The Health Insurance Portability and Accountability Act (HIPAA) of 1996 has led to the development of new health information privacy standards by the U.S. Department of Health and Human Services (DHHS). The new standards provide protection for the privacy of certain individually identifiable health data, referred to as protected health information (PHI). The HIPAA Privacy Rule 45 CFR §164.512(b) recognizes the legitimate need for public health authorities, that are responsible for protecting the health of the public, to have access to protected health information to carry out their public health functions. The limits on exchange of protected health information generally do not apply to governmental public health agencies. Public Health-Seattle & King County is a public health authority as defined by the HIPAA Privacy Rule, 45 C.F.R §164.501.

The HIPAA privacy standards (Privacy Rule) expressly permit disclosures without individual authorization to public health authorities authorized by law to collect or receive the information for the purposes of preventing or controlling disease, injury, or disability, including but not limited to public health surveillance, investigation, and intervention. The HIPAA Privacy Rule permits covered entities (health care providers, health plans, and health care clearinghouses) to disclose protected health information without client or patient authorization, to public health authorities. Usually an accounting is required for disclosures made without authorization, including public health purposes¹. The covered entity does not need a business associate contract, or other agreement with the public health entity in order to disclose the information.

In Washington State, there are several laws and regulations that require disclosure of certain protected health information to public health authorities, and describe the content of notifiable disease reports. Chief among these are WAC 246-101 Notifiable Conditions (as authorized by RCW 43.20.050 Powers and Duties of State Board of Health), RCW 70.28.010 (health care providers required to report tuberculosis cases) and RCW 70.24 (control and treatment of sexually transmitted diseases).

More information about HIPAA is available on the Washington State DOH web site (www.doh.wa.gov/OS/HIPAA/default.htm) and the Center's for Disease Control and Prevention's (CDC) web site (www.cdc.gov/mmwr/preview/mmwrhtml/su5201a1.htm). If you have additional questions about HIPAA, please contact your regular Public Health representative or Public Health's Privacy Office at 206-205-5975.