Which of the following is NOT a mandatory disclosure under the HIPAA Privacy Rule?

• A. Reporting of traffic fatalities
• B. Disclosures for treatment
• C. Disclosures for payment
• D. Disclosures for health care operations

Answer: (A)

Under the HIPAA Privacy Rule, certain disclosures are allowed without patient authorization to keep care moving: for treatment, for payment, and for health care operations. These categories are designed to let providers share information as part of delivering and administering care and billing, as long as they use the minimum necessary.

Disclosures that are required by law or mandated by public health or safety authorities are handled differently and must meet specific statutory criteria. Reporting traffic fatalities, however, isn’t a standard HIPAA-required disclosure. If a report is needed, it would come from other laws or agencies, not from HIPAA’s mandatory-disclosure provisions. That’s why this option is not a mandatory HIPAA disclosure.

The other options describe routine HIPAA contexts where PHI can be disclosed without the patient’s authorization for treatment, payment, or health care operations.