HIPAA allows the release of certain, limited data fields for very narrow purposes: public health activity, health care operations, and research activity. The DRRC reviews every request for CO APCD data reports to ensure that no information is released that goes beyond HIPAA rules and CIVHC denies any request for data or reports that would violate HIPAA or state law and rule.