Key points
- These questions and answers are intended to provide guidance to health care providers and public health agencies about the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule and how it impacts perinatal hepatitis B prevention.
- This information is not intended to provide legal advice to you or your organization.
Questions and answers
A: Under 45 CFR § 164.512(b), for disclosures not required by law, covered entities may disclose, without authorization, to a public health authority authorized by law to collect or receive the information for the purpose of preventing or controlling disease, injury, or disability, the minimum necessary information to accomplish the intended public health purpose of the disclosure. In addition, under 45 CFR §164.512(a), covered entities may disclose protected health information to public health authorities if the disclosure is required by law. A specific mandate to report is not required for disclosure. In states that do not have a law that specifically mandates the reporting of maternal HBsAg status, notifiable disease reporting laws mandate reporting of hepatitis B.
A: Under 45 CFR § 164.512(b), for disclosures not required by law, covered entities may disclose, without authorization, to a public health authority authorized by law to collect or receive the information for the purpose of preventing or controlling disease, injury, or disability, the minimum necessary information to accomplish the intended public health purpose of the disclosure.
A: As explained above, under 45 CFR § 164.512(b), for disclosures not required by law, covered entities may disclose, without authorization, to a public health authority authorized by law to collect or receive the information for the purpose of preventing or controlling disease, injury, or disability, the minimum necessary information to accomplish the intended public health purpose of the disclosure.
A: Yes. The HIPAA Privacy Rule governs the use and disclosure of protected health information by covered entities (health plans, clearinghouses, and providers who transmit specified transactions electronically). The definition of health plans (45 CFR §160.103) includes the Indian Health Service (IHS) and programs under the Indian Health Care Improvement Act, 25 U.S.C. 1601 et seq. (45 CFR 160.103(1)(xii)).
Resources
- Office for Civil Rights (responsible for enforcing the Privacy Rule)
- CDC/DHHS guidance on the Privacy Rule and Public Health [24 pages]