HIPAA Privacy Regulations: Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object is Not Required: General Rule - § 164.512
As Contained in the HHS HIPAA Privacy Rules
|
HHS Regulations as Amended August 2002 |
A covered entity may use or disclose protected health information without the written authorization of the individual, as described in § 164.508, or the opportunity for the individual to agree or object as described in § 164.510, in the situations covered by this section, subject to the applicable requirements of this section. When the covered entity is required by this section to inform the individual of, or when the individual may agree to, a use or disclosure permitted by this section, the covered entity's information and individual's agreement may be given orally.
| HHS Description from Original Rulemaking Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object is Not Required: General Rule |
The final rule's requirements regarding disclosures for directory information and to family members or others involved in an individual's care are in a section separate from that covering disclosures allowed for other national priority purposes. In the final rule, we place most of the other disclosures for national priority purposes in a new Sec. 164.512.
As in the NPRM, in Sec. 164.512 of the final rule, we allow covered entities to make these national priority uses and disclosures without individual authorization. As in the NPRM, these uses and disclosures are discretionary. Covered entities are free to decide whether or not to use or disclose protected health information for any or all of the permitted categories. However, as in the NPRM, nothing in the final rule provides authority for a covered entity to restrict or refuse to make a use or disclosure mandated by other law.
The new Sec. 164.512 includes paragraphs on: Uses and disclosures required by law; uses and disclosures for public health activities; disclosures about victims of abuse, neglect, or domestic violence; uses and disclosures for health oversight activities; disclosures for judicial and administrative proceedings; disclosures for law enforcement purposes; uses and disclosures about decedents; uses and disclosures for cadaveric donation of organs, eyes, or tissues; uses and disclosures for research purposes; uses and disclosures to avert a serious threat to health or safety (which we had called `”emergency circumstances” in the NPRM); uses and disclosures for specialized government functions (referred to as “specialized classes” in the NPRM); and disclosures to comply with workers' compensation laws.
Section 164.512(c) in the final rule, which addresses uses and disclosures regarding adult victims of abuse, neglect and domestic violence, is new, although it incorporates some provisions from proposed Sec. 164.510 of the NPRM. In the final rule we also eliminate proposed Sec. 164.510(g) on government health data systems and proposed Sec. 164.510(i) on banking and payment processes. These changes are discussed below.
Approach to Use of Protected Health Information
Proposed Sec. 164.510 of the NPRM included specific subparagraphs addressing uses of protected health information by covered entities that were also public health agencies, health oversight agencies, government entities conducting judicial or administrative proceedings, or government heath data systems. Such covered entities could use protected health information in all instances for which they could disclose the information for these purposes. In the final rule, as discussed below, we retain this language in the paragraphs on public health activities and health oversight. However, we eliminate this clause with respect to uses of protected health information for judicial and administrative proceedings, because we no longer believe that there would be any situations in which a covered entity would also be a judicial or administrative tribunal. Proposed Sec. 164.510(e) of the NPRM, regarding disclosure of protected health information to coroners, did not include such a provision. In the final rule we have added it because we believe there are situations in which a covered entity, for example, a public hospital conducting post-mortem investigations, may need to use protected health information for the same purposes for which it would have disclosed the information to a coroner.
While the right to request restrictions under Sec. 164.522 and the consents required under Sec. 164.506 do not apply to the use and disclosure of protected health information under Sec. 164.512, we do not intend to preempt any state or other restrictions, or any right to enforce such agreements or consents under other law.
We note that a covered entity may use or disclose protected health information as permitted by and in accordance with one of the paragraphs of Sec. 164.512, regardless of whether that use or disclosure fails to meet the requirements for use or disclosure under a different paragraph in Sec. 164.512 or elsewhere in the rule.
Verification for Disclosures Under Sec. 164.512
In Sec. 164.510(a) of the NPRM, we proposed that covered entities verify the identity and authority of persons to whom they made disclosure under the section. In the final rule, we generally have retained the proposed requirements. Verification requirements are discussed in Sec. 164.514 of the final rule.