Which of the following types of information would an organization generally NOT be required to disclose to law enforcement?

The HIPAA Privacy Rule generally permits, but does not require, a covered entity to disclose Personal Health Information (PHI) to law enforcement without patient authorization. Disclosure is allowed under specific circumstances (e.g., in response to a court order or to report a crime), but it is not a general mandatory reporting obligation. In contrast, other federal laws create affirmative, mandatory duties to report specific information to government agencies. Therefore, PHI is the category of information an organization is generally not required to disclose.

A. The Food, Drug, and Cosmetic Act and its implementing regulations mandate the reporting of adverse drug events to the FDA.
B. The Bank Secrecy Act requires financial institutions to file Suspicious Activity Reports (SARs) with the Financial Crimes Enforcement Network (FinCEN).
C. The Occupational Safety and Health Act (OSHA) requires employers to report all work-related fatalities and serious injuries to OSHA.

1. U.S. Department of Health and Human Services. (2013). 45 C.F.R. § 164.512 - Uses and disclosures for which an authorization or opportunity to agree or object is not required. Section (f), "Disclosures for law enforcement purposes."

2. Financial Crimes Enforcement Network. (n.d.). Bank Secrecy Act. U.S. Department of the Treasury. Retrieved from https://www.fincen.gov/resources/statutes-regulations/bank-secrecy-act. (See 31 U.S.C. § 5318(g)).

3. Occupational Safety and Health Administration. 29 C.F.R. § 1904.39 - Reporting fatalities, hospitalizations, amputations, and losses of an eye as a result of work-related incidents to OSHA. U.S. Department of Labor.