Jonathan Porter welcomes colleague Claire Postman to discuss how healthcare providers approach HIPAA when responding to civil investigative demands in False Claims Act investigations. Jonathan explains that providers often feel tension between meeting the requirements of a CID and complying with HIPAA. Claire begins by outlining HIPAA’s general prohibition on disclosing protected health information and describes the exceptions that allow disclosures in specific circumstances. She explains that HIPAA permits disclosures when required by law, including mandated reporting in situations such as abuse or neglect, and in response to court orders, grand jury subpoenas, and civil investigative demands. Claire also notes that disclosures must match the scope of the request and that de-identification may sometimes be appropriate.