All States and U.S. Territories (referred to as "States" collectively) have laws that define what constitutes child abuse and neglect and procedures in place for individuals to report suspected cases of child abuse and neglect. All States also have laws that require "mandatory reporters" to report cases of suspected child abuse or neglect. In every State, health care providers are mandatory reporters.

In some States, statutory rape and/or illegal sexual contact with a minor, in addition to being a crime, may also be considered a form of child abuse or neglect. If statutory rape or illegal sexual contact with a minor is considered child abuse or neglect in a State, mandatory reporters must report it to the appropriate authorities just as they would other forms of suspected abuse or neglect.

We have become aware that Federal privacy rules are being cited as the rationale for mandatory reporters not to follow State laws regarding reporting child abuse and neglect. Nothing in the Federal privacy rules or law prohibits mandatory reporters from reporting child abuse and neglect to the appropriate authorities. In fact, the Federal privacy law explicitly allows reporting of child abuse and neglect consistent with State law as an exception to general rules requiring the confidentiality of health records.

We cite here laws which require the confidentiality of health information, but which also contain specific exceptions for complying with State child abuse and neglect reporting laws:

HIPAA. The Privacy Rule, at 45 CFR Part 160 and Part 164 Subparts A and E, protects individually identifiable health information in accordance with a statutory mandate in Title II, Subtitle F-Administrative Simplification of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), Public Law 104-191. The HIPAA Privacy Rule allows covered entities to disclose protected health information to report known or suspected child abuse or neglect, if the report is made to a public health authority or other appropriate government authority that is authorized by law to receive such reports. See 42 USC 1320d-7(b) and 45 CFR 164.512(b)(1)(ii).

Title X of the Public Health Service Act. Title X family planning grantees are required to keep client information confidential, although program regulations provide an exception to this rule in cases in which disclosure is required by law - this exception allows grantees to comply with State laws requiring the reporting of child abuse and neglect. In addition, each year since 1999, appropriations language for the Title X program clarifies the responsibility of health care providers to report child abuse and neglect by stating that: "Notwithstanding any other provision of law, no provider of services under Title X of the Public Health Service Act shall be exempt from any State law requiring notification or the reporting of child abuse, child molestation, sexual abuse, rape, or incest." The Consolidated Appropriations Act of 2005 (Public Law 108-447), Division F, Title II, section 212. See also 42 USC 300, et seq. and 42 CFR 59.11.

Alcohol and Drug Abuse Patient Records. Federal grantees that serve alcohol and drug abuse patients are also required by Federal law to maintain confidentiality. The law and regulations make exceptions to those confidentiality rules in order for grantee programs to comply with State laws to report child abuse and neglect. See 42 USC 290dd-2 and 42 CFR 212(c)(6). However, the restrictions on disclosure continue to apply to the original alcohol or drug abuse patient records. We encourage State child welfare and/or child protective services agencies to work with their State Attorney General and notify all mandatory reporters of their obligation under State and Federal law to report child abuse and neglect. We ask that the Federal agencies that oversee various health care programs transmit this memorandum to their respective grantees who may be mandatory reporters.