HIPAA allows the release of certain, limited data fields for very narrow purposes: public health activity and research activity. The CO APCD DRRC reviews every request for CO APCD data reports to ensure that no information is released that goes beyond HIPAA rules.