45 C.F.R. § 164.512 Explained: HIPAA Disclosure Rules

45 C.F.R. § 164.512 is the HIPAA Privacy Rule provision that lets a covered entity disclose protected health information without a patient's written authorization in twelve defined situations, including law enforcement requests, court proceedings, and public health reporting, each governed by its own conditions.

This article covers the federal HIPAA Privacy Rule at 45 C.F.R. § 164.512, which applies only to covered entities (health plans, health care clearinghouses, and health care providers that transmit health information electronically) and their business associates. It does not cover ordinary employers, schools acting in their educational role, or most consumer health and fitness apps, none of which HIPAA binds. State law can impose stricter medical-privacy rules than federal HIPAA does; see the state-law section near the end of this article before assuming a federal answer settles the question.

Information last verified against eCFR-mirrored regulatory text and federal court and agency guidance on August 12, 2026. This article has not yet been reviewed by a licensed lawyer.

What 45 C.F.R. § 164.512 Permits

The HIPAA Privacy Rule's default rule, set out in 45 C.F.R. § 164.508, requires a covered entity to get the patient's written authorization before using or disclosing protected health information (PHI) for most purposes, and 45 C.F.R. § 164.510 requires giving the patient an opportunity to agree or object for certain other uses, such as being listed in a hospital directory. Section 164.512 is the set of narrow, defined exceptions to both of those rules: twelve categories of disclosure a covered entity may make, in most categories may rather than must, without going through authorization or the opportunity to object. Each category carries its own conditions, and meeting one category's conditions does not automatically satisfy another's. The table below summarizes all twelve. The highest-demand categories, law enforcement and legal proceedings, get their own sections further down this page.

Law Enforcement Disclosures Under 164.512(f): What Police Can and Cannot Get

45 C.F.R. § 164.512(f) gives covered entities six separate gateways to disclose PHI to law enforcement, each with its own conditions. The most commonly invoked, 164.512(f)(1), permits disclosure to comply with legal process: a court order, a court-ordered warrant, a grand jury subpoena, or an administrative subpoena or similar demand that is relevant to a legitimate law enforcement inquiry, specific and limited in scope, and could not reasonably be satisfied with de-identified information instead. That means police generally do not need a judge-signed Fourth Amendment warrant specifically to obtain medical records; a qualifying subpoena is often enough on its own. A separate, narrower gateway, 164.512(f)(2), lets a covered entity share limited identifying or locating details, such as name, address, date of birth, and injury type, to help identify or locate a suspect, fugitive, material witness, or missing person, with no legal process required at all. DNA, dental records, and body fluid or tissue samples are excluded from that no-process pathway, though they remain disclosable through a court order, warrant, or written administrative request.

The remaining four law enforcement gateways in 164.512(f) each cover a narrower fact pattern:

• 164.512(f)(3): about a crime victim, with the victim's agreement, or, if the victim cannot agree, if law enforcement represents that the information is needed, will not be used against the victim, and disclosure is in the victim's best interest.
• 164.512(f)(4): about a decedent the covered entity suspects died as a result of criminal conduct.
• 164.512(f)(5): about a crime the covered entity believes in good faith occurred on its own premises.
• 164.512(f)(6): by an emergency department or EMS provider, to alert law enforcement to the commission, nature, and location of a crime, the identity of the victim, and in some cases a description of the perpetrator, during emergency treatment away from the covered entity's premises.

HHS's own guidance on law enforcement disclosures confirms this reading of 164.512(f)(1): disclosure to comply with a court order or court-ordered warrant, a judicial subpoena or summons, or a grand jury subpoena is permitted, and an administrative request also works if the information sought is relevant and material to a legitimate law enforcement inquiry, the request is specific and limited in scope, and de-identified information could not reasonably be used instead. The common belief that police always need a judge-signed warrant to get medical records is incorrect as a blanket statement.

Subpoenas, Court Orders, and Legal Proceedings Under 164.512(e)

45 C.F.R. § 164.512(e) governs disclosure of PHI in judicial and administrative proceedings, separately from the law enforcement gateway in 164.512(f). A covered entity may disclose PHI in response to a court or administrative tribunal order, limited to what the order expressly authorizes, or in response to a subpoena, discovery request, or other lawful process not accompanied by a court order, but only if it receives satisfactory assurance that the requesting party made a good-faith effort to notify the patient and give them a chance to object, or made reasonable efforts to secure a qualified protective order limiting use of the records and requiring their return or destruction once the proceeding ends.

Meeting 164.512(e)'s procedural conditions does not guarantee a court will enforce the subpoena. In Northwestern Memorial Hospital v. Ashcroft, 362 F.3d 923 (7th Cir. 2004), the federal government subpoenaed redacted medical records of patients who had undergone a specific procedure at the hospital, as part of a challenge to the Partial-Birth Abortion Ban Act. The Seventh Circuit affirmed an order quashing the subpoena, holding that the burden and privacy risk to patients, including the realistic chance of identifying them even from redacted records, outweighed the subpoena's limited evidentiary value. According to recordinglaw.com's case-law index, hundreds of federal court decisions cite 45 C.F.R. § 164.512, and Northwestern Memorial is among the most-cited of them.

For a fuller walkthrough of how subpoenas interact with HIPAA, see HIPAA and Subpoenas: When Can PHI Be Disclosed?.

Public Health Reporting, Abuse Reporting, and Health Oversight

45 C.F.R. § 164.512(b) lets a covered entity report to a public health authority for disease and injury prevention and control, including mandatory disease and vital-event reporting and public health surveillance, notify someone who may have been exposed to a communicable disease, and report to FDA-regulated persons on product safety issues. It also lets a covered health care provider disclose specific workplace medical surveillance or work-related injury findings to an employer that requested the evaluation, subject to conditions including written notice to the employee. Section 164.512(c) permits disclosure to a government authority authorized by law to receive reports of abuse, neglect, or domestic violence, generally coupled with a requirement to promptly inform the patient unless doing so would create a safety risk. Section 164.512(d) permits disclosure to a health oversight agency for activities such as audits, investigations, licensure and disciplinary actions, and civil rights compliance tied to the health care system.

The employer-disclosure pathway in 164.512(b) is narrow: it covers only the findings of an employer-requested medical surveillance or fitness-for-duty evaluation, not general treatment records. Ordinary employer drug testing and most employment records fall outside HIPAA entirely, because the definition of protected health information in 45 C.F.R. § 160.103 expressly excludes employment records a covered entity holds in its role as employer. See Does a Failed Drug Test Show Up on Your Medical Record? for how that plays out in practice.

164.512(c) exists specifically to permit reporting suspected abuse, neglect, and domestic violence to the proper authorities, and state law separately mandates that kind of reporting for many professionals. HIPAA is not the obstacle some assume it to be.

Other Permitted Disclosures: Decedents, Research, Organ Donation, and More

The remaining categories in 45 C.F.R. § 164.512 cover more specialized situations. Section 164.512(g) permits disclosure to a coroner or medical examiner to identify a decedent or determine cause of death, and to funeral directors as necessary to carry out their duties, which can begin before death if needed for funeral arrangements. Section 164.512(h) permits disclosure to organ procurement organizations and transplant and tissue banks to facilitate donation. Section 164.512(i) permits disclosure for research where an institutional review board or privacy board has approved a waiver of authorization under specific privacy-protection criteria, or for reviews preparatory to research, or research involving only decedents' information. Section 164.512(j) permits disclosure necessary to prevent or lessen a serious and imminent threat to a person's or the public's health or safety, a duty-to-warn style provision, made to someone reasonably able to prevent or lessen the threat. Section 164.512(k) covers specialized government functions, including military command purposes, national security and intelligence activities authorized under the National Security Act, protective services, correctional institutions and law enforcement custodians, certain public benefits programs, and reporting to the National Instant Criminal Background Check System regarding persons prohibited from possessing firearms. Section 164.512(l) permits disclosure authorized by and necessary to comply with workers compensation or similar no-fault injury benefit laws.

The Minimum Necessary Standard Still Applies

45 C.F.R. § 164.512 authorizes disclosure within a category; it does not authorize disclosing more PHI than that purpose requires. The HIPAA minimum necessary standard at 45 C.F.R. § 164.502(b) generally requires a covered entity to limit PHI to the minimum necessary to accomplish the purpose of the use or disclosure, and that standard applies to most 164.512 categories, including law enforcement, public health, and judicial-proceeding disclosures. The one carve-out is disclosures required by law under 164.512(a): the minimum necessary standard does not apply there, because the other law itself defines what must be disclosed. Outside that narrow exception, a covered entity that hands over an entire medical record when only a specific finding was needed has not necessarily complied with 164.512, even where the category itself applied to the disclosure.

Reproductive Health Privacy: What Was Vacated, and What Remains

In April 2024, HHS finalized a rule adding 45 C.F.R. § 164.502(a)(5)(iii), which barred covered entities from using or disclosing PHI to investigate, impose liability on, or identify a person for the act of seeking, obtaining, providing, or facilitating lawful reproductive health care, along with a new attestation requirement at 164.509 for certain requesters. On June 18, 2025, the U.S. District Court for the Northern District of Texas, in Purl v. HHS (N.D. Tex., Case No. 2:24-cv-00228), granted summary judgment vacating those reproductive-health-care provisions nationwide, holding that HHS had exceeded its statutory authority. The government did not pursue the appeal; the Fifth Circuit dismissed it on September 10, 2025. Multiple health-law trackers describe the ruling as ending the rule.

As of this article's verification date, the codified text of 45 C.F.R. § 164.502(a)(5)(iii) available through eCFR and Cornell's Legal Information Institute still displays the reproductive-health-care prohibition language, with no editorial note reflecting the June 2025 vacatur. That is a known lag between a court's vacatur, which took effect immediately and nationwide by judicial order, and the formal update of the codified regulation text, which has not yet caught up. In practical terms, the reproductive-health-specific restriction and attestation requirement written into the CFR text are not currently in effect and are not being enforced, even though the text has not been formally removed. A separate part of the 2024 rule, notice-of-privacy-practices language tied to substance-use-disorder records, was left intact by the same court order, on its own effective date. That same lag shows up inside 164.512 itself, not just in 164.502: the section's own opening sentence still reads "Except as provided by § 164.502(a)(5)(iii), a covered entity may use or disclose...," and 164.512(c) still includes a (c)(3) rule of construction, added by the same 2024 rule, stating that nothing in 164.512 permits a disclosure prohibited by § 164.502(a)(5)(iii) when the sole basis of an abuse, neglect, or domestic violence report is that the person provided or facilitated reproductive health care. Both references point to the same provision this section describes as currently vacated and unenforced; the codified text of 164.512 has not yet been updated to remove them. Because litigation status and the codified text can both change, confirm the current status directly with HHS or a licensed health-privacy attorney before relying on this section for a specific reproductive-health-record situation.

Can You Sue for a Violation of 164.512?

No. HIPAA, including 45 C.F.R. § 164.512, creates no private right of action. A patient cannot sue a covered entity directly in federal court for an improper disclosure under 164.512. In Acara v. Banks, 470 F.3d 569 (5th Cir. 2006), the Fifth Circuit held that HIPAA contains no express or implied private cause of action and affirmed dismissal for lack of federal subject-matter jurisdiction, noting that every district court to have considered the question had reached the same conclusion. That holding is now a broad multi-circuit consensus: the Second, Fourth, Fifth, Sixth, Seventh, Eighth, Ninth, and Tenth Circuits have all reached the same result, including the Fourth Circuit in Payne v. Taslimi. The available remedies instead run through HHS's Office for Civil Rights, which accepts administrative complaints generally within 180 days of when the complainant knew or should have known of the violation (OCR can extend this deadline for good cause), and through Department of Justice criminal referrals for willful violations. Some patients instead bring state-law claims, such as negligence or breach of confidentiality, built on the same underlying facts.

HIPAA Is a Privacy Floor, Not a Ceiling

45 C.F.R. § 164.512 sets what federal law permits; it does not override a stricter state law. Under 45 C.F.R. § 160.203, a state law that relates to the privacy of individually identifiable health information and is more stringent than the federal standard is not preempted and controls instead. That means a disclosure 164.512 would federally permit, such as a category (f) law enforcement disclosure, may still be blocked by a state statute that requires patient consent or a court order for especially sensitive records, such as mental health or HIV-status information, in some states. It also means 164.512 does not override a state law that independently requires disclosure in narrower or broader circumstances than the federal rule does. Anyone relying on 164.512 to determine whether a specific disclosure is lawful should also check the relevant state's own medical privacy statute.

Common Misconceptions About 164.512

"Police always need a warrant to get my medical records." False as a blanket statement. Under 164.512(f)(1), a court order, a court-ordered warrant, a grand jury subpoena, or a qualifying administrative subpoena or request all suffice on their own, and 164.512(f)(2) permits a narrow set of identifying or locating details with no legal process at all.

"I can sue my doctor or hospital for violating HIPAA." No private right of action exists under HIPAA, per Acara v. Banks and the broad circuit consensus described above. The available remedy is an HHS Office for Civil Rights administrative complaint, or a state-law claim built on the same facts.

"HIPAA covers my health data everywhere, including my employer and fitness apps." HIPAA binds only covered entities, meaning health plans, health care clearinghouses, and health care providers that transmit health information electronically, and their business associates. Ordinary employers acting as employers, most consumer health and fitness apps, and schools acting in their educational role are not covered entities, so 164.512 does not govern the data they hold.

"HIPAA blocks a hospital from reporting suspected abuse." The opposite is true. 164.512(c) specifically permits, and state law often separately requires, disclosure to authorities authorized to receive reports of abuse, neglect, or domestic violence.

"Reproductive health records now have special federal HIPAA protection nationwide." The 2024 rule that created this extra protection was vacated nationwide by a federal court in June 2025, and the government did not pursue the appeal further. The extra protection and its attestation requirement are not currently in effect, even though the codified CFR text has not yet been formally updated to remove them. See the section above for the full explanation.

"If HIPAA allows a disclosure, no state can stop it, and if HIPAA blocks a disclosure, no one can share it." HIPAA is a privacy floor. A stricter state law can still block a disclosure that 164.512 would federally permit, and 164.512 does not override a state law that independently requires disclosure in different circumstances.

Disclaimer

This article provides general information about the federal HIPAA Privacy Rule provision at 45 C.F.R. § 164.512, as in effect and verified against eCFR-mirrored regulatory text and federal court and agency guidance on the date noted above. It is not legal advice and does not create an attorney-client relationship. The reproductive-health-care provisions discussed above are the subject of active litigation history and a lag between the court's ruling and the codified regulation text; confirm current status, and the application of 164.512 to any specific disclosure, with HHS or a licensed attorney before relying on this article for a specific situation.

---

Last updated: August 12, 2026.