Difference between revisions of "Template:COVID-19 Testing, Reporting, and Information Management in the Laboratory/Diagnostic testing of COVID-19 and other coronaviruses/Organizational and agency guidance on COVID-19 testing"

From LIMSWiki
Jump to: navigation, search
m (2.3.1 Regulatory considerations: Header)
(2.3.1 Regulatory considerations: HIPAA and CLIA: Updates and fixes.)
Line 25: Line 25:
  
 
====2.3.1 Regulatory considerations: HIPAA and CLIA====
 
====2.3.1 Regulatory considerations: HIPAA and CLIA====
'''HIPAA'''
+
[[File:HIPAA Screenshot.png|right|350px]]'''HIPAA'''
  
The [[Health Insurance Portability and Accountability Act]] (HIPAA) is a set of U.S. federal regulatory requirements that attempts to modernize the flow of healthcare information, stipulate how personally identifiable information (PII) (or protected health information [PHI}) maintained by healthcare providers and insurers should be protected from fraud and theft, and address limitations on healthcare insurance coverage in the U.S. HIPAA spans five sections or "titles," mandating health care information access, portability, privacy, and security, as well as stipulations on medical savings accounts, group health insurance requirements, and other tax- and legal-status-related issues.
+
The [[Health Insurance Portability and Accountability Act]] (HIPAA) is a set of U.S. federal regulatory requirements that attempts to modernize the flow of healthcare information, stipulate how personally identifiable information (PII) (often referred to as "protected health information" or "PHI") maintained by healthcare providers and insurers should be protected from fraud and theft, and address limitations on healthcare insurance coverage in the U.S. HIPAA spans five sections or "titles," mandating health care information access, portability, privacy, and security, as well as stipulations on medical savings accounts, group health insurance requirements, and other tax- and legal-status-related issues.
  
 
Normally, HIPAA regulations would put strict requirements on how and when PII can be managed, used, shared, and stored. However, the COVID-19 pandemic has seen a relaxation of some of those requirements by the U.S. Department of Health and Human Services' (HHS) Office for Civil Rights (OCR). The HHS is currently maintaining a list of announcements, notifications, guidance documents, bulletins, and other resources as they relate to HIPAA and the public health emergency. Important notes pulled from that information reveal<ref name="HHS_HIPAA20">{{cite web |url=https://www.hhs.gov/hipaa/for-professionals/special-topics/hipaa-covid19/index.html |title=HIPAA and COVID-19 |publisher=Department of Health and Human Services |date=11 May 2020 |accessdate=18 May 2020}}</ref>:
 
Normally, HIPAA regulations would put strict requirements on how and when PII can be managed, used, shared, and stored. However, the COVID-19 pandemic has seen a relaxation of some of those requirements by the U.S. Department of Health and Human Services' (HHS) Office for Civil Rights (OCR). The HHS is currently maintaining a list of announcements, notifications, guidance documents, bulletins, and other resources as they relate to HIPAA and the public health emergency. Important notes pulled from that information reveal<ref name="HHS_HIPAA20">{{cite web |url=https://www.hhs.gov/hipaa/for-professionals/special-topics/hipaa-covid19/index.html |title=HIPAA and COVID-19 |publisher=Department of Health and Human Services |date=11 May 2020 |accessdate=18 May 2020}}</ref>:
  
* Family, friends, and others identified by the patient as being involved in their care may receive PHI from a covered health care provider, particular when they deem that sharing in the patient's best interest. Additionally, "[a] covered entity also may share information about a patient as necessary to identify, locate, and notify family members, guardians, or anyone else responsible for the patient’s care, of the patient’s location, general condition, or death."
+
* Family, friends, and others identified by the patient as being involved in their care may receive PHI from a covered health care provider, particularly when they deem that sharing in the patient's best interest. Additionally, "[a] covered entity also may share information about a patient as necessary to identify, locate, and notify family members, guardians, or anyone else responsible for the patient’s care, of the patient’s location, general condition, or death."
  
* "Covered health care providers will not be subject to penalties for violations of the HIPAA Privacy, Security, and Breach Notification Rules that occur in the good faith provision of telehealth during the COVID-19 nationwide public health emergency. This Notification does not affect the application of the HIPAA Rules to other areas of health care outside of telehealth during the emergency." This exercising of enforcement discretion will last until OCR provides a notice otherwise. Telehealth should optimally be performed in a privage setting, whenever possible, using non-public facing communication technologies. Providers should opt to use the most secure services possible, "but will not be penalized for using less secure products in their effort to provide the most timely and accessible care possible to patients during the public health emergency."
+
* "Covered health care providers will not be subject to penalties for violations of the HIPAA Privacy, Security, and Breach Notification Rules that occur in the good faith provision of telehealth during the COVID-19 nationwide public health emergency. This Notification does not affect the application of the HIPAA Rules to other areas of health care outside of telehealth during the emergency." This exercising of enforcement discretion will last until OCR provides a notice otherwise. Telehealth should optimally be performed in a private setting, whenever possible, using non-public facing communication technologies. Providers should opt to use the most secure services possible, "but will not be penalized for using less secure products in their effort to provide the most timely and accessible care possible to patients during the public health emergency."
  
 
* The OCR extended its enforcement discretion to include business associates of covered health care providers, allowing them to share PHI data "without risk of a HIPAA penalty." The OCR adds that "[s]ome HIPAA business associates have been unable to timely participate in these efforts [to ensure the health and safety of the public] because their BAAs do not expressly permit them to make such uses and disclosures of PHI." Like the enforcement discretion of telehealth provision by covered health care providers, the business associate must still make a good-faith effort in the "use or disclosure of the covered entity’s PHI" for public health and health oversight activities. Similarly, this exercising of enforcement discretion will last until OCR provides a notice otherwise.
 
* The OCR extended its enforcement discretion to include business associates of covered health care providers, allowing them to share PHI data "without risk of a HIPAA penalty." The OCR adds that "[s]ome HIPAA business associates have been unable to timely participate in these efforts [to ensure the health and safety of the public] because their BAAs do not expressly permit them to make such uses and disclosures of PHI." Like the enforcement discretion of telehealth provision by covered health care providers, the business associate must still make a good-faith effort in the "use or disclosure of the covered entity’s PHI" for public health and health oversight activities. Similarly, this exercising of enforcement discretion will last until OCR provides a notice otherwise.
Line 41: Line 41:
 
* "[T]he HIPAA Privacy Rule permits a covered entity to disclose the protected health information (PHI) of an individual who has been infected with, or exposed to, COVID-19, with law enforcement, paramedics, other first responders, and public health authorities1 without the individual’s HIPAA authorization, in certain circumstances." OCR provides [https://www.hhs.gov/sites/default/files/covid-19-hipaa-and-first-responders-508.pdf numerous examples], including: "when the disclosure is needed to provide treatment," "when such notification is required by law," when a public health authority must be notified "to prevent or control spread of disease," "when first responders may be at risk of infection," when preventing or lessening "a serious and imminent threat to the health and safety of a person or the public," and when responding to a law enforcement inquiring concerning a lawfully detained inmate or other individual.
 
* "[T]he HIPAA Privacy Rule permits a covered entity to disclose the protected health information (PHI) of an individual who has been infected with, or exposed to, COVID-19, with law enforcement, paramedics, other first responders, and public health authorities1 without the individual’s HIPAA authorization, in certain circumstances." OCR provides [https://www.hhs.gov/sites/default/files/covid-19-hipaa-and-first-responders-508.pdf numerous examples], including: "when the disclosure is needed to provide treatment," "when such notification is required by law," when a public health authority must be notified "to prevent or control spread of disease," "when first responders may be at risk of infection," when preventing or lessening "a serious and imminent threat to the health and safety of a person or the public," and when responding to a law enforcement inquiring concerning a lawfully detained inmate or other individual.
  
* The public health emergency does not change restrictions on disclosing PHI to the media. This includes the prohibition of media crews in, for example, emegency departments where COVID-19 patients are being treated, as PHI is found everwhere in that setting. Only when every patient who is or will be in a potentially filmed area has signed a HIPAA authorization form can this be done.
+
* The public health emergency does not change restrictions on disclosing PHI to the media. This includes the prohibition of media crews in, for example, emergency departments where COVID-19 patients are being treated, as PHI is found everywhere in that setting. Only when every patient who is or will be in a potentially filmed area has signed a HIPAA authorization form can this be done.
  
  
Line 50: Line 50:
 
CLIA uses seven different criteria to gauge and assign one of three complexity levels to laboratory devices and [[assay]]s: high, moderate, and waived.<ref name="CDCTestCom">{{cite web |url=https://www.cdc.gov/clia/test-complexities.html |title=Clinical Laboratory Improvement Amendments (CLIA): Test complexities |author=Centers for Disease Control and Prevention |date=06 August 2018 |accessdate=09 April 2020}}</ref><ref name="FDAIVDReg">{{cite web |url=https://www.fda.gov/medical-devices/ivd-regulatory-assistance/clia-categorizations |title=CLIA Categorizations |publisher=U.S. Food and Drug Administration |date=25 February 2020 |accessdate=09 April 2020}}</ref> Additionally, CLIA mandates clinical laboratories handling specimens originating from the U.S. and its territories to apply for a CLIA certificate that is appropriate for the type of testing it performs. Labs using complex devices and assays would have to apply for a high complexity certificate, and so on. Waived tests are recognized as simple to perform with a low risk of erroneous results and include among others urinalysis for pregnancy and drugs of abuse, blood glucose and cholesterol tests, and fertility analysis.
 
CLIA uses seven different criteria to gauge and assign one of three complexity levels to laboratory devices and [[assay]]s: high, moderate, and waived.<ref name="CDCTestCom">{{cite web |url=https://www.cdc.gov/clia/test-complexities.html |title=Clinical Laboratory Improvement Amendments (CLIA): Test complexities |author=Centers for Disease Control and Prevention |date=06 August 2018 |accessdate=09 April 2020}}</ref><ref name="FDAIVDReg">{{cite web |url=https://www.fda.gov/medical-devices/ivd-regulatory-assistance/clia-categorizations |title=CLIA Categorizations |publisher=U.S. Food and Drug Administration |date=25 February 2020 |accessdate=09 April 2020}}</ref> Additionally, CLIA mandates clinical laboratories handling specimens originating from the U.S. and its territories to apply for a CLIA certificate that is appropriate for the type of testing it performs. Labs using complex devices and assays would have to apply for a high complexity certificate, and so on. Waived tests are recognized as simple to perform with a low risk of erroneous results and include among others urinalysis for pregnancy and drugs of abuse, blood glucose and cholesterol tests, and fertility analysis.
  
Anything but waived testing requires meeting "the CLIA quality system standards, such as those for proficiency testing, quality control and assessment, and personnel requirements. The standards for moderate and high complexity testing differ only in the personnel requirements."<ref name="CDCTestCom" /> As the Centers for Medicare and Medicaid Services (CMS) points out in a frequently asked questions (FAQ) document—and as can be verifed on the FDA's EUA page<ref name="FDAEmerg20" />—a huge majority of COVID-19 tests are only authorized for moderate or high complexity testing, and thus labs certified to do that sort of testing.<ref name="CMSFAQ">{{cite web |url=https://www.cms.gov/files/document/clia-laboratory-covid-19-emergency-frequently-asked-questions.pdf |format=PDF |title=Frequently Asked Questions (FAQs), CLIA Guidance During the COVID-19 Emergency |author=Centers for Medicare and Medicaid Services |accessdate=18 May 2020}}</ref> As of May 18, only four of 75 FDA EUAed tests are approved to be performed in a CLIA-waived laboratory setting.<ref name="FDAEmerg20" />
+
Anything but waived testing requires meeting "the CLIA quality system standards, such as those for proficiency testing, quality control and assessment, and personnel requirements. The standards for moderate and high complexity testing differ only in the personnel requirements."<ref name="CDCTestCom" /> As the Centers for Medicare and Medicaid Services (CMS) points out in a frequently asked questions (FAQ) document—and as can be verified on the FDA's EUA page<ref name="FDAEmerg20" />—a huge majority of COVID-19 tests are only authorized for moderate or high complexity testing, and thus labs certified to do that sort of testing.<ref name="CMSFAQ">{{cite web |url=https://www.cms.gov/files/document/clia-laboratory-covid-19-emergency-frequently-asked-questions.pdf |format=PDF |title=Frequently Asked Questions (FAQs), CLIA Guidance During the COVID-19 Emergency |author=Centers for Medicare and Medicaid Services |accessdate=18 May 2020}}</ref> As of May 18, only four of 75 FDA EUAed tests are approved to be performed in a CLIA-waived laboratory setting.<ref name="FDAEmerg20" />
  
 
CMS' FAQ, as well as their March 2020 guidance document, provides additional insight in regards CLIA and COVID-19<ref name="CMSFAQ" /><ref name="WrightClinical20">{{cite web |url=https://www.cms.gov/files/document/qso-20-21-clia.pdf-0 |format=PDF |title=Clinical Laboratory Improvement Amendments (CLIA) Laboratory Guidance During COVID-19 Public Health Emergency |author=Wright, D.R. |publisher=Centers for Medicare and Medicaid Services |date=26 March 2020 |accessdate=18 May 2020}}</ref>:
 
CMS' FAQ, as well as their March 2020 guidance document, provides additional insight in regards CLIA and COVID-19<ref name="CMSFAQ" /><ref name="WrightClinical20">{{cite web |url=https://www.cms.gov/files/document/qso-20-21-clia.pdf-0 |format=PDF |title=Clinical Laboratory Improvement Amendments (CLIA) Laboratory Guidance During COVID-19 Public Health Emergency |author=Wright, D.R. |publisher=Centers for Medicare and Medicaid Services |date=26 March 2020 |accessdate=18 May 2020}}</ref>:
Line 58: Line 58:
 
* Laboratories choosing to use temporary testing sites for remotely (from home or another temporary location) viewing and reporting on cytology slides and images may do so if certain defined conditions are met. (Consult [https://www.cms.gov/medicareprovider-enrollment-and-certificationsurveycertificationgeninfopolicy-and-memos-states-and/clinical-laboratory-improvement-amendments-clia-laboratory-guidance-during-covid-19-public-health the memo] for those defined conditions.)
 
* Laboratories choosing to use temporary testing sites for remotely (from home or another temporary location) viewing and reporting on cytology slides and images may do so if certain defined conditions are met. (Consult [https://www.cms.gov/medicareprovider-enrollment-and-certificationsurveycertificationgeninfopolicy-and-memos-states-and/clinical-laboratory-improvement-amendments-clia-laboratory-guidance-during-covid-19-public-health the memo] for those defined conditions.)
  
* Proficiency testing (PT) is still required if a CLIA-certified lab is still performing testing and issuing patient results. However, should a PT provider need to postpone, suspend, or cancel a proficiency testing event, "[l]aboratories will not be penalized for lack of PT results if an event is postponed, suspended, or canceled, so long as the cancelation is documented (including the notification from the PT program), and PT is conducted in a timely manner after the public health emergency ends. However, labs should consider performing their own self-assessment to ensure reliable testing."
+
* Proficiency testing (PT) is still required if a CLIA-certified lab is still performing testing and issuing patient results. However, should a PT provider need to postpone, suspend, or cancel a proficiency testing event, "[l]aboratories will not be penalized for lack of PT results ... so long as the cancelation is documented (including the notification from the PT program), and PT is conducted in a timely manner after the public health emergency ends. However, labs should consider performing their own self-assessment to ensure reliable testing."
  
 
* Alternate specimen collection devices (e.g., viral transport media, flocked nasopharyngeal swabs) used outside the manufacturer's instructions still require the establishment of performance specifications and assay validation prior to patient use. The FDA provides [https://www.fda.gov/medical-devices/emergency-situations-medical-devices/faqs-testing-sars-cov-2 additional guidance] on this topic.
 
* Alternate specimen collection devices (e.g., viral transport media, flocked nasopharyngeal swabs) used outside the manufacturer's instructions still require the establishment of performance specifications and assay validation prior to patient use. The FDA provides [https://www.fda.gov/medical-devices/emergency-situations-medical-devices/faqs-testing-sars-cov-2 additional guidance] on this topic.
* Laboratories performing laboratory developed tests (LDTs) are still required to be CLIA-certifed and meet the requirements for high complexity testing. However, if the state government of such a laboratory has opted to take responsibility fo authorizing an LDT (in order to expedite COVID-19 testing), then engagement with the FDA is not required.
+
 
 +
* Laboratories performing laboratory developed tests (LDTs) are still required to be CLIA-certified and meet the requirements for high complexity testing. However, if the state government of such a laboratory has opted to take responsibility for authorizing an LDT (in order to expedite COVID-19 testing), then engagement with the FDA is not required.
  
 
* As of May 2020, a CLIA specialty or subspecialty has not yet been assigned to COVID-19 testing.
 
* As of May 2020, a CLIA specialty or subspecialty has not yet been assigned to COVID-19 testing.

Revision as of 23:38, 19 May 2020

2.3 Organizational and agency guidance on COVID-19 testing

NOTE: Information shown here may rapidly become outdated given how quickly response to pandemic testing can change. A full attempt to keep the content relevant will be made.

CDC 2019-nCoV Real-time RT-PCR Panel (Research Use Only)
Laboratory guidance for testing for SARS-CoV-2 has been relatively quick to evolve. The timely development and organized use of accurate assays and meaningful screening protocols, however, has been inconsistent worldwide, with some countries more urgently and agilely responding than others.[1][2][3] With any novel virus, clinicians and public health experts are dealing with unknown factors. However, public health organizations and agencies have had a base to work from when creating laboratory testing guidance for a novel coronavirus, with more than 40 years of experience with coronavirus biology, pathogenesis, and diagnosis.[4] And while there are fundamental differences between SARS-CoV-2 and its predecessor SARS-CoV, they still share approximately 70 to 80 percent of their genetic code.[5][6] In fact, the WHO had draft guidance for laboratory testing out as early as January 10, 2020, before gene sequencing was even completed.[7] This guidance and similar draft guidance from national public health organizations and agencies have received steady revisions since as understanding of the virus has grown.

Similar to its predecessors SARS-CoV and MERS-CoV, RT-PCR is being recommended in guidance for detecting SARS-CoV-2's RNA in specimens and thus laboratory confirmation of COVID-19 cases. Serology has its place in testing as well, though with similar lessons from SARS and MERS that it's best used to test for past infection (typically after 14 days of suspected contact with a carrier, or mild symptoms) and thus potential short-term immunity due to the presence of antibodies in blood. In its March 19 guidance, the WHO said: "In cases where NAAT assays are negative and there is a strong epidemiological link to COVID-19 infection, paired serum samples (in the acute and convalescent phase) could support diagnosis once validated serology tests are available."[8] On April 3, the U.S. Food and Drug Administration (FDA) approved the countries first COVID-19 serology test created by Cellex, though Mayo Clinic was also on the verge of rolling out its own in-house serology test as well[9] As of April 28, the U.S. FDA has granted emergency use authorizations (EUA) for eight serology tests.[10] (Note: Johns Hopkins appears to be maintaining a page tracking approved serology tests around the world.)

The following sample collection and test procedures have evolved from the COVID-19 pandemic (note that this is only a summary; consult the cited literature directly for full details)[8][11][12][13][14]:

  • Determine that the patient is indicating clinical and/or epidemiological evidence of COVID-19 (meets case definitions). Case definitions and testing criteria have initially been strict, but as the CDC notes, as test kit availability ramps up, it "will allow clinicians to consider COVID-19 testing for a wider group of symptomatic patients."[11] However, clinicians are still encouraged to consider other causes for respiratory illness. The CDC provides a priority list, making hospitalized patients and symptomatic healthcare workers the top priority, followed by "those who are at highest risk of complication of infection," then "individuals in the surrounding community of rapidly increasing hospital cases." In the future, as more serology options and other resources become available, serological surveys of people who have never been diagnosed (asymptomatic or otherwise) may begin.[15][16]
  • Collect at a minimum upper respiratory tract specimens and, whenever possible, lower respiratory tract specimens. Although too early to say with certainty, it appears lower respiratory tract specimens such as sputum and bronchoalveolar lavage fluid are typically the most reliable specimen type for RT-PCR applications, as they have been shown to contain the highest viral load, in comparison to upper respiratory tract specimens.[17][18] As Wang et al. point out, "testing of specimens from multiple sites may improve the sensitivity and reduce false-negative test results,"[17] which is largely reflected in WHO, CDC, Public Health England (PHE), and Public Health Laboratory Network (PHLN; Australia) testing guidance.
Slight differences in upper respiratory tract specimen collection procedures can be found between the WHO/CDC and PHE/PHLN. Both the WHO and CDC offer nasopharyngeal and oropharyngeal swabs as options. The WHO doesn't appear to give a preference, whereas the CDC has a preference for nasopharyngeal swabs but maintains oropharyngeal as still remaining "an acceptable specimen type."[12] In comparison, the latest PHE and PHLN guidance prefer the approach of collecting from both pharynx locations—even with the same swab—"to optimize the chances of virus detection."[14] Nasopharyngeal aspiration is also an acceptable sample collection method for the upper respiratory tract according to all mentioned entities, though the PHLN specifies that it is a substitution for only the nasopharyngeal (they now refer to it as "deep nasal") specimen.[14]
Regarding serum specimens, statements differ slightly. The WHO notes serology to be useful for retrospective case definition, using paired specimens from the acute and convalescent phases of the disease. The CDC doesn't make reference to serum or serology in their clinical specimen guidance. The PHE suggests hospital patients have "a sample for acute serology" taken but say little else.[13] The PHLN gives similar advice as the WHO, while emphasizing a need "to facilitate retrospective testing, if this is relevant, once serology tests become available."[14]
Finally, and more recently, potential evidence of saliva having diagnostic value for detecting SARS-CoV-2 has arisen. As Xu et al. note in their mid-April paper, the "diagnostic value of saliva specimens for ... nucleic acid examination remains limited but promising."[19] Another paper awaiting peer review by researchers at Yale School of Public Health provides similiar thoughts, though is generally more optimistic than the paper published by Xu et al., suggesting salive from the opening of the mouth (in contrast to Xu et al. and their finding of better results from salive in the throat) may be viable specimen.[20] In fact, an April EUA by the FDA has been made for the first saliva-based COVID-19 test, produced by Vault Health, Inc.[21] As these and similar studies get peer reviewed and methods validated, preferred sample types (and the guidance recommending them) may change. Stay aware of the evolving science.
  • Conduct testing. NAAT methods like rRT-PCR have been the primary tools for diagnosing SARS-CoV-2 infection due to their high sensitivity. The PHLN provides the most background about PCR in their guidance, noting that laboratories in its network are confirming positive infections "either with RT-PCR assays detecting a different target gene, or broadly reactive PCR tests with sequencing of amplicons."[14] The latter option is less common due to long turnaround time. They also note that other zoonotic viruses such as SARS-CoV are capable of being detected from PCR assays, though endemic coronaviruses like -229E won't be. The WHO, CDC, and PHLN underscore the idea that viral cultures for routine diagnoses are not practical and, if attempted, should only be performed in Biosafety Level 3 (BSL-3) laboratories. As of April 5, no specific methods have been suggested for serological antibody detection, though the current set of approved serology tests from around the world appear to use lateral flow immunoassay, ELISA, or neutralization methods.[16]
  • Confirm the results. The strongest public guidance for considering a potential case as being laboratory-confirmed for SARS-CoV-2 infection comes from the WHO. In their guidance, they differentiate between cases by NAAT "in areas with no known COVID-19 virus circulation" and "in areas with established COVID-19 virus circulation." In the first case, one of these conditions must apply: either a validated NAAT test providing a positive result for at least two different genomic targets, or a validated NAAT test providing a positive result for the presences of betacoronavirus along with sequencing confirmation of a separate genomic target, "as long as the sequence target is larger or different from the amplicon probed in the NAAT assay used."[8] In the latter case of established virus circulation, the WHO notes that "a simpler algorithm might be adopted in which, for example, screening by rRT-PCR of a single discriminatory target is considered sufficient."[8] However, if testing produces one or more negative results, that doesn't necessarily rule out SARS-CoV-2 infection. If suspicion of infection remains high, particularly if only upper respiratory tract specimens were collected, additional specimens from the lower respiratory tract should be collected and analyzed. They also emphasize that both external and internal controls should be applied to NAAT runs.
  • Report using state and, if applicable, national reporting requirements. (See the next chapter for more on reporting.) Regardless of result, the final positive or negative laboratory confirmation should also be reported to state and national authorities. In the U.S., for example, this means reporting to the local or state health department using the CDC's PUI and Case Report Form. In Canada, reports are sent to the Public Health Agency of Canada (PHAC) via their Coronavirus Diseases (COVID-19) Case Report Form.

2.3.1 Regulatory considerations: HIPAA and CLIA

HIPAA Screenshot.png
HIPAA

The Health Insurance Portability and Accountability Act (HIPAA) is a set of U.S. federal regulatory requirements that attempts to modernize the flow of healthcare information, stipulate how personally identifiable information (PII) (often referred to as "protected health information" or "PHI") maintained by healthcare providers and insurers should be protected from fraud and theft, and address limitations on healthcare insurance coverage in the U.S. HIPAA spans five sections or "titles," mandating health care information access, portability, privacy, and security, as well as stipulations on medical savings accounts, group health insurance requirements, and other tax- and legal-status-related issues.

Normally, HIPAA regulations would put strict requirements on how and when PII can be managed, used, shared, and stored. However, the COVID-19 pandemic has seen a relaxation of some of those requirements by the U.S. Department of Health and Human Services' (HHS) Office for Civil Rights (OCR). The HHS is currently maintaining a list of announcements, notifications, guidance documents, bulletins, and other resources as they relate to HIPAA and the public health emergency. Important notes pulled from that information reveal[22]:

  • Family, friends, and others identified by the patient as being involved in their care may receive PHI from a covered health care provider, particularly when they deem that sharing in the patient's best interest. Additionally, "[a] covered entity also may share information about a patient as necessary to identify, locate, and notify family members, guardians, or anyone else responsible for the patient’s care, of the patient’s location, general condition, or death."
  • "Covered health care providers will not be subject to penalties for violations of the HIPAA Privacy, Security, and Breach Notification Rules that occur in the good faith provision of telehealth during the COVID-19 nationwide public health emergency. This Notification does not affect the application of the HIPAA Rules to other areas of health care outside of telehealth during the emergency." This exercising of enforcement discretion will last until OCR provides a notice otherwise. Telehealth should optimally be performed in a private setting, whenever possible, using non-public facing communication technologies. Providers should opt to use the most secure services possible, "but will not be penalized for using less secure products in their effort to provide the most timely and accessible care possible to patients during the public health emergency."
  • The OCR extended its enforcement discretion to include business associates of covered health care providers, allowing them to share PHI data "without risk of a HIPAA penalty." The OCR adds that "[s]ome HIPAA business associates have been unable to timely participate in these efforts [to ensure the health and safety of the public] because their BAAs do not expressly permit them to make such uses and disclosures of PHI." Like the enforcement discretion of telehealth provision by covered health care providers, the business associate must still make a good-faith effort in the "use or disclosure of the covered entity’s PHI" for public health and health oversight activities. Similarly, this exercising of enforcement discretion will last until OCR provides a notice otherwise.
  • The OCR also extended its enforcement discretion to include covered health care providers and business associates operating community-based COVID-19 testing sites (CBTS)—"which includes mobile, drive-through, or walk-up sites that only provide COVID-19 specimen collection or testing services to the public"—during the public health emergency. This enforcement discretion, however, "does not apply to covered health care providers or their business associates when such entities are performing non-CBTS related activities, including the handling of PHI outside of the operation of a CBTS."
  • "[T]he HIPAA Privacy Rule permits a covered entity to disclose the protected health information (PHI) of an individual who has been infected with, or exposed to, COVID-19, with law enforcement, paramedics, other first responders, and public health authorities1 without the individual’s HIPAA authorization, in certain circumstances." OCR provides numerous examples, including: "when the disclosure is needed to provide treatment," "when such notification is required by law," when a public health authority must be notified "to prevent or control spread of disease," "when first responders may be at risk of infection," when preventing or lessening "a serious and imminent threat to the health and safety of a person or the public," and when responding to a law enforcement inquiring concerning a lawfully detained inmate or other individual.
  • The public health emergency does not change restrictions on disclosing PHI to the media. This includes the prohibition of media crews in, for example, emergency departments where COVID-19 patients are being treated, as PHI is found everywhere in that setting. Only when every patient who is or will be in a potentially filmed area has signed a HIPAA authorization form can this be done.


CLIA

The Clinical Laboratory Improvement Amendments (CLIA) are a set of U.S. federal regulatory requirements applied to all non-research-based clinical laboratory testing performed on humans. These requirements are intended to further ensure a higher standard of quality in clinical laboratory testing, focusing in on improving the accuracy, reliability and timeliness of tests. (The implications of these requirements on U.S. clinical labs and their ability to test for COVID-19 are discussed later, in the next section.)

CLIA uses seven different criteria to gauge and assign one of three complexity levels to laboratory devices and assays: high, moderate, and waived.[23][24] Additionally, CLIA mandates clinical laboratories handling specimens originating from the U.S. and its territories to apply for a CLIA certificate that is appropriate for the type of testing it performs. Labs using complex devices and assays would have to apply for a high complexity certificate, and so on. Waived tests are recognized as simple to perform with a low risk of erroneous results and include among others urinalysis for pregnancy and drugs of abuse, blood glucose and cholesterol tests, and fertility analysis.

Anything but waived testing requires meeting "the CLIA quality system standards, such as those for proficiency testing, quality control and assessment, and personnel requirements. The standards for moderate and high complexity testing differ only in the personnel requirements."[23] As the Centers for Medicare and Medicaid Services (CMS) points out in a frequently asked questions (FAQ) document—and as can be verified on the FDA's EUA page[10]—a huge majority of COVID-19 tests are only authorized for moderate or high complexity testing, and thus labs certified to do that sort of testing.[25] As of May 18, only four of 75 FDA EUAed tests are approved to be performed in a CLIA-waived laboratory setting.[10]

CMS' FAQ, as well as their March 2020 guidance document, provides additional insight in regards CLIA and COVID-19[25][26]:

  • CLIA regulations remain firmly in effect during the U.S.-declared public health emergency; a Section 1135 waiver, under the Social Security Act, that modifies or suspends CLIA requirements is not within the authorizing jurisdiction of the CLIA program. Additionally, CMS in general does not have the authority "to grant waivers or exceptions that are not established in statute or regulation."
  • Laboratories choosing to use temporary testing sites for remotely (from home or another temporary location) viewing and reporting on cytology slides and images may do so if certain defined conditions are met. (Consult the memo for those defined conditions.)
  • Proficiency testing (PT) is still required if a CLIA-certified lab is still performing testing and issuing patient results. However, should a PT provider need to postpone, suspend, or cancel a proficiency testing event, "[l]aboratories will not be penalized for lack of PT results ... so long as the cancelation is documented (including the notification from the PT program), and PT is conducted in a timely manner after the public health emergency ends. However, labs should consider performing their own self-assessment to ensure reliable testing."
  • Alternate specimen collection devices (e.g., viral transport media, flocked nasopharyngeal swabs) used outside the manufacturer's instructions still require the establishment of performance specifications and assay validation prior to patient use. The FDA provides additional guidance on this topic.
  • Laboratories performing laboratory developed tests (LDTs) are still required to be CLIA-certified and meet the requirements for high complexity testing. However, if the state government of such a laboratory has opted to take responsibility for authorizing an LDT (in order to expedite COVID-19 testing), then engagement with the FDA is not required.
  • As of May 2020, a CLIA specialty or subspecialty has not yet been assigned to COVID-19 testing.
  • Subbaraman, N.; Callaway, E. (23 March 2020). "Coronavirus tests: Researchers chase new diagnostics to fight the pandemic". Nature - News Explainer. doi:10.1038/d41586-020-00827-6. https://www.nature.com/articles/d41586-020-00827-6. Retrieved 05 April 2020. 
  • Apuzzo, M.; Gebrekidan, S. (20 March 2020). "Can’t Get Tested? Maybe You’re in the Wrong Country". The New York Times. https://www.nytimes.com/2020/03/20/world/europe/coronavirus-testing-world-countries-cities-states.html. Retrieved 05 April 2020. 
  • Hindsley, G. (28 March 2020). "The Lost Month: How a Failure to Test Blinded the U.S. to COVID-19". The New York Times. https://www.nytimes.com/2020/03/28/us/testing-coronavirus-pandemic.html. Retrieved 05 April 2020. 
  • Denison, M.R. (2004). "Coronavirus Research: Keys to Diagnosis, Treatment, and Prevention of SARS". Learning from SARS: Preparing for the Next Disease Outbreak. Institute of Medicine. pp. 137–72. doi:10.17226/10915. ISBN 9780309182157. https://www.nap.edu/read/10915/chapter/5. 
  • Ceccarelli, M.; Berretta, M.; Venanzi Rullo, E. et al. (2020). "Differences and similarities between Severe Acute Respiratory Syndrome (SARS)-CoronaVirus (CoV) and SARS-CoV-2. Would a rose by another name smell as sweet?". European Review for Medical and Pharmacological Sciences 24 (5): 2781-2783. doi:10.26355/eurrev_202003_20551. PMID 32196628. 
  • Wilder-Smith, A.; Chiew, C.J.; Lee, V.J. (2020). "Can we contain the COVID-19 outbreak with the same measures as for SARS?". The Lancet Infectious Diseases. doi:10.1016/S1473-3099(20)30129-8. PMC PMC7102636. PMID 32145768. http://www.pubmedcentral.nih.gov/articlerender.fcgi?tool=pmcentrez&artid=PMC7102636. 
  • World Health Organization (10 January 2020). "Laboratory testing of human suspected cases of novel coronavirus (nCoV) infection: Interim guidance 10 January 2020". WHO/2019-nCoV/laboratory/2020.1. World Health Organization. https://apps.who.int/iris/bitstream/handle/10665/330374/WHO-2019-nCoV-laboratory-2020.1-eng.pdf. Retrieved 05 April 2020. 
  • 8.0 8.1 8.2 8.3 World Health Organization, et al. (19 March 2020). "Laboratory testing for coronavirus disease (COVID-19) in suspected human cases: Interim guidance, 19 March 2020". WHO/COVID-19/laboratory/2020.5. World Health Organization. https://apps.who.int/iris/handle/10665/331501. Retrieved 05 April 2020. 
  • Terry, M. (03 April 2020). "Cellex and Mayo Clinic Launch Tests to Determine COVID-19 Immunity from Previous Exposure". BioSpace. https://www.biospace.com/article/fda-approves-1st-covid-19-antibody-test/. Retrieved 05 April 2020. 
  • 10.0 10.1 10.2 "Emergency Use Authorizations". U.S. Food and Drug Administration. 08 April 2020. https://www.fda.gov/medical-devices/emergency-situations-medical-devices/emergency-use-authorizations#covid19ivd. Retrieved 28 April 2020. 
  • 11.0 11.1 Centers for Disease Control and Prevention (24 March 2020). "Evaluating and Testing Persons for Coronavirus Disease 2019 (COVID-19)". Centers for Disease Control and Prevention. https://www.cdc.gov/coronavirus/2019-nCoV/hcp/clinical-criteria.html. Retrieved 05 April 2020. 
  • 12.0 12.1 Centers for Disease Control and Prevention (24 March 2020). "Interim Guidelines for Collecting, Handling, and Testing Clinical Specimens from Persons for Coronavirus Disease 2019 (COVID-19)". Centers for Disease Control and Prevention. https://www.cdc.gov/coronavirus/2019-nCoV/lab/guidelines-clinical-specimens.html. Retrieved 05 April 2020. 
  • 13.0 13.1 Public Health England (03 April 2020). "COVID-19: Guidance for sampling and for diagnostic laboratories". U.K Government. https://www.gov.uk/government/publications/wuhan-novel-coronavirus-guidance-for-clinical-diagnostic-laboratories. Retrieved 05 April 2020. 
  • 14.0 14.1 14.2 14.3 14.4 Public Health Laboratory Network (01 April 2020). "PHLN guidance on laboratory testing for SARS-CoV-2 (the virus that causes COVID-19)". Department of Health, Australian Government. https://www.health.gov.au/resources/publications/phln-guidance-on-laboratory-testing-for-sars-cov-2-the-virus-that-causes-covid-19. Retrieved 05 April 2020. 
  • Branswell, H. (04 April 2020). "CDC launches studies to get more precise count of undetected Covid-19 cases". STAT. https://www.statnews.com/2020/04/04/cdc-launches-studies-to-get-more-precise-count-of-undetected-covid-19-cases/. Retrieved 05 April 2020. 
  • 16.0 16.1 Center for Health Security (02 April 2020). "Serology-based tests for COVID-19". Johns Hopkins University. http://www.centerforhealthsecurity.org/resources/COVID-19/Serology-based-tests-for-COVID-19.html. Retrieved 05 April 2020. 
  • 17.0 17.1 Wang, W.; Xu, Y.; Gao, R. et al. (2020). "Detection of SARS-CoV-2 in Different Types of Clinical Specimens". JAMA. doi:10.1001/jama.2020.3786. PMC PMC7066521. PMID 32159775. http://www.pubmedcentral.nih.gov/articlerender.fcgi?tool=pmcentrez&artid=PMC7066521. 
  • Yu, F.; Yan, L.; Wang, N. et al. (2020). "Quantitative Detection and Viral Load Analysis of SARS-CoV-2 in Infected Patients". Clinical Infectious Diseases: ciaa345. doi:10.1093/cid/ciaa345. PMID 32221523. 
  • Xu, R.; Cui, B.; Duan, X. et al. (2020). "Saliva: Potential diagnostic value and transmission of 2019-nCoV". International Journal of Oral Science 12: 11. doi:10.1038/s41368-020-0080-z. 
  • Greenwood, M. (24 April 2020). "Saliva samples preferable to deep nasal swabs for testing COVID-19". YaleNews. https://news.yale.edu/2020/04/24/saliva-samples-preferable-deep-nasal-swabs-testing-covid-19. Retrieved 01 May 2020. 
  • Vault Health (14 April 2020). "Vault Health Launches First-of-its-Kind Saliva-based FDA EUA Approved Test for COVID-19". PR Newswire. https://www.prnewswire.com/news-releases/vault-health-launches-first-of-its-kind-saliva-based-fda-eua-approved-test-for-covid-19-301039633.html. Retrieved 01 May 2020. 
  • "HIPAA and COVID-19". Department of Health and Human Services. 11 May 2020. https://www.hhs.gov/hipaa/for-professionals/special-topics/hipaa-covid19/index.html. Retrieved 18 May 2020. 
  • 23.0 23.1 Centers for Disease Control and Prevention (06 August 2018). "Clinical Laboratory Improvement Amendments (CLIA): Test complexities". https://www.cdc.gov/clia/test-complexities.html. Retrieved 09 April 2020. 
  • "CLIA Categorizations". U.S. Food and Drug Administration. 25 February 2020. https://www.fda.gov/medical-devices/ivd-regulatory-assistance/clia-categorizations. Retrieved 09 April 2020. 
  • 25.0 25.1 Centers for Medicare and Medicaid Services. "Frequently Asked Questions (FAQs), CLIA Guidance During the COVID-19 Emergency" (PDF). https://www.cms.gov/files/document/clia-laboratory-covid-19-emergency-frequently-asked-questions.pdf. Retrieved 18 May 2020. 
  • Wright, D.R. (26 March 2020). "Clinical Laboratory Improvement Amendments (CLIA) Laboratory Guidance During COVID-19 Public Health Emergency" (PDF). Centers for Medicare and Medicaid Services. https://www.cms.gov/files/document/qso-20-21-clia.pdf-0. Retrieved 18 May 2020.