HIPAA Disclosures Required by Law and Public Health (45 CFR 164.512)
Disclosures permitted without authorization or opportunity to agree, including public health, judicial proceedings, law enforcement, and serious threats to health or safety.
Primary source
45 CFR 164.512 — eCFR →https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.512
Verified May 23, 2026 · This is the authoritative regulator URL. The summary below is a research aid; the linked source controls.
45 CFR 164.512 is the catalog of permitted disclosures that require neither authorization nor opportunity to agree. The major categories: disclosures required by law (a); public health activities to public health authorities (b); about victims of abuse, neglect, or domestic violence (c); for health oversight activities (d); for judicial and administrative proceedings (e); for law enforcement purposes (f); about decedents to coroners and funeral directors (g); for cadaveric organ donation (h); for research with IRB or Privacy Board waiver (i); to avert a serious threat to health or safety (j); for specialized government functions including military and national security (k); and for workers' compensation (l).
Each subsection carries its own threshold and documentation requirements. Law enforcement disclosures, for example, are bounded by the type of process served (court order, subpoena, administrative request) and require minimum necessary plus verification of identity and authority.
Disclosures under 164.512 are subject to the accounting of disclosures requirement in 164.528 (unless explicitly excluded). Practices should map each disclosure type their operations make to the specific 164.512 subsection that authorizes it.
Use this in your workspace
D3rx assembles the documentation linked to this regulation, walks the practical decisions in plain English, and stores the artifacts against the .gov sources cited above. It is an administrative research aid, not a substitute for counsel.
Related regulations
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- RegulationHIPAA Accounting of Disclosures (45 CFR 164.528)Individuals may request an accounting of disclosures of their PHI made by a covered entity in the prior six years, with a defined list of exclusions.
- RegulationHIPAA Privacy Rule: General Rules for Uses and Disclosures (45 CFR 164.502)The general rules covered entities follow for any use or disclosure of protected health information, including the minimum necessary standard and treatment, payment, and operations exceptions.
- RegulationHIPAA Business Associate Agreements (45 CFR 164.504(e))Required contract elements for any business associate that creates, receives, maintains, or transmits PHI on behalf of a covered entity.
- ComplianceAccounting of Disclosures (45 CFR § 164.528): Tracker + ProcedureA 2026 HIPAA Accounting of Disclosures procedure citing 45 CFR § 164.528 — the six-year lookback, what to log, exclusions, and a copy-ready tracker template.
- RegulationHIPAA Research Uses and Disclosures (45 CFR 164.512(i))Research uses of PHI without individual authorization require either IRB or Privacy Board waiver, a limited data set with data use agreement, or reviews preparatory to research and decedent research with specific safeguards.
- SRAHIPAA Risk Analysis for a Physical Therapy PracticeWhat an outpatient physical therapy clinic owes under 45 CFR 164.308(a)(1)(ii)(A), with the ePHI workflows specific to PT, OT, and rehab settings.
- GlossaryAccounting of DisclosuresThe HIPAA right of an individual to receive a list of disclosures of their PHI made by a covered entity over the prior six years.
- BillingBusiness Associate Agreement Checklist for Small PracticesA working checklist for small practices to identify which vendors need a Business Associate Agreement, what clauses the BAA must contain, and how to track them.
Last reviewed May 23, 2026 · Citation verified May 23, 2026
Research aid, not legal advice. This summary is an administrative research aid prepared by D3rx. It does not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. For authoritative regulatory text follow the primary source link at the top of this page. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.