Does HIPAA require covered entities to obtain written authorization from the individual before reporting protected health information to CPDR?

No. The provision of the Privacy Rule authorizing disclosure of protected health information as required
by law is an exception to the requirement for written authorization. See 45 CFR sec. 164.512(a)(1).