Under HIPAA, disclosures without patient consent are permissible for which purposes?

• A. Marketing to patients
• B. Personal use by staff without authorization
• C. Public health activities and research
• D. Financial audits by unrelated companies

Answer: (C)

Disclosures without patient consent are allowed when they serve public health or research needs. The HIPAA Privacy Rule explicitly permits sharing PHI with public health authorities to prevent or control disease, report outbreaks, track immunizations, and fulfill other public health duties. It also allows disclosures for research purposes without individual authorization, provided safeguards are in place—such as an IRB or Privacy Board approving a waiver of authorization or use of de-identified data, or a limited data set shared under a data use agreement. These provisions recognize that advancing public health and enabling important research can justify sharing information with appropriate protections.

Marketing to patients generally requires patient authorization or falls under narrow, specific exceptions; personal use by staff without authorization violates privacy protections and is not allowed; disclosures to unrelated companies for financial audits aren’t blanketly permitted without the proper framework (such as a business associate agreement and a legitimate operational purpose), so they aren’t a default without consent.