§ 164.510 Uses and disclosures requiring an opportunity for the individual to agree or to object
A Covered Entity may use or disclose Protected Health Information, provided that the individual is informed in advance of the use or disclosure and has the opportunity to agree to or prohibit or restrict the use or disclosure, in accordance with the applicable requirements of this section. The Covered Entity may orally inform the individual of and obtain the individual's oral agreement or objection to a use or disclosure permitted by this section.
(a) Standard: Use and disclosure for facility directories.
HIPAA Survival Guide Note
For the sake of brevity we assume that facilities (fairly or unfairly) understand these requirements.
(b) Standard: Uses and disclosures for involvement in the individual's care and notification purposes.
(1) Permitted uses and disclosures. In general, if the individual (read patient) identifies a family member, other relative or close personal friend, or any other person, then the Covered Entity can disclose Protected Health Information relevant to that person's involvement. A Covered Entity may also disclose Protected Health Information for notification purposes as long as other rules within this section are met.
(2) Uses and disclosures with the individual present. In general, if the individual is present then a Covered Entity must obtain agreement to use or disclose PHI, or reasonably infer such agreement.
(3) Limited uses and disclosures when the individual is not present. In general, if the individual is not present, is incapacitated, or emergency circumstances apply, then the Covered Entity may exercise professional judgment whether disclosure of Protected Health Information is in the best interest of the individual and then disclose only such Protected Health Information that is directly relevant to a person's involvement with the individual.
(4) Use and disclosure for disaster relief. In general, disclosure of Protected Health Information is valid as long as the other requirements of this section are met and the organization to which Protected Health Information is disclosed is authorized by law or charter.
§ 164.512 Uses and disclosures for which an authorization or opportunity to agree or object is not required
Introductory Comment: This section goes on for approximately 10 pages. Parts of this section require the individual to be informed. Where it does so oral communication suffices. We simply list the applicable standards without further comments.
(a) Standard: Uses and disclosures required by law.
(b) Standard: Uses and disclosures for public health activitites.
(c) Standard: Disclosures about victims of abuse, neglect or domestic violence.
(d) Standard: Uses and disclosures for health oversight activities.
(e) Standard: Disclosures for judicial and administrative proceedings.
(f) Standard: Disclosures for law enforcement purposes.
(g) Standard: Uses and disclosures about decedents.
(h) Standard: Uses and disclosures for cadaveric organ, eye or tissue donation purposes.
(i) Standard: Uses and disclosures for research purposes.
(j) Standard: Uses and disclosures to avert a serious threat to health or safety.
(k) Standard: Uses and disclosures for specialized government functions.
(l) Standard: Disclosures for workers' compensation.
HIPAA Survival Guide Note
Detailed requirements must still be met despite the fact that the individual need not agree to the use or disclosure. Even a single one of these standards may go on for a page or more. Our best suggestion is to be aware of these standards and read those that may be applicable at the appropriate time, and/or seek advice of counsel.
§ 164.514 Other requirements relating to uses and disclosures of protected health information
HIPAA Survival Guide Note
This section deals with the use and disclosure of Protected Health Information for the purposes of de-identification, fund raising, underwriting, etc. Unless you are involved in these activities then this section is of little concern to you. We (mercifully) skip these standards altogether. Also, for reasons unknown to mere mortals, the next section is §164.520 (i.e. the regulatory text itself "skips" from §164.514 to §164.520).
Make sure you are Omnibus Rule Compliant: HIPAA Privacy Checklist.