The Office for Civil Rights (OCR) at the U.S. and Human Services (HHS) posted a bulletin to provide notice related to sharing patient information under the HIPAA Privacy Rule due to the outbreak of infectious disease or other emergency situation. HIPAA Privacy Rule protections are not set aside during an emergency. For further information, the US Department of Health and Human Services has issued a bulletin on HIPAA and the novel coronavirus.
The California Consumer Protection Act (CCPA) currently requires certain employers to provide job applicants, new hires, and current employees with a notice stating the categories of personal information collected and the business purposes for which that personal information will be used. If employers begin to collect medical information such as customer or employee temperature or COVID-19 testing results, employers may need to modify and/or issue new notices identifying medical information as a category. CCPA notices should be provided at or before the collection of personal information.