NRPM: Standards for Privacy of Individually Identifiable Health Information. f. Carve-out for State public health laws.


Section 1178(b) provides that “Nothing in this part shall be construed to invalidate or limit the authority, power, or procedures established under any law providing for the reporting of disease or injury, child abuse, birth, or death, public health surveillance, or public health investigation or intervention.” This section appears to carve out an area over which the States have traditionally exercised oversight and authority -- the collection of vital statistics, the enforcement of laws regarding child abuse and neglect, and the conduct of public health surveillance, investigation, and intervention. State laws in these areas may involve reporting of individually identifiable health information to State or local authorities. Section 1178(b) indicates that existing or future State laws in these areas are enforceable, notwithstanding any privacy requirements adopted pursuant to section 264(c). In addition, covered entities should not be inhibited from complying with requests authorized by State law for release of information by public health authorities for the stated purposes.

It should be noted that the limitation of section 1178(b) applies to the “authority, power, or procedures established under any law.” Public health laws often convey broad general authorities for the designated agency to protect public health, including enforcement powers, and these State authorities and powers would remain enforceable. Further, section 1178(b) also covers “procedures” authorized by law; we read this language as including State administrative regulations and guidelines.

The proposed rules propose to address these concerns by treating the disclosures covered by section 1178(b) as allowable disclosures for public health activities under proposed § 164.510(b). Thus, those disclosures permitted under proposed § 164.510(b) are intended to be, with respect to disclosures authorized by State law, at least as broad as section 1178(b). This means that disclosures that are authorized by State law but which do not come within the scope of proposed § 164.510(b) are considered to fall outside of the limitation of section 1178(b). In addition, since similar activities and information gathering are conducted by the federal government, disclosures to public health authorities authorized by federal law would be permitted disclosures under this proposed rule and applicable federal law will govern the use and re-disclosure of the information.