Health Information Privacy

FAQs in Connection with Testing and Contact Tracing

BU’s COVID-19 testing for employees is administered by BU Occupational Health Center (BUOHC), and the BU Clinical Testing Laboratory (the Clinical Laboratory). It is important for each member of the on-campus BU community to understand how your health information is protected and the circumstances under which either BUOHC, or the Clinical Laboratory may disclose any of your health information.

Your health information, including the results of your COVID-19 testing, is confidential health information at BUOHC and the Clinical Laboratory.

However, because COVID-19 is a contagious disease, we are required to share certain information with government public health agencies, such as the Massachusetts Department of Public Health (MDPH). We may also share your health information with individuals within the BU community on a need-to-know basis.

Privacy & Security of Health Information

What kind of health information do BU healthcare providers have about me?

  • Faculty and Staff: BUOHC has health information related to employees’ work at BU, including COVID-19 testing results. For example, immunization records for clinical staff, fitness for duty evaluations for certain job functions, and information related to the prevention, diagnosis, and treatment of occupational illnesses and injuries. BUOHC also has medical information related to your medical leaves of absence and return to work. BUOHC does not provide general primary care services to BU employees.
  • The Clinical Laboratory has specimens for testing, test results, the BU ID of anyone tested, and the bar code associated with each sample kit. The Clinical Laboratory does not have the names or other identifying information of persons tested, because it is not necessary.

How do BU healthcare providers keep my information secure?
Your health information is stored in electronic medical records, each of which meets stringent security standards set by BU’s Information Services & Technology. The information is accessible only by persons working for these healthcare providers. Your health information is considered “Confidential” under BU’s Data Classification Policy and is subject to BU’s stringent security standards for confidential data. You can find more information on data protection in the information security data classification and management policies.

Which laws protect my health information at BUOHC or the Clinical Laboratory?
None of these healthcare providers are required to follow the federal HIPAA privacy and security rules. However, they are required under Massachusetts law and their professional obligations to keep your health information private and confidential.

Clinical Testing Laboratory & Privacy

What kind of health information does the Clinical Laboratory keep for me?
The Clinical Laboratory does not hold the names of persons being tested. The Clinical Laboratory collects your BU ID. After testing, the Clinical Laboratory has the results of your test.

Does HIPAA or any other law protect my health information at the Clinical Laboratory?
The Clinical Laboratory is not a HIPAA-covered component and is not required to follow the HIPAA privacy and security rules. However, it is required to keep all health information confidential as a CLIA and MDPH licensed laboratory and pursuant to BU policies.

Test Results & Privacy 

Who gets the results of my COVID-19 test?
The Clinical Laboratory conducts the test, stores the result in the Laboratory Information Management System, and transmits your test results electronically to BUOHC. Your results are tied only to a barcode and your BU ID, and not to your name or other identifying information. You will receive your testing results through your Occupational Health Connect Portal.

Does BU report my test information to anyone outside of BU?
Yes, we are required by law to report all COVID-19 test results, as well as certain information including name, date of birth, address, sex, race, ethnicity, and phone number, to the MDPH. Demographic information is provided to the MDPH so that public health authorities (and the public) can assess the impact of the pandemic on certain racial, ethnic, age, gender, and community groups and conduct contact tracing. MA law authorizes the MDPH to obtain medical records and other information that it deems necessary to carry out its responsibilities to investigate, monitor, prevent, and control diseases dangerous to the public health.