Can a hospital, doctor, or other HIPAA-covered entity legally hand over a child's protected health records to the Georgia Child Fatality Review Panel or to a county-level child fatality review committee without patient or family authorization?

Plain-English summary

The Chairman of the Georgia Child Fatality Review Panel asked whether HIPAA's "public health exception" lets hospitals and other covered entities share protected health information about deceased children with the panel and the local county-level child fatality review committees, without needing patient or family authorization.

AG Thurbert Baker said yes, applying a two-part HIPAA test:

Part one: Are the panel and local committees "public health authorities"?
HIPAA defines "public health authority" at 45 C.F.R. § 164.501 as an agency or authority of a state, territory, or political subdivision (or a contractor of such an agency) that "is responsible for public health matters as part of its official mandate." The Georgia Child Fatality Review Panel was created by O.C.G.A. § 19-15-4(a) with a mandate to oversee local review processes, recommend prevention measures, monitor local committee operations, and report to the Governor on child deaths. Local county committees were created by O.C.G.A. § 19-15-3 with parallel investigative duties. Both clearly fit the HIPAA definition.

Part two: Are the disclosures for "public health activities"?
HIPAA permits disclosure to a public health authority for: (1) "preventing or controlling disease, injury, or disability, including, but not limited to, the reporting of disease, injury, vital events such as birth or death, and the conduct of public health surveillance, public health investigations, and public health interventions" (45 C.F.R. § 164.512(b)(1)(i)); and (2) receiving "reports of child abuse or neglect" (§ 164.512(b)(1)(ii)). Reviewing the circumstances of child deaths and recommending measures to reduce them is a textbook "public health investigation" and squarely fits the second category as well.

The Georgia statute reinforces the panel's data-collection authority. O.C.G.A. § 19-15-3(k)(1) and (2) require medical providers, the medical examiner or coroner, and state and local agencies to share specified categories of information with the local committee, including "[m]edical care, including dental, mental, and prenatal health care" and "[p]ertinent information from any social services agency that provided services to the child or family." O.C.G.A. § 19-15-3(k)(3) also gives the local committee a subpoena mechanism through any superior court judge of the circuit when the judge finds the documents or witnesses necessary for the review.

The bottom line was that hospitals, physicians, and other HIPAA-covered entities could and should disclose protected health information about deceased children to the appropriate review committee without seeking authorization from family members or guardians, and would be doing so in compliance with both HIPAA and Georgia law.

Currency note

This opinion was issued in 2004. Subsequent statutory amendments, court decisions, or later AG opinions may have changed the analysis. Treat this page as historical context, not current legal advice. Verify current law before relying on any specific rule, deadline, or remedy mentioned here.

HIPAA itself has been substantially amended since 2004 (most prominently by the HITECH Act in 2009, with corresponding revisions to the HIPAA Privacy Rule in 2013 and ongoing OCR guidance). The public-health-authority exception in 45 C.F.R. § 164.512(b) remains a stable feature, but compliance officers should always check the current regulation and current OCR guidance. Georgia's child-fatality-review statutes have also been amended several times since 2004; the current responsibilities and reporting structures should be verified against the present version of O.C.G.A. Title 19, Chapter 15.

Common questions

Q: Does HIPAA require patient or family authorization for any disclosure of a deceased patient's records?
A: No. HIPAA recognized several categories of permissible disclosures without authorization, including disclosures to public health authorities, law enforcement under specific conditions, and disclosures relating to deceased individuals to coroners and medical examiners. The public-health-authority exception was the cleanest path for child-fatality reviews.

Q: Could a hospital refuse to disclose, citing HIPAA?
A: HIPAA permits but does not require disclosure under § 164.512(b). However, Georgia state law independently required providers, the medical examiner or coroner, and government agencies to provide specified information to the local review committee under O.C.G.A. § 19-15-3(k). So under Georgia law, refusing to provide the statutorily required information would have created its own legal risk, regardless of HIPAA's permissive nature.

Q: What about psychiatric or substance-abuse records, which often have heightened protection?
A: O.C.G.A. § 19-15-3(k)(1)-(2) carved out information "otherwise protected by statute." That means specially protected categories like federally regulated substance-use treatment records (under 42 C.F.R. Part 2) might still need separate analysis. The opinion did not address those special-protection categories in detail.

Q: Did the local committee really have subpoena power?
A: Yes, but indirectly. Under O.C.G.A. § 19-15-3(k)(3), the local committee could obtain a subpoena from a superior court judge of the county or circuit, but only after the judge made a finding that the documents or witnesses were necessary for the review. The committee couldn't issue a subpoena directly.

Q: Who actually sat on a local child fatality review committee?
A: Membership was multi-disciplinary: typically the district attorney, the coroner or medical examiner, law enforcement representatives, the local DFCS director, public health representatives, EMS or pediatric medical professionals, and others depending on county practice.

Q: Could the committee or the state panel publish identifying information about the children whose deaths it reviewed?
A: The opinion did not address publication. As a general matter, child fatality review information was treated as confidential under separate statutory provisions, and reports were typically published in aggregate form only. Anyone considering disclosure of identifying information from a review process should verify the current confidentiality rules.

Background and statutory framework

The HIPAA Privacy Rule, codified at 45 C.F.R. parts 160 and 164, took effect for most covered entities in 2003. It governs how "covered entities" (most healthcare providers, health plans, and healthcare clearinghouses) may use and disclose "protected health information." The general rule is that disclosure requires either patient authorization or a specifically permitted exception. The public-health-authority exception in § 164.512(b) is one of the broadest of those exceptions and was designed to preserve longstanding public-health surveillance, reporting, and investigation programs that predated HIPAA.

The Georgia child fatality review system was established by statute well before HIPAA. The state panel under O.C.G.A. § 19-15-4 oversees the local review process, reports to the Governor, monitors local committees, and makes systemic recommendations. The local committees under O.C.G.A. § 19-15-3 do the actual case-by-case review, working from notice provided by the medical examiner or coroner within 48 hours of any child death in the county. The local committee then has 30 days to convene and review the cause and circumstances of the death.

The information-sharing provisions in O.C.G.A. § 19-15-3(k)(1)-(2) were drafted broadly to support meaningful review: medical providers must share pertinent health information; state, county, and local agencies must share birth records, death records, law enforcement investigative data, medical examiner data, parole and probation records, medical care records (including mental and prenatal), and social services records. The statute essentially built a privileged data-sharing channel into the review process. The 2004 AG opinion confirmed that this state-law channel aligned cleanly with the federal HIPAA framework.

Citations and references

Federal:
- HIPAA, Pub. L. No. 104-191, 110 Stat. 1936 (1996)
- 45 C.F.R. Parts 160 and 164 (HHS Standards for Privacy of Individually Identifiable Health Information)
- 45 C.F.R. § 164.501 (public health authority definition)
- 45 C.F.R. § 164.512(b)(1)(i) (public health activity disclosure)
- 45 C.F.R. § 164.512(b)(1)(ii) (child abuse/neglect disclosure)

Statutes:
- O.C.G.A. § 19-15-1(7) (definition: Georgia Child Fatality Review Panel)
- O.C.G.A. § 19-15-3 (local child fatality review committees, including 48-hour notification, 30-day review window, information requirements, and subpoena mechanism)
- O.C.G.A. § 19-15-4 (creation of state panel; oversight and policy duties)

Source

• Landing page: https://law.georgia.gov/opinions/2004-9
• Original PDF: not linked from landing page

Original opinion text

This opinion is in response to your request concerning whether the Georgia Child Fatality Review Panel and the local child fatality review committees may rely on the Health Insurance Portability and Accountability Act's (hereinafter "HIPAA" or "the Act")[1] public health exception in collecting, receiving, and reviewing protected health information from covered entities under the Act. The HIPAA Privacy Rule ("the Rule")[2] recognizes the legitimate need for public health authorities and others responsible for assuring public health and safety to have access to protected health information to carry out their public health mission. Pursuant to the Rule, a covered entity may disclose protected health information without authorization from the individual to "[a] public health authority that is authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury, or disability, including, but not limited to, the reporting of disease, injury, vital events such as birth or death, and the conduct of public health surveillance, public health investigations, and public health interventions." 45 C.F.R. § 164.512(b)(1)(i). Additionally, disclosures may be made to "[a] public health authority or other appropriate government authority authorized by law to receive reports of child abuse or neglect." 45 C.F.R. § 164.512(b)(1)(ii). A public health authority "means an agency or authority of the United States, a State, a territory, a political subdivision of a State or territory, or an Indian tribe, or a person or entity acting under a grant of authority from or contract with such public agency, including the employees or agents of such public agency or its contractors or persons or entities to whom it has granted authority, that is responsible for public health matters as part of its official mandate." 45 C.F.R. § 164.501. Invoking the public health exception under HIPAA first requires demonstrating that an entity has been given statutory authority over a matter of public health as part of its official mandate. The Georgia Child Fatality Review Panel is created by state law.[3] As set forth in O.C.G.A. § 19‑15‑1(7), "[t]he panel oversees the local child fatality review process and reports to the Governor on the incidence of child deaths with recommendations for prevention." Additional and specific duties are set out in O.C.G.A. § 19‑15‑4(g)-(j), including reviewing the reports of local review committees and recommending measures to decrease the incidence of child deaths. Among these additional duties are collecting and sharing information with other state agencies "which provide services to children and families or investigate child deaths" and monitoring the operations of the local child fatality review committees.[4] In addition to the Georgia Child Fatality Review Panel, O.C.G.A. § 19‑15‑3 provides that "[e]ach county shall establish a local multidisciplinary, multiagency child fatality review committee." The chairperson of the local review committee is required to be notified within 48 hours of the death "[w]hen a county medical examiner or coroner receives a report regarding the death of any child [in] the county or circuit." O.C.G.A. § 19‑15‑3(h). When a child's death meets the criteria for review, the chairperson "shall convene the review committee within 30 days after receipt of the report for a meeting to review and investigate the cause and circumstances of the death. Review committee members shall provide [specific] information . . . except where otherwise protected by statute."[5] In addition to the statutorily specified information, state law authorizes a local child fatality review committee to "obtain from any superior court judge of the county or circuit for which the review committee was created a subpoena to compel the production of documents or attendance of witnesses when that judge has made a finding that such documents or witnesses are necessary for the review committee's review." O.C.G.A. § 19-15-3(k)(3). Under Georgia's statutory scheme establishing and empowering the Georgia Child Fatality Review Panel and the local child fatality review committees, both entities are "authorized by law" to collect and receive protected health information and both meet the criteria established by the Department of Health and Human Services to be considered a "public health authority." See 45 C.F.R. § 164.501 and §164.512. The second important requirement for invoking the public health exception is that the purpose for which the data is being disclosed is a public health activity.[6] Although the Rule does not provide a discrete definition for "public health activity," it does list those uses that are included in the phrase "public health activities and purposes." 45 C.F.R. § 164.512(b)(1)(i) and (ii). Those uses include collecting or receiving information for the purpose of "preventing or controlling . . . injury . . . including, but not limited to, the reporting of . . . injury, . . . the conduct of public health surveillance, public health investigations, and public health interventions" and "receiv[ing] reports of child abuse or neglect." Id. As discussed earlier in this opinion,[7] among the statutory purposes of the Georgia Child Fatality Review Panel and the local child fatality review committees are reviewing the circumstances of child fatalities and recommending measures to reduce child fatalities. These functions clearly fit under the public health activity of "public health investigations"; that is, collecting, receiving, and reviewing information, including reports of child abuse, for the purpose of identifying causes, making recommendations, and preventing injury. In summary, in order to meet the public health exception for purposes of disclosing protected health information an entity must be (1) a public health authority responsible for public health matters as part of its official mandate that is (2) authorized by law to collect or receive such information for the purposes specified or (3) authorized by law to receive reports of child abuse or neglect.[8] The Georgia Child Fatality Review Panel and local child fatality review committees, as constituted by state law, meet each of these criteria. Therefore, it is my official opinion that the Georgia Child Fatality Review Panel and local child fatality review committees are public health authorities as defined by the Health Insurance Portability and Accountability Act of 1996 and the regulations promulgated pursuant to the Act by the Department of Health and Human Services, that they are authorized by law to receive public health information, including reports of child abuse and neglect, in order to carry out their statutory duties, and that they are thereby authorized to obtain protected health information from covered entities under the Act's public health exception. Prepared by: LAURA W. HYMAN Assistant Attorney General [1] Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, 110 Stat. 1936. [2] HHS Standards for Privacy of Individually Identifiable Health Information, 45 C.F.R. pts. 160 and 164 (2003). [3] "There is created the Georgia Child Fatality Review Panel as defined in paragraph (7) of Code Section 19-15-1." O.C.G.A. § 19-15-4(a). [4] Included in the duty to recommend child protective measures are identifying risk factors for children, collecting and sharing information among state child protective agencies, recommending measures for improving coordination of services, identifying trends in child deaths, investigating the relationship between child deaths and family violence, reviewing reports from local child fatality review committees, providing training and written materials, developing investigation protocols, monitoring the operations of local review committees, and developing and implementing any necessary internal operating procedures and policies. O.C.G.A. § 19‑15‑4(h)(1)-(10). [5] The specific information required by O.C.G.A. § 19‑15‑3(k)(1) and (2) is: "(1) The providers of medical care and the medical examiner or coroner shall provide pertinent health and medical information regarding a child whose death is being reviewed by the local review committee; (2) State, county, or local government agencies shall provide all of the following data on forms designated by the panel for reporting child fatalities: Birth information for children who died at less than one year of age including confidential information collected for medical and health use; Death information for children who have not reached their eighteenth birthday; Law enforcement investigative data, medical examiner or coroner investigative data, and parole and probation information and records; Medical care, including dental, mental, and prenatal health care; and Pertinent information from any social services agency that provided services to the child or family." [6] "A covered entity may disclose [to a public health authority] protected health information for the public health activities and purposes described in this paragraph." 45 C.F.R. 164.512(b)(1) (emphasis added). [7] See notes 3, 4, and 5 and accompanying text supra. [8] See 45 C.F.R. § 164.501, § 164.512(b)(1)(i) and (ii).