The Health Insurance Portability and Accountability Act (HIPAA) is a law to protect the confidentiality and security of healthcare information. Below are some frequently asked questions regarding HIPAA and disease reporting:

Q1. Does HIPAA prohibit reporting to public health agencies?

No, disease reporting to public health authorities in not prohibited by HIPAA.

Section 164.512(b)(1)(i) of HIPAA allows disclosure for public health activities to “a public health authority that is authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury, or disability…the conduct of public health surveillance, public health investigations, and public health interventions…”

Q2. Does HIPAA require authorization from patients prior to reporting?

No, HIPAA does not require the reporter to seek authorization or documentation from patients

Q3. How does HIPAA effect how disease and conditions are reported to public health authorities?

No, HIPAA does not require any changes to procedures when reporting notifiable diseases and conditions to public health authorities.

For more information, click here to visit the Health and Human Services webpage on HIPAA privacy rules.