Can patient identifiers, including name and birthdate, be collected and stored electronically, incidental to AFIX or VFC visits?
Yes. Under 45 CFR ยง 164.512(b) of the HIPAA Privacy Rule, covered entities may disclose protected health information–including name, birthdate, and other individually identifiable health information–to public health authorities that are authorized by law to collect such information for public health purposes. However, other requirements of the Privacy Rule (including minimum necessary, verification of identity, and accounting requirements) may apply to covered entities making these disclosures. For a full explanation of these requirements, see the website of the Office for Civil Rights (www.hhs.gov/ocr/hipaa) (responsible for enforcing the Privacy Rule), or CDC/DHHS guidance on the Privacy Rule and Public Health, in the MMWR, HIPAA Privacy Rule and Public Health (printable version is available at http://www.cdc.gov/mmwr/pdf/other/m2e411.pdf). Once protected health information has been disclosed to a public health authority for a public health activity pursuant to section 164.512(b) o
