HIPAA FAQs
Frequently Asked Questions for Use with Healthcare Organizations: Legal Considerations for Data Sharing related to HIPAA
This section can be used by public health authorities (PHAs) to prepare for conversations with healthcare organizations (HCOs) about legal implications for sharing electronic health information (EHI), and could also be shared with HCOs as part of discussions about access.
1. Can electronic health records be shared with PHAs who are covered entities under HIPAA?
Yes. The HIPAA Privacy Rule (45 CFR 164.512 Subpart A) explicitly allows covered entities (e.g., providers, hospitals) to disclose protected health information (PHI) without patient authorization to PHAs that are legally authorized to collect it for public health activity purposes such as disease reporting, investigation, or outbreak response (45 CFR 164.512 Subpart B).
2. What qualifies as a “Public Health Authority”?
A PHA is an agency or person authorized by law to collect or receive information to prevent or control disease, injury, or disability. This includes:
- State, Tribal, local, and territorial (STLT) health departments
- CDC and other federal public health agencies
- Tribal Epidemiology Centers (TECs), which are designated as PHAs under HIPAA
3. Do we need a patient’s written authorization to share their data for public health purposes?
No, the HIPAA exception allows the disclosure of PHI without individual authorization when the recipient is a PHA operating under a legal mandate (e.g., for reportable conditions, immunizations, case investigations).
4. What kind of data can be shared?
Providers may share EHI that is relevant to the public health activity, such as:
- Laboratory orders and results
- Diagnoses and clinical notes
- Demographic data
- Immunization records
- Hospital discharge data
- Reportable conditions
- Syndromic surveillance indicators
However, disclosures must adhere to the “minimum necessary” standard, only the data needed to fulfill the public health purpose should be shared.
5. What legal safeguards must be in place for EHI sharing?
Covered entities must ensure:
- The PHA is legally authorized to collect the data
- Data is transmitted through secure, HIPAA-compliant methods (e.g., encrypted transmission, secure application programming interfaces (APIs)
- Legal agreements may be established to document roles, responsibilities, and safeguards, including if data is being reshared with others
6. Can EHI be shared electronically (e.g., via application programming interfaces (APIs) or EHR (electronic health record)-to-EHR interfaces)?
Yes. HIPAA does not limit the technology used for legal disclosures. EHI may be shared via:
- Secure file transfers
- Direct interfaces with EHR systems
- Health information exchanges (HIEs)
- APIs using FHIR (Fast Healthcare Interoperability Resources) or other standards
The mode of exchange must comply with HIPAA’s Security Rule requirements.
7. Can EHI be shared with Tribal governments or Tribal health programs?
Tribal Nations are sovereign governments and may have their own privacy policies and laws in addition to HIPAA. Data sharing with Tribal public health entities must:
- Align with Tribal law and respect Tribal data governance principles
- Be legally authorized, especially if data is flowing from a non-Tribal covered entity
- Often involve consultation and formal agreements
- TECs are recognized PHAs and can legally receive PHI under HIPAA
8. What’s the risk of HIPAA violations when sharing with public health?
If disclosures are made in accordance with HIPAA’s public health provisions and proper safeguards are used, there is no risk of violation.
It’s important to:
- Validate that the recipient is a legally authorized public health authority
- Limit disclosures to the minimum necessary
- Use secure and compliant data transmission methods
9. How do we build trust and clarity around EHI sharing with public health?
- Review the benefits to HCOs of sharing PHI with PHAs here [link to section 3 of the Toolkit].
- Educate staff about legal allowances under HIPAA for public health.
- Collaborate early with PHAs/HCOs to establish shared understanding and workflows.
- Develop clear documentation (e.g., memorandum of understandings [MOUs], data sharing protocols).
- Reinforce that public health data sharing is not only legal and permissible — it is essential to protecting community health
This page is available as a downloadable PDF that can be accessed here. [Link to the PDF of this section]
