A Model for Expanded Public Health Reporting in the Context of HIPAA

Table 1

HIPAA Mechanisms for Disclosing Health Information to Public Health Authorities without Patient Authorization

Mechanism of Disclosure	HIPAA Section [8]	Minimum Necessary 164.502(b)	Accounting of Disclosures	Identifiers Allowed	Address	Dates	Approach
Required by law	164.512(a)	No	Yes	All	Full	All	1
Public health activity	164.512(b)	Yes	Yes	All	Full	All	2
De-identification	164.514(b)	No	No	Code not derived from patient identifiers	3-digit zip code in most areas	Year only	3, 6
Research with IRB waiver	164.512(i)	Yes	Yes	All	Full	All	4
Limited data set	164.514(e)	Yes	No	Code that may be derived from patient identifiers (e.g., perfect one-way hash) [20]	5-digit zip code	All	5

HIPAA = Health Insurance Portability and Accountability Act.

This Article

Access policy for JAMIA

All content published in JAMIA is deposited with PubMed Central by the publisher with a 12 month embargo. Authors/funders may pay an Unlocked fee of $2,000 to make the article free on the JAMIA website and PMC immediately on publication.

All content older than 12 months is freely available on this website.

AMIA members can log in with their JAMIA user name (email address) and password or via the AMIA website.