HIPPA doesn’t apply to “public health emergencies”:
https://compliancy-group.com/disclosure-of-phi-to-a-public-health-authority/
“HIPPA doesn’t apply to ‘public health emergencies’”
HIPAA. In HR, I used to do HIPAA training, but never got into the emergencies exception.
Why was AIDS/HIV never considered a “public health emergency”?
What Proof of Authority Must a Requestor or a Public Health Authority Provide?
Requestors and public health authorities must be able to provide a statement of authority, and to verify their identity, before they can receive the requested PHI.
In most cases, the requestor or public health authority should be prepared to provide a written statement of its legal authority. However, in circumstances where it would be impractical to provide a written statement, a covered entity may rely, if it is reasonable to do so, on an oral statement of authority.
In addition, the requestor should be prepared to verify its identity by:
Presenting an agency identification badge, other official credentials, or other proof of government status if the request is made in person;
Making the request on the appropriate government letterhead if the request is made in writing; or
If the request is by a person acting on behalf of a public official, providing a written statement on appropriate government letterhead that the person is acting under the government authority.
Other evidence or documentation of agency (the authority to act as another’s agent) may include:
A copy of the contract for service; or
A copy of the relevant memorandum of understanding, or purchase order.
That establishes that the person is acting on behalf of the public official.
AS LONG AS THOSE REQUESTING provide the above, and the stipulations within. IOW, they can pound sand.