The US Department of Health and Human Services (HHS) issued a Notification of Enforcement Discretion to address the disclosure of protected health information (PHI) to public health authorities and the utilisation of PHI to conduct analytics for such authorities. The notification announces that the HHS will not impose penalties for violations of the privacy rules, issued under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), against healthcare providers for using and disclosing PHI for public health and health oversight activities related to the COVID-19 pandemic. The notification explains that some actors have been unable to co-operate in a timely manner in sharing PHI with federal public health authorities and health oversight agencies, state and local health departments, and state emergency operations centres due to existing HIPAA Privacy Rules. The enforcement discretion enables the facilitation of uses and disclosures of PHI for the purpose of ensuring the public health and safety during the COVID-19 outbreak.