The HIPAA Privacy Rule provides that protected health information may be used and disclosed to DHHS in its role as a Health Oversight Agency, without the authorization of the subject of that information, for health oversight activities that are authorized by law.  Examples of such activities are inspection, licensure and other activities necessary for the appropriate oversight of entities subject to government regulatory programs for which health information is necessary for determining compliance with program standards.