The Privacy Rule expressly permits protected health information (PHI) to be shared for specified public health purposes. For example, covered entities may disclose PHI, without individual authorization, to a public health authority legally authorized to collect or receive the information for the purpose of preventing or controlling disease, injury, or disability.
Due to the requirements of our IND protocols and our need to collect safety and surveillance data, CDC may need to obtain and store information from the patient’s record, including patient identifiers. Hard copies of patient records will be stored in locked, secure storage areas in the CDC Drug Service.
