HIPAA GENERAL OPERATING POLICY #18
USES AND DISCLOSURES FOR PUBLIC HEALTH ACTIVITIES
I. General Rule
Except as otherwise provided in HIPAA General Operating Policies 8, 44 and 45, a HCC may disclose PHI without an authorization for the public health activities and purposes described below to:
a. A public health authority that is authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury or disability;
b. A public health authority or other appropriate government authority authorized by law to receive reports of child abuse or neglect;
c. A person subject to the jurisdiction of the FDA with respect to an FDA-regulated product or activity, for the purpose of activities related to the quality, safety or effectiveness of such FDA-regulated product or activity, such as collecting or reporting adverse events, product defects or problems; to track FDA-regulated products; to enable product recalls, repairs, replacements or look back; or to conduct post-marketing surveillance.
d. A person who may have been exposed to a communicable disease or may be at risk of contracting or spreading a disease or condition, if the HCC or public health authority is authorized by law to notify such person;
e. An employer, about an individual who is a member of the workforce of the employer, if:
i. The HCC is a covered health care provider who is a member of the workforce of the employer or who provides healthcare at the request of the employer to conduct an evaluation relating to medical surveillance of the workplace or to evaluate whether the individual has a work-related illness or injury.
ii. The PHI that is disclosed consists of findings concerning a work-related illness or injury or workplace-related medical surveillance.
iii. The employer needs such findings to comply with its obligations under certain federal or state laws to record such illness or injury or to carry out responsibilities for workplace medical surveillance.
iv. The covered health care provider gives written notice to the individual that PHI relating to medical surveillance of the workplace and work-related illnesses and injuries is disclosed to the employer by giving a copy of the notice to the individual when care is provided or, if care is provided at the site of the employer, by posting the notice in a prominent area where care is provided.
Revised 09/04/03