How do privacy laws like HIPAA affect cross-jurisdictional sharing of surveillance data?

• A. HIPAA prohibits any cross-jurisdiction data sharing under all circumstances.
• B. HIPAA allows unrestricted sharing as long as it's for public health.
• C. They require minimum necessary data, secure transmission, and proper authorizations; sharing across jurisdictions may require data use agreements and governance.
• D. Cross-jurisdiction sharing requires no governance.

Answer: (C)

Privacy protections under HIPAA govern how protected health information can be shared, especially when data cross jurisdictional boundaries. HIPAA requires that disclosures be limited to the minimum necessary to achieve the purpose, that the data be transmitted securely (with strong access controls and encryption where appropriate), and that disclosures are supported by valid authorizations or permitted under specific public health or clinical oversight provisions. When information moves across jurisdictions, these safeguards often strengthen through data use agreements and governance frameworks that spell out who can access the data, for what purposes, how the data will be protected, retention and breach-notification requirements, and oversight mechanisms. There are legitimate carve-outs for public health activities where disclosures to health authorities are allowed without individual authorization, but even then the data must be handled with safeguards and, when feasible, de-identification is used to reduce risk. So, the best description is that cross-jurisdiction sharing involves adhering to minimum-necessary disclosures, secure transmission, proper authorizations, and governance through data use agreements.