Use and Disclosure of PHI

Back Next

Permitted Uses and Disclosures

The HIPAA Privacy Rule limits when and how PHI may be used and disclosed.

• PHI is "used" when internally accessed, shared, examined, or analyzed.

• PHI is "disclosed" when released, transfered, or access given to another entity.

For treatment, payment, or healthcare operations, (TPO) PHI may be used and disclosed without the individual's permission. Healthcare operations include a wide range of activities, including, for example, conducting quality assessment and improvement activities, reviewing the competence of healthcare professionals, conducting training programs, conducting or arranging for medical review or legal services, business planning and development and business management and administrative activities.

In addition to uses and disclosures related to treatment, payment or healthcare operations, under certain circumstances agencies are permitted to use or disclose PHI without the patient's written authorization in the following circumstances:

• Uses and disclosures required by law

• Uses and disclosures for public health activities

• Disclosures about victims of abuse, neglect or domestic violence

• Uses and disclosures for health oversight

• Disclosures for judicial and administrative proceedings

• Disclosures for law enforcement purposes

• Uses and disclosures about decedents

• Uses and disclosures for cadaveric organ, eye or tissue donation purposes

• Uses and disclosures for research purposes

• Uses and disclosures to avert a serious threat to health and safety

• Uses and disclosures for specialized government activities

• Disclosure for workers' compensation

In addition, while agencies are not required to obtain the patient's written authorization first, they are required to give the individual the opportunity to object to the following types of disclosures:

• Uses and disclosures for facility directories

• Uses and disclosures to family member and other individuals involved in the patients care or payment for that care

Before PHI is used or disclosed for any other purpose, written authorization must be obtained from the patient.