If a state law requires a covered health care provider to disclose proof of a student’s immunizations directly to a school without the affirmative permission of a parent or guardian, must the health care provider also obtain the agreement of a parent or guardian in accordance with 45 CFR 164.512(b)(1)(vi) of the Privacy Rule prior to making the disclosure?

Answer:

No.  The Privacy Rule permits a covered entity to use or disclose protected health information to the extent that such use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of that law.  See 45 CFR 164.512(a).  In such cases, the covered entity is not required to also meet the conditions of 45 CFR 164.512(b)(1)(vi) in making the required by law disclosure.