SESK: Stuff Everyone Should Know · sesk.info/hipaa-required-disclosures
HIPAA requires a covered entity to disclose PHI in only two situations. Which pair?
To the patient, and to HHS for compliance reviews.
- To the patient, and to HHS for compliance reviews ✔
- To police and to employers
- To family and to insurers
Why: Disclosure is required only to the patient (access and accounting requests) and to HHS when it investigates compliance. Most other disclosures are permitted, not required.
Huh, didn't know that: Uses and disclosures required by law are also exempt from the minimum necessary standard.
Why was the broom late for work? It over-swept.
Like this card?
References
Answer: To the patient, and to HHS for compliance reviews. Disclosure is required only to the patient (access and accounting requests) and to HHS when it investigates compliance. Most other disclosures are permitted, not required.
- 45 CFR 164.502 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
A covered entity is required to disclose protected health information: (i) To an individual
Checked 2026-10-10. - 45 CFR 164.502 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
When required by the Secretary under subpart C of part 160 of this subchapter to investigate
Checked 2026-10-10.
Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.
More stuff everyone should know
Work SkillsDoes HIPAA protect patient information that is spoken out loud, or only paper and computer records?Work SkillsA hospital's HR office keeps Dana's pre-hire physical in Dana's personnel file, as the employer. Is that file PHI?Work SkillsFor how long after a person dies must a covered entity keep protecting that person's health information?
That's stuff everyone should know.