 441A.910]