Skip to content
Use and Disclosure of PHICompliancy Group2020-10-19T14:02:27-04:00 Use and Disclosure of PHIThe HIPAA Privacy Rule regulates use and disclosure of PHI. Show
When Does the HIPAA Privacy Rule Require Use and Disclosure of PHI?Under the HIPAA Privacy Rule, a covered entity must disclose protected health information in only two situations: (a) to individuals (or their personal representatives) specifically when they request access to, or an accounting of disclosures of, their protected health information; and (b) to the Department of Health and Human Services (HHS) when it is undertaking a compliance investigation, review, or enforcement action. Under the HIPAA Privacy Rule, What Is Permitted Use and Disclosure of PHI?A covered entity is permitted, but not required, to use and disclose protected health information, without an individual’s authorization, for the following purposes or situations: To the Individual (unless required for access or accounting of disclosures):A covered entity may be permitted to disclose protected health information to the individual who is the subject of the information. Treatment, Payment, and Healthcare Operations:
Note that most uses and disclosures of psychotherapy notes for treatment, payment, and health care operations purposes require an authorization. Obtaining “consent” (written permission from individuals to use and disclose their protected health information for treatment, payment, and health care operations) is optional under the Privacy Rule for all covered entities. The content of a consent form, and the process for obtaining consent, are at the discretion of the covered entity electing to seek consent. Use and Disclosure of PHI to which an Individual Has an Opportunity to Agree or Object:Informal permission may be obtained by asking the individual outright, or by circumstances that clearly give the individual the opportunity to agree, acquiesce, or object. Where the individual is incapacitated, in an emergency situation, or not available, covered entities generally may use and disclose PHI, if in the exercise of their professional judgment, the use or disclosure is determined to be in the best interests of the individual. Uses or disclosures to which an individual has an opportunity to agree or object include:
Handling PHI?Make sure you’re HIPAA compliantwith our software!Uses or Disclosures Incident to an Otherwise Permitted Use or Disclosure:The Privacy Rule does not require that every risk of an incidental use or disclosure of protected health information be eliminated. A use or disclosure of this information that occurs as a result of, or as “incident to,” an otherwise permitted use or disclosure is permitted as long as the covered entity has adopted reasonable safeguards as required by the Privacy Rule, and the information being shared was limited to the “minimum necessary,” as required by the Privacy Rule. Public Interest and Benefit Activities:The Privacy Rule permits use and disclosure of protected health information, without an individual’s authorization or permission, for public interest purposes, and for benefit activity purposes. PHI may be disclosed:
HIPAA Compliance Software!Learn How Simple Compliance Can BeImportant HIPAA Deadline: December 31st, Required Assessment Due When can a covered entity disclose PHI without authorization?Under HIPAA, a covered entity provider can disclose PHI to another covered entity provider for the treatment activities of the recipient health care provider, without needing patient consent or authorization. (45 CFR 164.506(c)(2).)
Can PHI be disclosed without permission?Notifying Media and the Public
Health care providers should obtain a written HIPAA authorization from the patient or the patient's legally authorized representative before disclosing specific, detailed PHI to the media or the public.
For which of the following reasons may a covered entity disclose PHI without the patient's written authorization?A covered entity is permitted, but not required, to use and disclose protected health information, without an individual's authorization, for the following purposes or situations: (1) To the Individual (unless required for access or accounting of disclosures); (2) Treatment, Payment, and Health Care Operations; (3) ...
Can PHI be disclosed without authorization for public health reasons?General Public Health Activities.
The Privacy Rule permits covered entities to disclose protected health information, without authorization, to public health authorities who are legally authorized to receive such reports for the purpose of preventing or controlling disease, injury, or disability.
|