Office for Civil Rights

HIPAA Privacy Rule: Disclosures for Emergency Preparedness - A Decision Tool

The disclosure is to an agency for public health purposes!

The disclosure may be made:

- OR -

covered entities may disclose information in a limited data set (LDS), when it has obtained a data use agreement with the data recipient and the information disclosed is limited to the amount reasonably necessary to accomplish the public health purpose. For more information about disclosures for public health, click here.

With a data use agreement, covered entities may disclose a LDS for public health purposes, such as emergency response planning, to organizations that are not public health authorities authorized to collect or receive protected health information.
While helpful for some activities, this option is not useful if patient identity is needed for emergency response planning.
For example, a physician could disclose that a patient is a 101 year old woman who uses a motorized wheelchair if the agreement specifies age, gender and limitations.

Last revised: November 9, 2006