OCR/ONC Issue Guidance on Public Health Disclosures Under HIPAA

The U.S. Department of Health and Human Services Office of the National Coordinator for Health Information Technology (ONC) and Office of Civil Rights (OCR) have published a new fact sheet explaining how providers are permitted to share protected health information (PHI) with public health agencies without obtaining an individual’s written authorization for public health activities. Like the previous fact sheets for treatment and for health care operations, the new fact sheet is intended to address confusion on how the Health Insurance Portability and Accountability Act (HIPAA) supports the exchange of electronic PHI for legitimate purposes permitted under HIPAA. The fact sheet describes numerous scenarios where the exchange of PHI would be permitted, including reporting diseases, public health surveillance, public health investigations, and public health interventions. As the fact sheets demonstrate, HIPAA is important for protecting patients from improper disclosures of PHI, but also provides a mechanism to ensure the open flow of information to support public health activities.