A lab result comes back positive for a condition on the state's reportable list. The new medical assistant asks whether the patient has to sign something before the report goes to the health department. The front desk says no, HIPAA allows it. The physician says the state requires it. All three are describing the same disclosure, and each has hold of a different piece of the rule.
The piece that belongs to HIPAA is 45 CFR 164.512(b), the public health standard. It is a permission, not a mandate, and it names six kinds of recipients, each with its own conditions. This article quotes the standard, explains where the actual duty to report comes from, walks through the six recipients, covers the minimum necessary and verification steps that still apply, notes what has to be logged, and ends with the policy language a small practice needs.
HIPAA Public Health Disclosures Under 45 CFR 164.512(b)
The opening paragraph of 164.512(b)(1) says a covered entity "may use or disclose protected health information for the public health activities and purposes described in this paragraph to:" and the first recipient on the list is:
"A public health authority that is authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury, or disability, including, but not limited to, the reporting of disease, injury, vital events such as birth or death, and the conduct of public health surveillance, public health investigations, and public health interventions; or, at the direction of a public health authority, to an official of a foreign government agency that is acting in collaboration with a public health authority."
Two definitions carry the sentence. "May" means no signed authorization under 164.508 is needed and the patient has no opportunity to object. And "public health authority" is defined in 164.501 as "an agency or authority of the United States, a State, a territory, a political subdivision of a State or territory, or an Indian tribe, or a person or entity acting under a grant of authority from or contract with such public agency," that "is responsible for public health matters as part of its official mandate." A state or county health department qualifies. A contractor running the state's immunization registry under contract with it qualifies. A university researcher, on their own, does not.
Permitted, Not Required: Where the Duty Comes From
HIPAA does not require a practice to report anything to public health. It removes the privacy objection so that other laws can. The duty itself comes from state statutes and regulations, and those vary: the CDC's notifiable disease site states plainly that "the list of reportable conditions varies by state," with the Council of State and Territorial Epidemiologists recommending which conditions states pass on to the national surveillance system. The practice's reporting list is its own state health department's list, and that list, not HIPAA, sets what is reported, how fast, and in what form.
HIPAA reinforces that arrangement in two places. 164.512(a) separately permits disclosures "to the extent that such use or disclosure is required by law," provided the disclosure "complies with and is limited to the relevant requirements of such law." And the preemption rule at 160.203(c) leaves state law standing when it "provides for the reporting of disease or injury, child abuse, birth, or death, or for the conduct of public health surveillance, investigation, or intervention." Put together: the state tells you to report, HIPAA says you may, and nothing in HIPAA lets a practice refuse a lawful public health report on privacy grounds.
The Six Recipients
| Recipient | What may be disclosed | Conditions in the rule | Paragraph |
|---|---|---|---|
| Public health authority | PHI for preventing or controlling disease, injury, or disability: disease and injury reports, births and deaths, surveillance, investigations, interventions | The authority must be "authorized by law to collect or receive" it | (b)(1)(i) |
| Child abuse or neglect authority | Reports of child abuse or neglect | A public health authority or other government authority "authorized by law to receive" such reports | (b)(1)(ii) |
| Person subject to FDA jurisdiction | PHI about the quality, safety, or effectiveness of an FDA-regulated product: adverse events, product defects, tracking, recalls, post-marketing surveillance | The recipient must have responsibility for the product or activity | (b)(1)(iii) |
| Person exposed to a communicable disease | Notice to someone who "may have been exposed" or is "at risk of contracting or spreading a disease or condition" | The practice or public health authority must be "authorized by law to notify such person" | (b)(1)(iv) |
| Employer | Findings about a work-related illness or injury or workplace medical surveillance | Four conditions, including written notice to the employee (see below) | (b)(1)(v) |
| School | Proof of immunization only | School must be required by law to have it; the practice obtains and documents the parent's or adult patient's agreement | (b)(1)(vi) |
Two of these trip up small practices. Reports of abuse of an adult go under a different paragraph, 164.512(c), with its own conditions; only child abuse and neglect reports live here. And the exposed-person paragraph is not a license to warn anyone the clinician thinks should know; the practice must be "authorized by law" to make that notification, which is usually the health department's job.
Employers: Four Conditions and a Written Notice
The employer paragraph matters to any practice that does pre-placement physicals, drug screens, or return-to-work evaluations. The disclosure is permitted only if all four conditions in (b)(1)(v) are met: the practice provides the care "at the request of the employer" to evaluate workplace medical surveillance or a work-related illness or injury; the PHI disclosed "consists of findings concerning a work-related illness or injury or a workplace-related medical surveillance"; the employer needs the findings to comply with its obligations under the OSHA and MSHA recordkeeping rules "or under state law having a similar purpose"; and the practice "provides written notice to the individual" that such information is disclosed to the employer, either by handing the patient a copy at the time of care or, for care given on the work site, by posting the notice prominently where the care is provided.
The findings are what may go to the employer. Faxing the whole chart to HR because "the employer paid for the visit" leaves this paragraph and enters the authorization rule.
Schools: Proof of Immunization, With Documented Agreement
The school paragraph is narrow on purpose. The disclosure "is limited to proof of immunization," the school must be "required by State or other law to have such proof of immunization prior to admitting the individual," and the practice must obtain and document the agreement of a parent, guardian, or person acting in loco parentis for a minor, or of the patient if an adult or emancipated minor. The introductory text of 164.512 allows that agreement to be given verbally, but (b)(1)(vi)(C) still requires the practice to document it. A note in the chart, dated and naming who agreed, satisfies that. A school asking for the full pediatric record needs a signed authorization instead.
Minimum Necessary Still Applies, With a Shortcut
Public health disclosures are subject to the minimum necessary standard in 164.502(b)(1): the practice "must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose." The exception in 164.502(b)(2)(v) removes that limit only for disclosures "required by law," so a state-mandated disease report is measured by what the state form asks, while a voluntary response to a health department survey is measured by what the survey actually needs.
The shortcut is 164.514(d)(3)(iii)(A): a practice "may rely, if such reliance is reasonable under the circumstances, on a requested disclosure as the minimum necessary" when "making disclosures to public officials that are permitted under § 164.512, if the public official represents that the information requested is the minimum necessary for the stated purpose(s)." If the health department's investigator says the case report form is what they need, the practice may fill in the form and stop there. The practical side of the standard is in the minimum necessary rule in daily operations.
Verify Who Is Asking
Before any 164.512 disclosure to someone the practice does not already know, 164.514(h) requires it to "verify the identity of a person requesting protected health information and the authority of any such person." For public officials the rule lists what may be relied on: in person, "an agency identification badge, other official credentials, or other proof of government status"; in writing, a request "on the appropriate government letterhead"; for someone acting on an official's behalf, a written statement on letterhead or other documentation of agency such as a contract. Authority may be verified by "a written statement of the legal authority under which the information is requested," or an oral statement where writing is impracticable. A phone caller who says they are from the health department and wants a patient's address gets a call back at the department's published number, not an answer.
Log It
Public health disclosures are not on the list of disclosures excluded from the accounting of disclosures in 164.528(a)(1). Treatment, payment, and operations are excluded; authorized disclosures are excluded; public health reports are not. Each one therefore needs a log entry with the date, the recipient, a description of the PHI, and the purpose, and the practice must be able to produce that list for any patient who asks for the prior six years. Routine reports to the same agency for the same purpose may be summarized under 164.528(b)(3) as a first entry plus frequency and the date of the last report. A practice that files immunization registry uploads every week and has no log has a six-year hole in its accounting.
A Note on Text the eCFR Still Prints
The 2024 HIPAA rule on reproductive health care privacy added limits to 164.512. A federal district court vacated that rule nationwide in June 2025, and as of this writing the eCFR still displays the vacated text. The paragraphs quoted above are the pre-2024 text, which is what governs; the extra language on the eCFR page is not enforceable. The broader picture is in the Privacy Rule requirements guide.
What to Write Into the Policy
- The reporting list. The state health department's current reportable conditions list, with timeframes and the reporting method, attached to the policy and reviewed annually. This is the "required by law" source that HIPAA defers to; the interaction with state law generally is in state privacy laws vs HIPAA.
- Who reports. The role responsible for disease reports, registry submissions, and adverse event reports, and the role that fields inbound requests from public officials.
- Standard protocols. For each routine, recurring public health disclosure, the fields sent and nothing more, as 164.514(d)(3)(i) requires for recurring disclosures.
- Verification. The badge, letterhead, and call-back steps for any request from an official the practice does not know.
- Employer and school forms. The written employee notice for workplace surveillance findings, and the chart-note template documenting agreement for immunization proof.
- Non-public-health requests. Anything beyond the six recipients (a full chart for a school, an employer's request for history) is routed to the authorization process.
- The log. A disclosure log entry for every public health disclosure, using the summary format for recurring reports, retained six years under 164.530(j).
Back to the positive lab result. The state requires the report, HIPAA permits it, no signature is needed, the report contains what the state form asks, and the disclosure goes in the log. All three people at the front desk were partly right; the policy is where their answers live in one place.
---
FAQ
Does HIPAA require patient authorization to report a disease to the health department?
No. 45 CFR 164.512(b)(1)(i) permits disclosure to a public health authority authorized by law to receive it, without authorization. The duty to report comes from state law; HIPAA supplies the permission.
Who counts as a public health authority under HIPAA?
Under 164.501, an agency or authority of the United States, a state, territory, political subdivision, or tribe, or a person or entity acting under a grant of authority from or contract with such an agency, that is responsible for public health matters as part of its official mandate.
Can we send immunization records to a school without a release?
Only proof of immunization, only where the school is required by law to have it before admitting the student, and only after obtaining and documenting the agreement of the parent or guardian (or the adult patient). Anything more requires an authorization.
Can we disclose exam results to an employer?
Only under the four conditions in 164.512(b)(1)(v): care provided at the employer's request for workplace surveillance or a work-related illness or injury, disclosure limited to those findings, employer need under OSHA-type recordkeeping law, and written notice to the employee.
Do public health disclosures have to be logged?
Yes. They are not among the disclosures excluded from the accounting of disclosures in 164.528(a)(1), so each one must be documented with date, recipient, description, and purpose, and produced on request for the prior six years.
Conclusion
Public health reporting is the disclosure most practices make every week without a policy, a verification step, or a log entry. One Guy Consulting's Full-Scope plan includes the uses-and-disclosures policy, the verification checklist, and the disclosure log, with consulting time for the request that does not look like the last one. Start with a free 30-minute compliance review. No obligation, no pressure.
Sources
- 45 CFR 164.512 (uses and disclosures not requiring authorization; public health at (b))
- 45 CFR 164.501 (definitions, including public health authority)
- 45 CFR 164.514 (minimum necessary and verification)
- 45 CFR 164.502 (minimum necessary standard)
- 45 CFR 160.203 (preemption exceptions, including public health reporting)
- CDC: Surveillance Case Definitions for Notifiable Conditions (NNDSS)
Related Reading