Disclosures for Law Enforcement Purposes

An important ingredient in ensuring compliance with the Privacy Rule is the Department of Health and Human Services’ (HHS) responsibility to investigate complaints that the Rule has been violated and to follow up on other information regarding noncompliance.

Yes, The Rule recognizes that various agencies and public officials will need protected health information to deal effectively with a bioterrorism threat or emergency.

The Privacy Rule is balanced to protect an individual’s privacy while allowing important law enforcement functions to continue.

If a state agency is not a “covered entity”, as that term is defined at 45 CFR 160.103, it is not required to comply with the HIPAA Privacy Rule and, thus, any disclosure of information by the state agency pursuant to its state public records law would not be subject to the Privacy Rule.

The Privacy Rule permits a health plan to respond to a request for information by a IV-D agency pursuant to a National Medical Support Notice (NMSN), as described below.