Developments in information technology that make it possible to rapidly transmit health information also raise questions about the possible inappropriate use and protection of identifiable (or potentially identifiable) personal health information. Despite efforts to improve state laws, adoption of provisions has lagged. We found that half of states have no statutes addressing nondisclosure of personally identifiable health information generally held by public health agencies. Exceptional treatment of HIV, sexually transmitted infections, or tuberculosis-related information was common. Where other provisions were found, there was little consistency in the laws across states. The variation in state laws supports the need to build consensus on the appropriate use and disclosure of public health information among public health practitioners.