Skip directly to local search Skip directly to A to Z list Skip directly to navigation Skip directly to site content Skip directly to page options
CDC Home

HIPAA and Perinatal Hepatitis B Prevention

Question and Answer image

These questions and answers are intended to provide guidance to health care providers and public health agencies about the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule and how it impacts perinatal hepatitis B prevention. This information is not intended to provide legal advice to you or your organization.

Does HIPAA permit providers, hospitals, and laboratories to report HBsAg-positive women to state and local health departments (including local health agencies and local boards of health) without the authorization of the individual, regardless of whether the state has a reporting law?

Under 45 CFR § 164.512(b), for disclosures not required by law, covered entities may disclose, without authorization, to a public health authority authorized by law to collect or receive the information for the purpose of preventing or controlling disease, injury, or disability, the minimum necessary information to accomplish the intended public health purpose of the disclosure. In addition, under 45 CFR §164.512(a), covered entities may disclose protected health information to public health authorities if the disclosure is required by law. A specific mandate to report is not required for disclosure. In states that do not have a law that specifically mandates the reporting of maternal HBsAg status, notifiable disease reporting laws mandate reporting of hepatitis B.

Does HIPAA permit providers and hospitals to disclose patient information to state and local health departments (including local health agencies and local boards of health) without the authorization of the individual, for perinatal case management (e.g. immunization, prophylaxis, and post vaccination serology)?

Under 45 CFR § 164.512(b), for disclosures not required by law, covered entities may disclose, without authorization, to a public health authority authorized by law to collect or receive the information for the purpose of preventing or controlling disease, injury, or disability, the minimum necessary information to accomplish the intended public health purpose of the disclosure.

Can patient records be reviewed by state and local health department staff and their contractual agents when conducting quality assurance activities (e.g. chart reviews to assess HBsAg screening rates and appropriate prophylaxis), case investigations and/or disease outbreak activities?

As explained above, under 45 CFR § 164.512(b), for disclosures not required by law, covered entities may disclose, without authorization, to a public health authority authorized by law to collect or receive the information for the purpose of preventing or controlling disease, injury, or disability, the minimum necessary information to accomplish the intended public health purpose of the disclosure.

Does the HIPAA Privacy Rule apply to Indian Health Services and tribal clinics?

Yes. The HIPAA Privacy Rule governs the use and disclosure of protected health information by covered entities (health plans, clearinghouses, and providers who transmit specified transactions electronically). The definition of health plans (45 CFR §160.103) includes the Indian Health Service (IHS) and programs under the Indian Health Care Improvement Act, 25 U.S.C. 1601 et seq. (45 CFR 160.103(1)(xii)).

 

Resources

 

Top of Page

 

Images and logos on this website which are trademarked/copyrighted or used with permission of the trademark/copyright or logo holder are not in the public domain. These images and logos have been licensed for or used with permission in the materials provided on this website. The materials in the form presented on this website may be used without seeking further permission. Any other use of trademarked/copyrighted images or logos requires permission from the trademark/copyright holder...more

External Web Site Policy This graphic notice means that you are leaving an HHS Web site. For more information, please see the Exit Notification and Disclaimer policy.

 
Contact Us:
  • Centers for Disease Control and Prevention
    1600 Clifton Rd
    Atlanta, GA 30333
  • 800-CDC-INFO
    (800-232-4636)
    TTY: (888) 232-6348
    Contact CDC-INFO
USA.gov: The U.S. Government's Official Web PortalDepartment of Health and Human Services
Centers for Disease Control and Prevention   1600 Clifton Rd. Atlanta, GA 30333, USA
800-CDC-INFO (800-232-4636) TTY: (888) 232-6348 - Contact CDC–INFO
A-Z Index
  1. A
  2. B
  3. C
  4. D
  5. E
  6. F
  7. G
  8. H
  9. I
  10. J
  11. K
  12. L
  13. M
  14. N
  15. O
  16. P
  17. Q
  18. R
  19. S
  20. T
  21. U
  22. V
  23. W
  24. X
  25. Y
  26. Z
  27. #