Question 1: What exception does required reporting fall under in the HIPAA Privacy regulations?
Question 2: Does the fact that a facility reports personally identifiable information about a patient through the required reporting process need to be included in the notice of privacy practices?