Public health data sharing efforts implicate many laws. This resource is intended to provide public health managers with general insights into the information their attorneys and privacy officers may be thinking about in response to a data sharing request. Federal, state, and local laws, as well as agency policy may apply to data sharing activities. State and local laws and agency policy vary by jurisdiction.

Relevant Federal Laws

The sections below summarize information about some of the federal laws that most commonly apply to public health data sharing.⁴

The Health Insurance Portability and Accountability Act (HIPAA)

HIPAA is a federal law that created national standards for electronic health care transactions and incorporated privacy protections applicable to protected health information or PHI.⁵ HIPAA applies to “covered entities,” which it defines as a health plan, health care clearinghouse, or health care provider.⁶ HIPAA’s privacy and security rules dictate how a covered entity may use and disclose PHI. Most health departments are HIPAA covered entities or hybrid entities.⁷ Broadly speaking the application of HIPAA’s privacy and security rules follows these steps:

1. Assuming your organization is covered by HIPAA, before entering into a DUA, your organization will need to assess whether HIPAA applies to the data to be disclosed. If the data is considered PHI, HIPAA will apply.
2. If HIPAA applies, the next step is determining whether a HIPAA authorization is needed from the individuals whose PHI is to be shared or whether an applicable exception to the authorization rule applies (e.g., HIPAA’s public health exception).⁸
3. Then, depending on the format of the data to be shared (identifiable⁹, limited data set¹⁰, deidentified¹¹), HIPAA’s regulations may require a DUA with specific terms and conditions.

HIPAA permits covered entities to disclose limited data sets in specified circumstances for research, public health, and health care operations without first obtaining a patient authorization or waiver, as long as the parties executed a DUA that includes required provisions. HIPAA’s privacy rule requires a DUA when a limited data set is used or disclosed.¹² HIPAA does not require a DUA to disclose PHI under HIPAA’s public health exception; however, a DUA is often considered a best practice.

---

⁴ Note that this is not an exhaustive list of federal privacy laws or regulations that may apply to public health data.

⁵ Health Insurance Portability and Accountability Act of 1996, Pub L. No. 104-191, 110 Stat. 1936; see also HIPAA for Professionals, U.S. Dep't of Health & Hum. Servs. (July 19, 2024), https://www.hhs.gov/hipaa/for-professionals/index.html [https://perma.cc/G9JC-VK73].

⁶ 45 C.F.R. § 160.103 (2025). Note that HIPAA only applies to health care providers who transmit health information in electronic form in connection with a HIPAA covered transaction. For practical purposes, this covers most health care providers.

⁷ A hybrid entity is a single legal entity that is covered by HIPAA and whose business activities include both covered and non-covered functions under HIPAA. To become a hybrid entity, an organization must designate its covered and non-covered components, which then allows HIPAA to apply only to the HIPAA covered functions the organization performs. 45 C.F.R. §§ 164.103, 164.105 (2025).

⁸ See 45 C.F.R. §§ 164.508 (authorizations),164.512 (exceptions to authorization) (2025).

⁹ Identifiable health information or protected health information is data that can identify an individual and relates to their past, present, or future health or healthcare.

¹⁰ A limited data set is identifiable healthcare information with certain direct identifiers removed, used for research, public health, or healthcare operations under a data use agreement (DUA).

¹¹ De-identified health information is health information from which all individual identifiers have been removed, making it impossible to identify an individual.

¹² 45 C.F.R. § 164.514(a)–(c), (e) (2025).

42 CFR Part 2

In addition to HIPAA, there are other federal privacy laws that may apply to certain types of health data.¹³ For example, 42 CFR Part 2 applies to and imposes restrictions on the use and disclosure of substance use disorder patient records maintained as part of a Part 2 program. Part 2 is more restrictive than HIPAA and its application needs to be evaluated carefully.

---

¹³ Note that this is not an exhaustive list of federal privacy laws or regulations that may apply to public health data.

The Common Rule

Furthermore, federal protections for human research subjects, also known as the Common Rule,¹⁴ may apply to public health research activities. The Common Rule outlines the basic provisions for Institutional Review Boards (IRBs), informed consent, and assurances of compliance.¹⁵ While not a privacy rule, the Common Rule sets out ethical and other principles for human subjects research and may need to be complied with in addition to other privacy protections. For instance, it may be the case that a health department needs to comply with both the Common Rule and HIPAA’s privacy protections when sharing data as part of a research project.

 

---

¹⁴ 45 C.F.R. pt. 46 (2025).

¹⁵ See Federal Policy for the Protection of Human Subjects, U.S. Dep't of Health & Hum. Servs. (Jan. 15, 2026), https://www.hhs.gov/ohrp/regulations-and-policy/regulations/common-rule/index.html [https://perma.cc/PN8H-PL4D] (providing overview of Common Rule). HIPAA’s privacy rule contains standards for the use and disclosure of PHI for research purposes. 45 C.F.R. § 164.512(i) (2025).

State Privacy Law

State laws may impose additional privacy protections on public health data.¹⁶ State law is often less detailed than HIPAA and may allow disclosure so long as no particular individual can be identified.

¹⁶ 50-State Survey of Health Care Information Privacy Laws, Seyfarth Shaw LLP (2023), https://www.seyfarth.com/a/web/bhRXWBkMif111KfVwiQN6V/50-state-survey-of-health-care-information-privacy-laws-2023-2024-edition.pdf [https://perma.cc/SXQ7-MBET]. 

Subsets of Data That Frequently Have Special Legal Protections in State Law

Although state law often mirrors or defers to federal law on data protection, certain subsets of data may be specially protected under state law. Common examples include special privacy protections for HIV, immunization, communicable disease, and other information that may carry an increased risk of stigma or discrimination.¹⁷ 

---

¹⁷ See, e.g. Mich. Comp. Laws § 333.5131 (2025); Tex. Health & Safety Code Ann. §§ 161.0073, 161.008 (2025); Mich. Admin. Code r. 325.181 (2025). 

Comprehensive Privacy Legislation

In addition to state privacy laws applicable to public health, many states have adopted privacy laws that are more generally applicable. As of April 2025, 19 states have adopted comprehensive privacy legislation, and 15 states have introduced bills that are at various stages of the legislative process.¹⁸ These consumer protection laws generally establish a set of rights and responsibilities for the collection, use, and sharing of personal data across all sectors of the economy by non-governmental organizations.¹⁹ These laws may encompass PHI but the data they protect are broader. While many of these comprehensive privacy laws exempt state and local governments and/or HIPAA covered entities, health departments need to be aware of how comprehensive privacy laws may impact their ability to collect and use data.

---

¹⁸ David Botero, US State Privacy Legislation Tracker, Int’l Ass’n of Priv. Pros. (Feb. 10, 2026), https://iapp.org/resources/article/us-state-privacy-legislation-tracker/ [https://perma.cc/Q9PG-U6Y7].

¹⁹ Jordan Francis, Anatomy of State Comprehensive Privacy Law, Future of Priv. Forum (Nov. 2024), https://fpf.org/wp-content/uploads/2024/11/REPORT-Anatomy-of-State-Comprehensive-Privacy-Law.pdf [https://perma.cc/DU3N-GM39].