Child Fatality Review Team HIPAA Compliance Checklist

A child fatality review team may need health information to examine a child’s death and identify ways to prevent future fatalities. But a team’s name or public purpose does not, by itself, authorize a covered entity to disclose protected health information (PHI).

Use this checklist to confirm the team’s legal authority, identify the applicable disclosure permission, and limit and protect the information you share. State child fatality review statutes and other confidentiality laws vary, so verify the rules for your jurisdiction before responding to a request.

When may a covered entity disclose PHI to a child fatality review team?

HIPAA does not create a blanket permission for disclosures to every child fatality review team. A covered entity may disclose PHI without individual authorization when a specific HIPAA permission applies—for example, when a team is a public health authority legally authorized to receive the information for a public health investigation, or when another applicable law requires the disclosure.

The HIPAA public health authority disclosure provision permits disclosures to an authority legally authorized to receive information for public health activities, including investigations and the reporting of vital events such as deaths. A team’s statutory role, its relationship to a government authority, and the purpose of the request matter. HHS guidance on disclosures for public health activities explains these permissions under 45 C.F.R. § 164.512(b).

• Identify the covered entity and the PHI being requested.
• Determine whether the team or the requesting agency is legally authorized to receive that information for the stated purpose.
• Identify whether the disclosure is permitted, required by law, or instead needs an individual’s valid authorization or another HIPAA basis.

HIPAA’s public health provision permits certain disclosures; it does not, by itself, require them. A separate state or federal law may impose a reporting duty, so distinguish a legal mandate from a request that the covered entity may decline. HHS’s explanation of whether public health disclosures are required clarifies this distinction.

How to verify the team’s legal authority and applicable state rules

Before releasing records, review the state child fatality review statutes and any implementing regulations, orders, or official guidance that govern the team. Confirm who may request records, which entities must or may provide them, which types of information are covered, and whether the law limits use, redisclosure, or public release.

• Obtain the team’s statutory citation and written request.
• Verify the requesting person’s identity and role, and confirm the team’s authority for this specific review.
• Check whether the statute authorizes the team itself to receive information or requires the request to come through a designated agency.
• Review any confidentiality provisions, deadlines, and limits on use or redisclosure.
• Escalate unclear, unusually broad, or disputed requests to your privacy officer or legal counsel.

A statute that creates a review team does not necessarily authorize every requested disclosure of PHI. HIPAA permits disclosures required by law only to the extent the disclosure complies with and is limited to the relevant requirements of that law. HHS guidance on HIPAA and state reporting laws explains how state-law reporting requirements may interact with HIPAA.

Apply the minimum necessary standard to case information

For a disclosure that is permitted but not required by law, the minimum necessary standard generally requires the covered entity to make reasonable efforts to limit PHI to what is needed for the review’s stated purpose. A request for an entire medical record should not be treated as automatically justified; assess whether that scope is reasonably necessary.

• Match each requested data element to the team’s authorized review purpose.
• Consider whether a focused summary, selected records, or fewer identifiers would meet that purpose.
• Use established protocols for routine requests and individual review criteria for non-routine requests.
• If relying on the requester’s minimum-necessary determination, confirm that the requester is an eligible public official or agency and that reliance is reasonable in the circumstances.

The minimum necessary standard does not apply to disclosures required by law or disclosures made under a valid individual authorization, among other exceptions. When disclosure is required, follow the law’s scope and limits rather than treating the exception as permission to send unrelated records. HHS minimum necessary guidance describes the standard, exceptions, and reasonable reliance rules.

Document disclosures and distinguish permission from reporting duties

Record the request, the legal basis you identified, the information disclosed, the recipient, and the date and method of transmission. Keep any statute, written request, verification, authorization, or legal review associated with the decision, consistent with your organization’s policies and applicable retention requirements.

Documentation helps show why the disclosure was allowed and how its scope was determined. HIPAA also gives individuals a right to an accounting of certain disclosures, subject to exceptions; maintain the information needed for an accounting when the disclosure is one that must be included. 45 C.F.R. § 164.528 sets out the accounting requirements and related documentation.

Keep a clear distinction between:

• Required disclosures: A law compels disclosure, and the covered entity follows the law’s relevant requirements.
• Permitted disclosures: HIPAA allows disclosure for a qualifying purpose, but does not itself require the covered entity to provide the information.
• Disclosures requiring authorization or another basis: No applicable permission or legal duty has been established, so do not release the PHI until an appropriate basis is confirmed.

Protect confidentiality within the review team

Even when a disclosure is authorized, share information only with the people and for the purposes covered by that authority. Confirm the team’s rules for access, secure storage, use in meetings, redisclosure, and destruction or return of records. Apply role-based access and secure transmission procedures as appropriate.

Do not assume that every team member is a HIPAA covered entity or that a team confidentiality pledge alone creates a HIPAA disclosure permission. Verify the legal basis for the covered entity’s disclosure and any separate state-law protections that bind the team and its members.

Identifiable PHI about a deceased child remains protected by the HIPAA Privacy Rule for 50 years after death. A child’s death therefore does not, on its own, remove the need for a valid disclosure basis. HHS guidance on protections for deceased individuals’ health information explains the 50-year period.

Account for substance use treatment and school records

Records protected by 42 C.F.R. Part 2 require a separate review. Do not assume that a HIPAA public health permission or a state child fatality review statute automatically permits disclosure of Part 2 records. Check whether valid Part 2 consent or a specific Part 2 exception or court order applies to the proposed disclosure.

HHS’s 2024 Part 2 final rule had a compliance date of February 16, 2026. Confirm that current Part 2 requirements are followed, including any applicable restrictions on use or disclosure in legal proceedings. HHS’s Part 2 final rule fact sheet summarizes the rule and its compliance date.

School records may be governed by FERPA rather than HIPAA. A school generally needs consent to disclose personally identifiable information from education records unless a FERPA exception applies. Schools should identify the relevant exception, follow its conditions, and make any required disclosure record. The U.S. Department of Education’s FERPA resource provides the applicable regulations and guidance.

Prepare public reports using de-identified or redacted information

Before publishing a review report, determine whether each proposed detail may lawfully be made public. A disclosure to a review team does not automatically authorize public release of the same identifiable information. Check state confidentiality and public-records rules, as well as any restrictions attached to the information received.

When a report can serve its purpose without identifying the child or family, use information that meets HIPAA’s de-identification standard or remove identifying details under an appropriate legal and editorial review. HIPAA provides two de-identification methods: expert determination and Safe Harbor. Simply removing a name may not be enough if details such as a rare cause of death, precise dates, small location, or distinctive circumstances could identify the child.

For the standards and methods, see HHS guidance on de-identification of PHI. If the report remains identifiable, confirm a separate legal basis for its public release before publication.

Checklist takeaway: Verify the team’s authority under state law, identify the precise HIPAA permission or mandate, limit disclosures where the minimum necessary standard applies, document the decision, and separately protect Part 2, FERPA, and public-report information.

FAQs

Does HIPAA require a covered entity to disclose information to a child fatality review team?

Not by itself. HIPAA permits certain public health disclosures but does not generally require them. A separate state or federal law may require disclosure; if so, follow that law’s scope and requirements. HHS guidance distinguishes permission from a reporting duty.

Can a child fatality review team receive PHI without individual authorization?

Sometimes. Authorization may not be needed when the team or requesting authority is legally authorized to receive the information for a qualifying public health purpose, when disclosure is required by law, or when another HIPAA permission applies. A team’s title or general public purpose alone is not enough; verify the applicable legal authority and any added protections, including Part 2 rules.

What confidentiality rules apply to information shared with team members?

HIPAA governs the covered entity’s disclosure, while state statutes and other applicable laws may impose confidentiality, access, use, and redisclosure restrictions on the team and its members. Confirm who may see the information and how the team must protect it. Identifiable PHI about a deceased person generally remains protected under HIPAA for 50 years after death.

Can public reports include identifying medical information?

Only when an applicable legal basis permits the public release. A team’s authority to review a case does not automatically allow publication of identifiable medical details. Where possible, use properly de-identified information; if details remain identifiable, verify that disclosure is authorized under HIPAA and any relevant state confidentiality rules.