Under HIPAA, which scenario allows disclosures without patient authorization for public health purposes?

Under HIPAA, which scenario allows disclosures without patient authorization for public health purposes?

• A. Under HIPAA, disclosures may be made to public health authorities without authorization.
• B. HIPAA prohibits such disclosures without authorization.
• C. Disclosures for public health purposes require patient consent.
• D. HIPAA does not apply to public health records.

Answer: (A)

Disclosures to public health authorities without patient authorization are allowed under HIPAA when the purpose is public health activities, such as reporting notifiable diseases, disease surveillance, and other measures to prevent or control disease. This allowed disclosure helps public health authorities perform their duties without needing patient consent, as long as only the minimum necessary PHI is shared and the recipient is an authorized public health authority. That’s why the correct option states that disclosures may be made to public health authorities without authorization for public health purposes. The other statements conflict with HIPAA: it does not prohibit such disclosures; consent is not always required for public health reporting; and HIPAA does apply to PHI in public health records. For example, a clinician reporting a notifiable infectious disease to the local health department is a standard, authorized public health disclosure without patient consent.

Disclosures to public health authorities without patient authorization are allowed under HIPAA when the purpose is public health activities, such as reporting notifiable diseases, disease surveillance, and other measures to prevent or control disease. This allowed disclosure helps public health authorities perform their duties without needing patient consent, as long as only the minimum necessary PHI is shared and the recipient is an authorized public health authority.

That’s why the correct option states that disclosures may be made to public health authorities without authorization for public health purposes. The other statements conflict with HIPAA: it does not prohibit such disclosures; consent is not always required for public health reporting; and HIPAA does apply to PHI in public health records. For example, a clinician reporting a notifiable infectious disease to the local health department is a standard, authorized public health disclosure without patient consent.