Protected health information – Ohio Rev. Code Ann. § 3701.17

Protected health information is defined as information in any form that describes an individual’s past, present, or future physical or mental health status or condition, receipt of treatment or care, or purchase of health products if the information reveals or could be used to reveal the identity of the individual.  Protected health information in the possession of the director of health, the department of health, or a board of health, is confidential and may only be released in the following circumstances: 

• With the written consent of the individual;
• The release of information is necessary to either provide treatment to the individual or to ensure the accuracy of the information, and the release is pursuant to a written agreement that requires the recipient of the information to comply with confidentiality requirements;
• The information is released in response to a search warrant or subpoena issued by a grand jury or at the request of a prosecutor in connection with a criminal investigation or prosecution; or
• The director of health determines that the release of information is necessary to avert or mitigate a clear threat to an individual or to the public health.  Information may only be released to those persons or entities necessary to control, prevent or mitigate the disease.

Information that does not identify an individual is not protected health information and may be released in summary, statistical, or aggregate form; such information is a public record and will be released by the director upon request.  

Unless protected health information is properly released by the director for public health purposes, every permissible disclosure must be in writing and accompanied by a written statement that includes the following or substantially similar language: “This information has been disclosed to you from confidential records protected from disclosure by state law.  If this information has been released to you in other than a summary, statistical or aggregate form, you shall make no further disclosure of this information without the specific, written, and informed released of the individual to whom it pertains, or as otherwise permitted by state law.  A general authorization for the release of medical or other information is not sufficient for the release of information pursuant to this section.”