Permitted use and disclosure of protected health information (PHI) under HIPAA

The U.S. Department of Health and Human Services (HHS) enacted HIPAA to protect patient privacy and set security requirements for healthcare covered entities (CEs). The federal regulation defines how, when, and why it is appropriate to safely and securely share PHI and what is shareable. Over 20 years later, healthcare organizations still have questions about permissible PHI use and disclosure without patient authorization. To provide further guidance, HHS, the Office of the National Coordinator for Health Information, and the Office for Civil Rights collaborated on two fact sheets that explore this issue. Here is a basic summary of both fact sheets.

Use and disclosure for healthcare operations

• quality assessments for patient safety or general health/healthcare costs
• in support of compliance
• the development of clinical guidelines and protocols
• the review and evaluation of healthcare providers
• employee training
• the detection of fraud

Such use and disclosures must reinforce or improve a CE’s core functions and help to improve patient care quality.

Use and disclosure for patient treatment

PHI can also be used and disclosed for patient treatment, broadly defined as the “provision, coordination, or management of healthcare and related services” by a CE or more than one CE. PHI is shareable between CEs or within a CE in order to help the organization(s) provide strong patient care.

Examples include:

• a doctor providing PHI to a nutritionist for approved patient treatment
• a CE hiring a care planning business associate who requests access
• a hospital discharging a patient into a care facility

Such a consultation or referral, when required, may occur without direct patient authorization.

Be aware and be knowledgeable

1. The disclosing and receiving CE must have a relationship (past or present) with the patient
2. The disclosed PHI must pertain to the relationship
3. The discloser must still adhere to the privacy rule’s minimum necessary requirement and limit datasets (i.e. remove unnecessary PII)
4. A patient must have an opportunity to agree or object.

Finally, a CE must make available to all patients a notice about its organization and PHI. Health providers should pose further questions to HHS on its website or by communicating with a representative. Be aware and be knowledgeable about HIPAA, general privacy regulations, and patient authorization.

RELATED: HIPAA Compliant Email Combining familiarity with HIPAA regulations, implementing the right policies and technical solutions can only help your organization provide necessary patient privacy with solid patient care.