Skip to content
Use and Disclosure of PHICompliancy Group2020-10-19T14:02:27-04:00 Use and Disclosure of PHIThe HIPAA Privacy Rule regulates use and disclosure of PHI. Show
When Does the HIPAA Privacy Rule Require Use and Disclosure of PHI?Under the HIPAA Privacy Rule, a covered entity must disclose protected health information in only two situations: (a) to individuals (or their personal representatives) specifically when they request access to, or an accounting of disclosures of, their protected health information; and (b) to the Department of Health and Human Services (HHS) when it is undertaking a compliance investigation, review, or enforcement action. Under the HIPAA Privacy Rule, What Is Permitted Use and Disclosure of PHI?A covered entity is permitted, but not required, to use and disclose protected health information, without an individual’s authorization, for the following purposes or situations: To the Individual (unless required for access or accounting of disclosures):A covered entity may be permitted to disclose protected health information to the individual who is the subject of the information. Treatment, Payment, and Healthcare Operations:
Note that most uses and disclosures of psychotherapy notes for treatment, payment, and health care operations purposes require an authorization. Obtaining “consent” (written permission from individuals to use and disclose their protected health information for treatment, payment, and health care operations) is optional under the Privacy Rule for all covered entities. The content of a consent form, and the process for obtaining consent, are at the discretion of the covered entity electing to seek consent. Use and Disclosure of PHI to which an Individual Has an Opportunity to Agree or Object:Informal permission may be obtained by asking the individual outright, or by circumstances that clearly give the individual the opportunity to agree, acquiesce, or object. Where the individual is incapacitated, in an emergency situation, or not available, covered entities generally may use and disclose PHI, if in the exercise of their professional judgment, the use or disclosure is determined to be in the best interests of the individual. Uses or disclosures to which an individual has an opportunity to agree or object include:
Handling PHI?Make sure you’re HIPAA compliantwith our software!Uses or Disclosures Incident to an Otherwise Permitted Use or Disclosure:The Privacy Rule does not require that every risk of an incidental use or disclosure of protected health information be eliminated. A use or disclosure of this information that occurs as a result of, or as “incident to,” an otherwise permitted use or disclosure is permitted as long as the covered entity has adopted reasonable safeguards as required by the Privacy Rule, and the information being shared was limited to the “minimum necessary,” as required by the Privacy Rule. Public Interest and Benefit Activities:The Privacy Rule permits use and disclosure of protected health information, without an individual’s authorization or permission, for public interest purposes, and for benefit activity purposes. PHI may be disclosed:
HIPAA Compliance Software!Learn How Simple Compliance Can BeImportant HIPAA Deadline: December 31st, Required Assessment Due What provides the patient the right to agree or object?The HIPAA Privacy Rule requires that patients be provided with an opportunity to agree or object to certain uses or disclosures of their protected health information and, if the patient objects, the use or disclosure may not be made.
When must an individual be given the opportunity to agree or object to the use and disclosure of their PHI?A covered entity is required to agree to an individual's request to restrict the disclosure of their PHI to a health plan when both of the following conditions are met: (1) the disclosure is for payment or health care operations and is not otherwise required by law; and (2) the PHI pertains solely to a health care item ...
Which situation would require a written authorization from a patient to disclose the PHI?Authorization. A covered entity must obtain the individual's written authorization for any use or disclosure of protected health information that is not for treatment, payment or health care operations or otherwise permitted or required by the Privacy Rule.
Which of the following is an exception of a breach under HIPAA?The first exception to a breach is when an employee unintentionally acquires, accesses, or uses protected health information (PHI) in good faith within the scope of their authority, and they do not further disclose the PHI in a manner not permitted by the rule.
|