Uses and Disclosures of Protected Health Information
Permitted Without Authorization
A covered entity may use and disclose PHI for treatment, payment, and healthcare operations (TPO) without authorization. It may also disclose without authorization for specified public-interest purposes: required by law, public health activities, reporting abuse or neglect, health oversight, judicial and administrative proceedings, law enforcement under defined conditions, coroners and funeral directors, organ donation, research with proper approvals or a waiver, to avert a serious threat to health or safety, and for specialized government functions. Disclosures to the individual are permitted.
Conditions and Limits
Many permitted disclosures carry conditions-for example, law enforcement disclosures may require a warrant, court order, or specific criteria. Disclosures for marketing and sale of PHI require authorization. Fundraising communications must include an opt-out. Incidental disclosures that occur despite reasonable safeguards are not violations.
Traps Candidates Miss
- "Permitted" is not "mandatory" except where law requires disclosure.
- Minimum necessary applies to most non-TPO disclosures but not to treatment or disclosures to the individual.
- Research requires IRB or privacy board approval, representations, or a waiver-not merely good intent.
- Serious threat disclosures must be consistent with law and limited to those who can prevent harm.
Rule of Thumb
Before disclosing, classify the purpose: TPO, individual request, public interest, or other. If it is "other" (marketing, sale, most research without approval), an authorization is likely required.
Worked Example
A hospital receives a subpoena for records without a court order or patient authorization. The correct response is to follow the judicial proceedings requirements-such as satisfactory assurances or a qualified protective order-not to release records automatically.