AhaBulbStuff Everyone Should Know
AhaBulb: Stuff Everyone Should Know · ahabulb.com/hipaa-required-disclosures

HIPAA requires a covered entity to disclose PHI in only two situations. Which pair?

To the patient, and to HHS for compliance reviews.

Start playing free

  1. To the patient, and to HHS for compliance reviews ✔
  2. To police and to employers
  3. To family and to insurers

Why: Disclosure is required only to the patient (access and accounting requests) and to HHS when it investigates compliance. Most other disclosures are permitted, not required.

Huh, didn't know that: Uses and disclosures required by law are also exempt from the minimum necessary standard.

The dad joke
Why was the broom late for work? It over-swept.
Like this card?
Play the game

References

Answer: To the patient, and to HHS for compliance reviews. Disclosure is required only to the patient (access and accounting requests) and to HHS when it investigates compliance. Most other disclosures are permitted, not required.

  1. 45 CFR 164.502 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
    A covered entity is required to disclose protected health information
    Checked 2026-10-11.
  2. 45 CFR 164.502 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
    When required by the Secretary under subpart C of part 160 of this subchapter to investigate
    Checked 2026-10-11.
  3. 45 CFR 164.502 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
    Uses or disclosures that are required by law, as described by § 164.512(a)
    Checked 2026-10-11.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Healthcare Privacy (HIPAA)A breach affects more than 500 residents of one state. Who must be told besides the patients?Healthcare Privacy (HIPAA)How are breaches affecting fewer than 500 people reported?Healthcare Privacy (HIPAA)Where do you file a HIPAA privacy complaint?

That's stuff everyone should know.