Homeland Security and HIM. Appendix A: Mandatory Reporting--Balancing Patients' Privacy Rights with Public Health Interests

This practice brief has been updated. See the latest version here. This version is made available for historical purposes only.

Editor's note: This document is an appendix to the practice brief "Homeland Security and HIM," Journal of AHIMA vol. 76, no. 6 (2004).

Maintaining health information is an essential duty for health information management (HIM) professionals and their employers. Both state and federal agencies impose regulations requiring maintenance of health information. In some states, hospital licensing laws specify not only that a medical record must be kept for every patient, but also what the record must contain at a minimum. Failure to meet these requirements can cause a facility to lose its license or, in some cases, be ordered to close. The regulations set forth in the Medicare Conditions of Participation also require that medical records be kept and outline in broad terms what such records must include. Accreditation standards of the Joint Commission on Accreditation of Healthcare Organizations and other healthcare-accrediting bodies also require the maintenance of medical records.

Mandatory Reporting

The duty to report health information is also required by law. For example, vital statistics laws require the reporting of births and deaths. Under federal and state statutes, healthcare facilities must report to various data banks certain disease conditions and medical events, such as the treatment of gunshot wounds, suspected child and elder abuse, industrial accidents, as well as certain poisonings, abortions, cancer cases, and communicable diseases. This is referred to as mandatory reporting.

In the United States the authority to require reporting of notifiable conditions resides in the respective state legislatures. Notifiable conditions fall under the categories of infectious diseases; child or elder abuse; evidence of violence (i.e., gunshot wounds); and bioterrorism.1 Reporting notifiable conditions assists the creation of control programs which ensures appropriate medical therapy and the detection of common-source outbreaks.

Mandatory reporting provides the information necessary for public health officials to protect the public's health by tracking communicable diseases and other conditions. Notification allows public health officials to treat persons already ill, provide preventive therapies for individuals who came into contact with infectious agents, and investigate and halt outbreaks. It also allows for assessment of broader patterns by historical trends or geographic clustering. Armed with this knowledge, public health officials can take action by redirecting programs or developing new policies.

History of Mandatory Reporting

The history of mandatory reporting is connected to the history of public health surveillance. Modern public health surveillance originates from the early development of governmental activities to control and prevent communicable diseases. Through monitoring of illnesses, societal regulations eventually led to less infectivity of populated areas. At the end of the 19th century, the state of Massachusetts began the first state-supported collection of health data by age, gender, occupation, socioeconomic level, and locality. Relying on physicians to report this information, the state board of Massachusetts sent out physician notification cards. These postcards were the beginning of systematic reporting. Modern notification follows the same principal outline with the exception of the inclusion of the name and address of the person reporting. As more state and municipal authorities saw the relationship between mortality and communicable diseases to living conditions, mandatory reporting increased. By 1901, all states required notification.

National Reporting

The need for a national reporting system became evident during the outbreak of polio and influenza in the early part of the 20th century. By 1925, all states contributed to the national morbidity report. Compilations of disease reporting requirements were published through a series of conventions held by state epidemiologists and public health officials. During the course of a convention held in 1951, the first standard list of infectious diseases was created.2 Until 1961, the National Office of Vital Statistics produced the Weekly Morbidity Report. After that, the Centers for Disease Control and Prevention (CDC) began publishing the Morbidity and Mortality Weekly Report (MMWR). In its infancy, the MMWR began at the US Marine Hospital Service, the predecessor of today's public health service. Its purpose was to collect morbidity reports on cholera, smallpox, plague, and yellow fever from US interests overseas. This information activated quarantine measures to prevent the introduction and spread of diseases into the nation.

The CDC created the National Notifiable Diseases Surveillance System (NNDSS) and collaborated with the Council of State and Territorial Epidemiologists (CSTE) to determine what was nationally reportable. The list contained 41 infectious diseases. Through the years the list has remained fluid to reflect the health status of society. Various diseases have been added or removed from the list (such as murine typhus fever or AIDS). Noninfectious conditions, such as elevated blood lead levels, have been added as well as risk behaviors, such as "prevalence of cigarette smoking."3 (See "The Reporting Procedure.")

Each state department of health contains protocols for notification procedures. The CDC's interim recommended notification procedures are divided into two categories:4

Preliminary Investigation: Local health departments, in concert with their state health department, should perform a preliminary investigation on a cluster of patients presenting with the following characteristics:

  • A cluster of ill persons with similar disease or syndrome
  • A cluster or even a single case of unexplained disease, syndrome, or deaths
  • Unusual illness in a selected population
  • Higher morbidity and mortality associated with usual disease or syndrome
  • Endemic disease with unexplained increased incidence

Full Investigation: Local health departments should immediately notify the state health departments for investigation of:

  • A cluster of patients that is unexplained after a preliminary investigation
  • One or more cases of disease in a community in which disease does not normally occur
  • A single or cluster of patients presenting with unusual characteristics
  • Endemic disease in a nonendemic area, or in an area without a vector/host for zoonotic disease (disease that can be transmitted between animals and humans)
  • Multiple disease entities in the same patient
  • Illness in an unusual geographic distribution
  • Simultaneous clusters of similar illness in nongeographic areas, domestic or foreign
  • Unusual, atypical, or antiquated strain of agent (including antibiotic resistance pattern)

Procedures for notification in the event of a bioterrorism incident contain the inclusion of the Federal Bureau of Investigation (FBI) and local law enforcement as well as other predetermined response partners such as the CDC.

Mandatory reporting requirements vary across the nation to some degree, but they have a certain degree of continuity. In some states, local or state health officials may require other information of epidemiological or public health value beyond the standard, depending on outbreaks or unforseen events. What these statutes have in common is that reporting is required and the authorization of the patient is generally not needed. In fact, even if the patient expresses the wish not to have information released, healthcare organizations must comply with the reporting requirement.

The challenge for HIM professionals becomes more complex when mandatory reporting requirements conflict with other laws, such as state laws that bar disclosure of mental health treatment records or federal laws that bar disclosure of substance abuse treatment. Some court decisions have allowed access to these records but only to the extent necessary to fulfill the requirements of the reporting statute. In addition, some state confidentiality laws permit exceptions in cases of imminent harm, in which the patient is in immediate danger or there is a threat to public health.

Compliance with mandatory reporting requirements is not always as simple at first sight. HIM professionals must determine their state's requirements and how those requirements may conflict with other confidentiality obligations so that appropriate reporting procedures are in place.


1. Washington State Access Codes, Chapter 246.101.101, Table HC-1, 246.101.301 Table HF-1, "Notifiable Conditions," and Chapter 70.02 RCW, "Medical Records – Health Care Information Access and Disclosure." Available at http://www.leg.wa.gov/wac/index.cfm?fuseaction=chapter&chapter=246-101&RequestTimeout=500.

2. Centers for Disease Control and Prevention. "Mandatory Reporting of Infectious Diseases by Clinicians." Morbidity and Mortality Weekly Report 39, RR-9 (1990): 1-11, 16-17. Available at http://www.cdc.gov/mmwr/preview/mmwrhtml/00001665.htm.

3. CDC. "Historical Perspectives Notifiable Disease Surveillance and Notifiable Disease Statistics–United States, June 1946 and June 1996." Morbidity and Mortality Weekly Report 45, no. 25 (1996): 530-536. Available at http://www.cdc.gov/mmwr/preview/mmwrhtml/00042744.htm.

4. CDC. "CDC Interim Recommended Notification Procedures for Local and State Public Health Department Leaders in the Event of a Bioterrorism Incident." 2001. Available at http://www.bt.cdc.gov/emcontact/investigate.asp.

The Reporting Procedure

While some variation may occur in reporting processes according to specific state or local laws, in general the following flowchart, published by the Centers for Disease Control and Prevention's Morbidity and Mortality Weekly Report illustrates the flow of events in reporting. (Source: "Updated Guidelines for Evaluating Public Health Surveillance Systems." Morbidity and Mortality Weekly Report 50, RR-13 (2001): 1-35.)

References and Resources

Centers for Disease Control and Prevention (CDC). "History of CDC Surveillance Activities." Morbidity and Mortality Weekly Report 39, SS-1 (1990): iii-iv. Available at http://www.cdc.gov/mmwr/preview/mmwrhtml/00001595.htm.

CDC. "Ten Leading Nationally Notifiable Infectious Diseases – United States, 1995." Morbidity and Mortality Weekly Report 45, no. 41 (1996): 8834. Available at http://www.cdc.gov/mmwr/preview/mmwrhtml/00044106.htm.

CDC. "Demographic Differences in Notifiable Infectious Disease Morbidity – United States, 1992-1994." Morbidity and Mortality Weekly Report 46, no. 28 (1997): 637-641. Available at http://www.cdc.gov/mmwr/preview/mmwrhtml/00048395.htm.

CDC. "Updated Guidelines for Evaluating Public Health Surveillance Systems." Morbidity and Mortality Weekly Report 50, RR-13 (2001): 1-35. Available at http://www.cdc.gov/mmwr/preview/mmwrhtml/rr5013a1.htm.

Dixon-Lee, Claire. "The HIM Role in Public Health Disease Surveillance, Public Health Disease Surveillance: An Assessment of US Readiness for Bioterrorism." AHIMA National Convention Proceedings, San Francisco, 2002. Available in the FORE Library: HIM Body of Knowledge at www.ahima.org.

Guglielmo, W. "HIPAA and Homeland Security: Can They Coexist?" Medical Economics 80, no. 24 (2003): 32. Available at http://www.memag.com/be_core/content/journals/m/data/2003/1219/ homeland.html.

Institute of Medicine. The Future of Public Health. Washington, DC: National Academy Press, 1988, p. 56. Available at http://books.nap.edu/books/0309038308/html/56.html#pagetop.

Illinois Department of Public Health. "Years Ago in Public Health." Available at http://www.idph.state.il.us/webhistory.htm.

Office of Civil Rights, Department of Health and Human Services. "OCR Summary of the HIPAA Privacy Rule." Available at http://www.hhs.gov/ocr/hipaa/privacy.html.

Randall, V.R. "Bioterrorism, Public Health and the Law." Course syllabus, 2002, University of Dayton School of Law. Available at http://academic.udayton.edu/health/syllabi/Bioterrorism/ 2PublicHealth/index.htm. [accessed 5/26/04]

Roush, S., G. Birkhead, D. Koo, A. Cobb, D. Fleming. "Mandatory Reporting of Diseases and Conditions by Health Care Professionals and Laboratories." Journal of American Medical Association 282, no. 2 (1999): 164-70. Available at http://www.ncbi.nlm.nih.gov/entrez/ query.fcgi?cmd=Retrieve&db=PubMed&list_uids=10411198&dopt=Abstract.

US Department of Health and Human Services. "Fact Sheet: Protecting the Privacy of Patients' Health Information." 2003. Available at http://www.hhs.gov/news/facts/privacy.html.

Warwick, M. "Public Health in America: A Primer." Journal of Homeland Security, July 2002. Available at http://www.homelandsecurity.org/journal/articles/displayArticle.asp?article=66.

Washington State Department of Health. "Notifiable Conditions." Available at http://www.doh.wa.gov/notify/.

Prepared by

Cynthia Baxter, University of Washington HIA student
Sakiko Taguchi, University of Washington HIA student

Source: Baxter, Cynthia, and Sakiko Taguchi. "Homeland Security and HIM. Appendix A: Mandatory Reporting–Balancing Patients' Privacy Rights with Public Health Interests" Journal of AHIMA 75, no.6 (June 2004): web extra.