Table 1.

Table 1 HIPAA Mechanisms for Disclosing Health Information to Public Health Authorities without Patient Authorization

Mechanism of Disclosure	HIPAA Section [8]	Minimum Necessary 164.502(b)	Accounting of Disclosures	Identifiers Allowed	Address	Dates	Approach
Required by law	164.512(a)	No	Yes	All	Full	All	1
Public health activity	164.512(b)	Yes	Yes	All	Full	All	2
De-identification	164.514(b)	No	No	Code not derived from patient identifiers	3-digit zip code in most areas	Year only	3, 6
Research with IRB waiver	164.512(i)	Yes	Yes	All	Full	All	4
Limited data set	164.514(e)	Yes	No	Code that may be derived from patient identifiers (e.g., perfect one-way hash) [20]	5-digit zip code	All	5

HIPAA = Health Insurance Portability and Accountability Act.