Compliance with Uses and Disclosures of PHI
Permitted uses and disclosures
The Privacy Rule permits use and disclosure for treatment, payment, and health care operations (TPO), and for public-policy purposes such as public health reporting, abuse/neglect reporting, law enforcement with legal process, organ donation, judicial and administrative proceedings, and research with IRB waiver or authorization. Everything else requires a valid authorization.
Minimum necessary
Minimum necessary applies to most non-treatment uses and disclosures. It does not apply to disclosures for treatment, to the individual, pursuant to a valid authorization, to HHS for compliance, or when required by law. Role-based access is the operational control that supports it.
Authorization elements
Core elements: description of the PHI, who may disclose, who may receive, purpose, expiration (date or event), signature and date, statement of the right to revoke, and statement about potential re-disclosure. Psychotherapy notes require a separate, specific authorization and cannot be combined with other authorizations. Compound authorizations are allowed for research under conditions.
Patient rights and breach
Right of access: 30 days with one 30-day extension and a reasonable, cost-based fee. Also: amendment, restrictions, confidential communications, and accounting of disclosures (6 years, excluding TPO and disclosures to the individual). Breach notification: individual notice without unreasonable delay and no later than 60 days from discovery; HHS notice; media notice if 500+ residents of a state. A breach is presumed unless a four-factor risk assessment shows low probability of compromise: nature/extent of PHI, the unauthorized recipient, whether the PHI was actually acquired or viewed, and mitigation.
De-identification
Safe Harbor removes 18 identifiers; expert determination requires statistical proof of very small re-identification risk. A limited data set requires a data use agreement. State law applies if stricter; 42 CFR Part 2 protects substance use disorder records.
Worked example: a lost unencrypted laptop is presumed a breach; a properly encrypted laptop is not, because encryption is a safe harbor.