In HIPAA, which of the following is a permitted disclosure without patient authorization?

• A. Providing patient data to marketing firms without consent
• B. Releasing information to family without consent
• C. Public health reporting as required by law
• D. Publishing patient information on social media

Answer: (C)

Public health reporting as required by law is allowed without patient authorization because HIPAA explicitly permits disclosures to public health authorities for activities mandated by law. This exception supports monitoring and controlling diseases and protecting community health. The other options involve uses that aren’t permitted without consent: sharing data with marketing firms is for promotional purposes and not an allowed public health exception; releasing information to family typically requires patient authorization; and publishing patient information on social media would make PHI public and is not allowed without proper consent or another valid exception.