In what circumstances must an individual be given the opportunity to agree or object to the use and disclosure of their PHI?

A Covered Entity may use or disclose Protected Health Information, provided that the individual is informed in advance of the use or disclosure and has the opportunity to agree to or prohibit or restrict the use or disclosure, in accordance with the applicable requirements of this section. The Covered Entity may orally inform the individual of and obtain the individual's oral agreement or objection to a use or disclosure permitted by this section.

(a) Standard: Use and disclosure for facility directories.

For the sake of brevity we assume that facilities (fairly or unfairly) understand these requirements.

(b) Standard: Uses and disclosures for involvement in the individual's care and notification purposes.

(1) Permitted uses and disclosures. In general, if the individual (read patient) identifies a family member, other relative or close personal friend, or any other person, then the Covered Entity can disclose Protected Health Information relevant to that person's involvement. A Covered Entity may also disclose Protected Health Information for notification purposes as long as other rules within this section are met.

(2) Uses and disclosures with the individual present. In general, if the individual is present then a Covered Entity must obtain agreement to use or disclose PHI, or reasonably infer such agreement.

(3) Limited uses and disclosures when the individual is not present. In general, if the individual is not present, is incapacitated, or emergency circumstances apply, then the Covered Entity may exercise professional judgment whether disclosure of Protected Health Information is in the best interest of the individual and then disclose only such Protected Health Information that is directly relevant to a person's involvement with the individual.

(4) Use and disclosure for disaster relief. In general, disclosure of Protected Health Information is valid as long as the other requirements of this section are met and the organization to which Protected Health Information is disclosed is authorized by law or charter.

§ 164.512 Uses and disclosures for which an authorization or opportunity to agree or object is not required

Introductory Comment: This section goes on for approximately 10 pages. Parts of this section require the individual to be informed. Where it does so oral communication suffices. We simply list the applicable standards without further comments.

(a) Standard: Uses and disclosures required by law.

(b) Standard: Uses and disclosures for public health activitites.

(d) Standard: Uses and disclosures for health oversight activities.

(e) Standard: Disclosures for judicial and administrative proceedings.

(f) Standard: Disclosures for law enforcement purposes.

(g) Standard: Uses and disclosures about decedents.

(h) Standard: Uses and disclosures for cadaveric organ, eye or tissue donation purposes.

(i) Standard: Uses and disclosures for research purposes.

(j) Standard: Uses and disclosures to avert a serious threat to health or safety.

(k) Standard: Uses and disclosures for specialized government functions.

(l) Standard: Disclosures for workers' compensation.

Detailed requirements must still be met despite the fact that the individual need not agree to the use or disclosure. Even a single one of these standards may go on for a page or more. Our best suggestion is to be aware of these standards and read those that may be applicable at the appropriate time, and/or seek advice of counsel.

§ 164.514 Other requirements relating to uses and disclosures of protected health information

This section deals with the use and disclosure of Protected Health Information for the purposes of de-identification, fund raising, underwriting, etc. Unless you are involved in these activities then this section is of little concern to you. We (mercifully) skip these standards altogether. Also, for reasons unknown to mere mortals, the next section is §164.520 (i.e. the regulatory text itself "skips" from §164.514 to §164.520).

Make sure you are Omnibus Rule Compliant: HIPAA Privacy Checklist.

UW HCC staff may disclose a patient’s protected health information to:
1. A family member, other relative, or a close personal friend of the patient or any other person identified by the patient, the protected health information directly relevant to such person’s involvement with the patient’s care or payment related to the patient’s health care.
2. Notify, or assist in the notification of (including identifying or locating), a family member, a personal representative of the patient, or another person responsible for the care of the patient of the patient’s location, general condition, or death.
The disclosure described above may be made only in accordance with the following procedures:
1. If the patient is present for, or otherwise available prior to, such disclosure and has the capacity to make health care decisions, UW HCC staff may disclose the protected health information if they:
  1. Obtain the patient’s agreement;
  2. Provide the patient with the opportunity to object to the disclosure and the individual does not express an objection; or
  3. Reasonably infer from the circumstances, based on the exercise of professional judgment, that the patient does not object to the disclosure.
  It is expected that in most circumstances, UW HCC staff will be able to disclose protected health information to those involved in the care of the patient and/or for notification purposes based on options ii or iii above. For example, if the patient allows a family member or friend to be present during treatment, it is reasonable to infer that the patient would not object to disclosures of most types of protected health information to the family member or friend.
  
  However, if UW HCC staff is aware of circumstances (e.g., “sensitive” diagnoses, dysfunctional family dynamics, etc.) that might result in the patient objecting to such disclosure, staff should obtain the patient’s agreement and document such agreement in the medical record before proceeding with the disclosure.
2. If the patient is not present, or the opportunity to agree or object to the disclosure cannot practicably be provided because of the patient’s incapacity or an emergency circumstance, UW HCC staff, in the exercise of professional judgment, may determine whether the disclosure is in the best interests of the patient. If so, UW HCC staff may disclose only the protected health information that is directly relevant to the person’s involvement with the individual’s care or payment related to the individual’s health care or needed for notification purposes. Unless circumstances dictate otherwise, it is generally in the patient’s best interest to disclose relevant protected health information to those present, accompanying the patient, or otherwise involved in the patient’s care.

UW HCC staff may use or disclose protected health information to a public or private organization authorized by law or its charter to assist in disaster relief efforts, for the purpose of coordinating with such entities for the notification of, or to assist in the notification of (including identifying or locating), a family member, a personal representative of the patient, or another person responsible for the care of the patient of the patient’s location, general condition, or death, as follows:

If the patient is present for, or otherwise available prior to, such use or disclosure and has the capacity to make health care decisions, UW HCC staff may use or disclose the protected health information as described above if they:
1. Obtain the patient’s agreement;
2. Provide the patient with the opportunity to object to the use or disclosure and the individual does not express an objection; or
3. Reasonably infer from the circumstances, based on the exercise of professional judgment, that the patient does not object to the use or disclosure.
It is expected that in most circumstances, when the patient is present, UW HCC staff will be able to disclose protected health information to disaster relief agencies for notification purposes, based on options B or C above.

However, if UW HCC staff are aware of circumstances that might result in the patient objecting to such disclosure, staff should obtain the patient’s agreement and document such agreement in the medical record before proceeding with the disclosure.
If the patient is not present, or the opportunity to agree or object to the use or disclosure cannot practicably be provided because of the patient’s incapacity or an emergency circumstance, UW HCC staff, in the exercise of professional judgment, may determine whether the use or disclosure is in the best interests of the patient. If so, UW HCC staff may disclose only the protected health information that is directly relevant to the person’s involvement with the patient’s health care. Unless circumstances suggest otherwise, it is generally in the patient’s best interest to disclose relevant protected health information for notification purposes to disaster relief agencies.

If the individual is deceased, UW HCC staff may disclose to a family member or another person as described in I.1.A above (who were involved in the individual’s care or payment for health care prior to death), protected health information that is relevant to such person’s involvement unless doing so is inconsistent with any prior expressed preference of the individual that is known to the covered entity.

The minimum necessary standard applies to disclosures made under this policy. See UW-109 Minimum Necessary Standard.