Although HIPAA's "minimum necessary" rule does not apply to these or other mandatory reporting requirements, HIPAA does require physicians to make "reasonable efforts" to protect their patients’ confidential health information. Prior to disclosure of this information, physicians or their staff should verify the identity and authority of the person requesting and/or receiving the information, if unknown. Where the disclosure is to a public official, verification may be achieved by presentation of proof of government status—such as a badge or a written statement on government letterhead of legal authority to request and/or receive the information.

HIPAA also requires physicians to keep a log of such disclosures, so that patients or their personal representatives may request an accounting of disclosures of their protected health information for the six-year period prior to the request. For more information on this requirement, including a form that physicians can use to log disclosures, see CMA ON-CALL document #1122, "Accounting of Disclosures."

For more details about public health reporting requirements, see ON-CALL documents #1506, "Reporting Communicable Diseases," and #1100, "Medical Records: Most Commonly Asked Questions." Document #1100 contains a convenient chart of physicians’ various reporting/warning obligations and the impact of the HIPAA privacy rule on these obligations.

ON-CALL documents are available free to members at CMA’s members-only website. Nonmembers can purchase ON-CALL documents for $2 per page from CMA's online bookstore. If you don’t have a computer, call CMA’s HIPAA Help Line, 415/882-3311 for assistance.

For more HIPAA information, visit the HIPAA Help section.

Contact: CMA’s HIPAA Help Line, 415/882-3311 or legalinfo@cmanet.org.

Previous HIPAA Tips:

HIPAA Tip: FAQ about OHCAs

HIPAA Tip: Chart Cabinets

How Sharp are Your HIPAA Tools?

HIPAA Tip: Security Rule Delay

HIPAA Tip: Sign-In Sheets

HIPAA Tip: Using Patient Names

HIPAA Tip: Using Reminder Postcards

HIPAA Tip: Extension Does Not Apply to Privacy Rule

HIPAA Tip: Inpatient/Outpatient Privacy Notice Requirements Differ

HIPAA Tip: The Extension Deadline Has Passed—Now What?