• Narrower Definitions of PHA – Not all state laws define Tribal or local entities as “public health authorities” in the same way HIPAA does. In these cases, even if HIPAA permits sharing, the state law may not authorize that data flow. 

• • Tribal facilities on Tribal lands are not subject to state law but follow Tribal laws and regulations which may have additional limitations or considerations. 

• Limitations Based on Health Information Type – Some health data types (e.g., reproductive health, behavioral health, genetic testing, HIV status, testing, and care) may have additional privacy protections under state law that restrict public health access without special approval or circumstances. 

• • One state provides an extra layer of privacy protection for behavioral health records beyond HIPAA, specifying that these data cannot be disclosed without an individual’s written consent, except under very limited circumstances.  

• • If a PHA is investigating an uptick in opioid overdoses, they could review emergency department records to understand how many visits involve patients with a diagnosed substance use disorder, as these data are aggregated and deidentified. However, they could not access identifiable individual-level behavioral health information from patient records without written patient authorization. 

• Data Sharing Prohibitions Across Jurisdictions – Certain jurisdictions limit or require agreements before cross-jurisdictional sharing (e.g., between a hospital and a PHA outside the same jurisdiction). 

• • A major metropolitan area, spanning several states in the eastern U.S., requires a data use agreement (DUA) before sharing specific types of healthcare data (e.g., behavioral health, communicable diseases, and syndromic surveillance) with neighboring PHAs. 

Public health professionals should: 

• Consult legal counsel or privacy experts on applicable STLT laws. 

• Consider establishing formal agreements, such as memorandums of understanding or DUAs that clarify data use parameters, requirements, and limitations. The Network for Public Health Law provides templates for data sharing agreements and DUAs on their website. 

• Engage in education and outreach with clinical partners to reduce misunderstanding and risk-aversion stemming from perceived legal barriers. 

• Consider operating on the concept of the minimum necessary requirement detailed by HIPAA (DHHS, 2003). 

• Stay informed on evolving state laws, especially those related to reproductive health (Lazzarotti and Silver, 2025, DHHS, 2025), substance use data (NASHP, 2021), and behavioral health (Sullivan and Strobel, 2025), and immunization registry reporting (Kolman, 2025).