· When the disclosure is required by law.3 A covered health care provider may disclose PHI when the disclosure is required by law (e.g., statute, regulation, court order, subpoena) and the disclosure complies with and is limited to the relevant requirements of such law.4.