7. CPH Domain 4: HIPAA, Public Health Authority, and COI
After this lesson you can
- Explain why HIPAA permits disclosure to a public health authority without patient authorization
- Tell privacy, confidentiality and security apart and name the Security Rule's three safeguards
- Describe police power, federalism, preemption and the scope of a health department's legal authority
- Choose between the Belmont Report and the APHA Code based on whether a stem describes research or practice and policy
- Identify potential, perceived and actual conflicts of interest and manage them through disclosure and recusal
- Trace IHR notification from county to state to the national focal point and WHO within 24 hours of assessment
Video coming soon
Scheduled for release on November 22, 2026.
A single lesson covering all seven task statements of Domain 4, Law and Ethics, which carries 8 percent of the exam. It covers HIPAA, 42 CFR Part 2, FERPA and state reporting law, the legal authority of public health, ethical analysis with the Belmont Report and the APHA Code, conflicts of interest, the International Health Regulations and assessing the health impacts of laws.
Questions and answers
Questions a learner would ask about this lesson. Think through your own answer before you open each one.
- Does HIPAA stop a hospital from reporting cases to the health department?
Show answer
No. The lesson calls "HIPAA prevents reporting" a trap that is always wrong. Under 45 CFR 164.512(b), a covered entity may disclose protected health information to a public health authority authorized by law to receive it, for preventing or controlling disease, injury or disability, with no patient authorization. HIPAA permits the disclosure, and state law requires the reporting.
- How much of the exam is Domain 4?
Show answer
Domain 4, Law and Ethics, carries 8 percent of the exam, about 14 of the 175 scored items. It has seven task statements, and this one lesson covers all of them. Expect HIPAA, ethics principle, conflict of interest and IHR items in recall and short-scenario style.
- Where does a state's power to protect public health come from?
Show answer
It comes from police power, the inherent authority of a state to protect health, safety, welfare and morals, reserved to the states by the Tenth Amendment. The lesson cites Jacobson v. Massachusetts, 1905, which upheld compulsory vaccination. Police power is limited by constitutional rights, and local authority is delegated by state statute or charter.
- When should I use the Belmont Report and when the APHA Code of Ethics?
Show answer
Belmont, from 1979, is written for research with human subjects and centers on the individual participant and informed consent. The APHA Public Health Code of Ethics, from 2019, is written for practice and policy and centers on the community, engagement and self-determination. Read the verb in the stem: a study points to Belmont, while a program or ordinance points to the APHA Code.
- Does a perceived conflict of interest still need to be managed?
Show answer
Yes. A perceived conflict exists when a reasonable observer would question the judgment, even if no judgment was actually influenced, and it still requires management. Management does not depend on intent or on proving influence. The person discloses in writing, an independent reviewer decides, and the conflict is managed through recusal, reassignment, oversight or divestiture, with the decision documented in the minutes.
Practice quiz
- Question 1Which term names the holder's duty not to disclose information?
- Question 2A hospital receives a request for case data from a public health authority. Under the minimum necessary standard, the hospital:
- Question 3How does 42 CFR Part 2 differ from HIPAA for substance use disorder records?
- Question 4A confirmed breach affects 650 residents of one state. Under the breach concepts in the lesson, the entity must notify:
- Question 5Where does a local health department's authority come from?
- Question 6A state law sets a minimum smoke-free standard and allows cities to adopt stronger rules. This is:
- Question 7In the Belmont Report, the principle of justice becomes which application?
- Question 8A board member sits on a vendor's advisory panel while the board weighs that vendor's contract. Nobody suspects that the member's judgment has been influenced. What should happen?
- Question 9A county identifies an event that may be a public health emergency of international concern. How does the notification reach WHO?
- Question 10A team codes a state law across places and years and compares health outcomes before and after it took effect. This is:
Saved in your browser only: no account, no server.
CPH Exam Pathway is an independent course produced by Subthesis for educational purposes. It is not affiliated with or endorsed by the National Board of Public Health Examiners (NBPHE), and completing it does not confer certification. Confirm fees, eligibility, and exam rules against the current NBPHE candidate handbook.