This opinion is in response to your request concerning whether the Georgia Child Fatality Review Panel and the local child fatality review committees may rely on the Health Insurance Portability and Accountability Act’s (hereinafter “HIPAA” or “the Act”)[1] public health exception in collecting, receiving, and reviewing protected health information from covered entities under the Act.

The HIPAA Privacy Rule (“the Rule”)[2] recognizes the legitimate need for public health authorities and others responsible for assuring public health and safety to have access to protected health information to carry out their public health mission. Pursuant to the Rule, a covered entity may disclose protected health information without authorization from the individual to “[a] public health authority that is authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury, or disability, including, but not limited to, the reporting of disease, injury, vital events such as birth or death, and the conduct of public health surveillance, public health investigations, and public health interventions.” 45 C.F.R. § 164.512(b)(1)(i). Additionally, disclosures may be made to “[a] public health authority or other appropriate government authority authorized by law to receive reports of child abuse or neglect.” 45 C.F.R. § 164.512(b)(1)(ii). A public health authority “means an agency or authority of the United States, a State, a territory, a political subdivision of a State or territory, or an Indian tribe, or a person or entity acting under a grant of authority from or contract with such public agency, including the employees or agents of such public agency or its contractors or persons or entities to whom it has granted authority, that is responsible for public health matters as part of its official mandate.” 45 C.F.R. § 164.501.

Invoking the public health exception under HIPAA first requires demonstrating that an entity has been given statutory authority over a matter of public health as part of its official mandate. The Georgia Child Fatality Review Panel is created by state law.[3] As set forth in O.C.G.A. § 19‑15‑1(7), “[t]he panel oversees the local child fatality review process and reports to the Governor on the incidence of child deaths with recommendations for prevention.” Additional and specific duties are set out in O.C.G.A. § 19‑15‑4(g)-(j), including reviewing the reports of local review committees and recommending measures to decrease the incidence of child deaths. Among these additional duties are collecting and sharing information with other state agencies “which provide services to children and families or investigate child deaths” and monitoring the operations of the local child fatality review committees.[4]

In addition to the Georgia Child Fatality Review Panel, O.C.G.A. § 19‑15‑3 provides that “[e]ach county shall establish a local multidisciplinary, multiagency child fatality review committee.” The chairperson of the local review committee is required to be notified within 48 hours of the death “[w]hen a county medical examiner or coroner receives a report regarding the death of any child [in] the county or circuit.” O.C.G.A. § 19‑15‑3(h). When a child’s death meets the criteria for review, the chairperson “shall convene the review committee within 30 days after receipt of the report for a meeting to review and investigate the cause and circumstances of the death. Review committee members shall provide [specific] information . . . except where otherwise protected by statute.”[5] In addition to the statutorily specified information, state law authorizes a local child fatality review committee to “obtain from any superior court judge of the county or circuit for which the review committee was created a subpoena to compel the production of documents or attendance of witnesses when that judge has made a finding that such documents or witnesses are necessary for the review committee’s review.” O.C.G.A. § 19-15-3(k)(3). Under Georgia’s statutory scheme establishing and empowering the Georgia Child Fatality Review Panel and the local child fatality review committees, both entities are “authorized by law” to collect and receive protected health information and both meet the criteria established by the Department of Health and Human Services to be considered a “public health authority.” See 45 C.F.R. § 164.501 and §164.512.

The second important requirement for invoking the public health exception is that the purpose for which the data is being disclosed is a public health activity.[6] Although the Rule does not provide a discrete definition for “public health activity,” it does list those uses that are included in the phrase “public health activities and purposes.” 45 C.F.R. § 164.512(b)(1)(i) and (ii). Those uses include collecting or receiving information for the purpose of “preventing or controlling . . . injury . . . including, but not limited to, the reporting of . . . injury, . . . the conduct of public health surveillance, public health investigations, and public health interventions” and “receiv[ing] reports of child abuse or neglect.” Id. As discussed earlier in this opinion,[7] among the statutory purposes of the Georgia Child Fatality Review Panel and the local child fatality review committees are reviewing the circumstances of child fatalities and recommending measures to reduce child fatalities. These functions clearly fit under the public health activity of “public health investigations”; that is, collecting, receiving, and reviewing information, including reports of child abuse, for the purpose of identifying causes, making recommendations, and preventing injury.

In summary, in order to meet the public health exception for purposes of disclosing protected health information an entity must be (1) a public health authority responsible for public health matters as part of its official mandate that is (2) authorized by law to collect or receive such information for the purposes specified or (3) authorized by law to receive reports of child abuse or neglect.[8] The Georgia Child Fatality Review Panel and local child fatality review committees, as constituted by state law, meet each of these criteria.

Therefore, it is my official opinion that the Georgia Child Fatality Review Panel and local child fatality review committees are public health authorities as defined by the Health Insurance Portability and Accountability Act of 1996 and the regulations promulgated pursuant to the Act by the Department of Health and Human Services, that they are authorized by law to receive public health information, including reports of child abuse and neglect, in order to carry out their statutory duties, and that they are thereby authorized to obtain protected health information from covered entities under the Act’s public health exception.

Prepared by:

LAURA W. HYMAN

Assistant Attorney General

[1] Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, 110 Stat. 1936.

[2] HHS Standards for Privacy of Individually Identifiable Health Information, 45 C.F.R. pts. 160 and 164 (2003).

[3] “There is created the Georgia Child Fatality Review Panel as defined in paragraph (7) of Code Section 19-15-1.” O.C.G.A. § 19-15-4(a).

[4] Included in the duty to recommend child protective measures are identifying risk factors for children, collecting and sharing information among state child protective agencies, recommending measures for improving coordination of services, identifying trends in child deaths, investigating the relationship between child deaths and family violence, reviewing reports from local child fatality review committees, providing training and written materials, developing investigation protocols, monitoring the operations of local review committees, and developing and implementing any necessary internal operating procedures and policies. O.C.G.A. § 19‑15‑4(h)(1)-(10).

[5] The specific information required by O.C.G.A. § 19‑15‑3(k)(1) and (2) is:

“(1) The providers of medical care and the medical examiner or coroner shall provide pertinent health and medical information regarding a child whose death is being reviewed by the local review committee;

(2) State, county, or local government agencies shall provide all of the following data on forms designated by the panel for reporting child fatalities:

  • Birth information for children who died at less than one year of age including confidential information collected for medical and health use;
  • Death information for children who have not reached their eighteenth birthday;
  • Law enforcement investigative data, medical examiner or coroner investigative data, and parole and probation information and records;
  • Medical care, including dental, mental, and prenatal health care; and
  • Pertinent information from any social services agency that provided services to the child or family.”

[6] “A covered entity may disclose [to a public health authority] protected health information for the public health activities and purposes described in this paragraph.” 45 C.F.R. 164.512(b)(1) (emphasis added).

[7] See notes 3, 4, and 5 and accompanying text supra.

[8] See 45 C.F.R. § 164.501, § 164.512(b)(1)(i) and (ii).