NRPM: Standards for Privacy of Individually Identifiable Health Information. 1. Uses and disclosures for public health activities. (§ 164.510(b))


We propose to permit covered entities to disclose protected health information without individual authorization to public health authorities carrying out public health activities authorized by law, to non-governmental entities authorized by law to carry out public health activities, and to persons who may be at risk of contracting or spreading a disease (when other law authorizes notification). Where the covered entity also is a public health agency, such as a public hospital or local health department, it would be permitted to use protected health information in all cases in which it would be permitted to disclose such information for public health activities under this section.