1.) It is an absolute certainty that entire rooms full of lawyers have vetted this across dozens of organizations and institutions from high schools to professional hockey teams who DO release this non-PPI in the form of generic #'s of persons testing positive in the org.
2.) You can read this:
Permitted Uses and Disclosures
Permitted Uses and Disclosures. A covered entity is permitted, but not required, to use and disclose protected health information, without an individual’s authorization, for the following purposes or situations: (1) To the Individual (unless required for access or accounting of disclosures); (2) Treatment, Payment, and Health Care Operations; (3) Opportunity to Agree or Object; (4) Incident to an otherwise permitted use and disclosure; (5) Public Interest and Benefit Activities; and (6) Limited Data Set for the purposes of research, public health or health care operations.18 Covered entities may rely on professional ethics and best judgments in deciding which of these permissive uses and disclosures to make.
which can be found here:
https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html
The above explains how this information could be covered
even if the information could be considered PPI. In such instances, the bare minimum of PPI is disclosed and any further disclosure is the decision of the patient/person. In this case, the positive test result.
Simply saying 3 players tested positive in a group of 125 players is in no way personally identifying that player. You would have to go much further such as giving the race, height, weight, position played, etc. in order to reasonably be considered having identified that patient. That is why simply releasing the number of positives on a team and on the support staff is NOT considered PPI.
= new reply since forum marked as read
