Question - What exception does required reporting fall under in the HIPAA Privacy regulations? Does the fact that a facility reports personally identifiable information about a patient through the required reporting process need to be included in the notice of privacy practices? Do required reporting disclosures have to be included in the accounting of disclosures? If so, what are the options to do so? If not, what law or regulation provides this exception?