Here's how Idaho decides what information to release about COVID-19 cases - Idaho Press

Stephanie Winer Schreiber​, shareholder in the firm's Healthcare section, was quoted in an Idaho Press article "Here's how Idaho decides what information to release about COVID-19 cases" regarding the type of information state and local officials can publicly release about COVID-19 cases.

Although private health information is protected at the federal level by the Health Insurance Portability and Accountability Act (HIPAA), that legislation is only the ground floor for medical privacy laws. States can enact more stringent laws and protect more information than HIPAA does, according to Stephanie Winer Schreiber, a corporate and health care attorney of the firm Buchanan, Ingersoll and Rooney, in Pittsburgh.

"HIPAA is the floor so to speak, so if a state has a more restrictive confidentiality law, HIPAA does not preempt them," Winer Schreiber said.

HIPAA requires the weighing of 18 factors to determine if information is private health information, such as names, telephone numbers, medical record numbers, and health plan beneficiary numbers.

Only specific entities — called "covered entities" — are bound by HIPAA regulations, Winer Schreiber said. The Idaho Department of Health and Welfare has determined itself to be a covered entity, and is thus bound by those regulations.

Across the country, Winer Schreiber said, few states leave their medical privacy laws close to the bare minimum HIPAA requirements. State privacy law even tends to be hypersensitive to certain topics; she listed HIV, drug and alcohol abuse, and mental health as topics that often receive additional protections.