The HIPAA Privacy Rule recognizes the legitimate need for public health authorities, and others responsible for ensuring the public's health and safety, to have access to protected health information (PHI) to conduct their missions.  HIPAA also recognizes the importance of public health reporting by covered entities to identify threats to the public and individuals.  Accordingly, the rule permits PHI disclosures to public health authorities legally authorized to collect and receive the information for such purposes without a written patient authorization for specified public health purposes.  In addition, the rule permits disclosures that are required by state, local or other public health.

The DHHS Division of Public Health Services conducts the activities of a public health authority as defined by the HIPAA Standards for Privacy of Individually Identifiable Health Information.   The Privacy Rule permits covered entities to disclose to DPHS, without individual authorization, protected health information including, but not limited to: the reporting of disease and injury, vital events such as birth or death, the conduct of public health surveillance, public health investigations, and public health interventions.  Also included in this authority is the monitoring of adverse outcomes related to food (including dietary supplements), drugs, biological products, and medical devices.  Covered entities may report adverse events related to FDA-regulated products or activities to public agencies and private entities that are subject to FDA jurisdiction.