The Privacy Rule sets the limits on how PHI may be used (shared and handled inside the organization) and disclosed (released to anyone outside it). The basic principle is simple: a covered entity may not use or disclose PHI unless the Privacy Rule permits or requires it, or the patient gives written permission.
Required disclosures
A covered entity must disclose PHI in only two situations:
- to the individual (or their personal representative) when they ask for access to their own information or an accounting of disclosures;
- to HHS when it is investigating a complaint, doing a compliance review or taking enforcement action.
Treatment, payment and health care operations (TPO)
PHI may be used and disclosed without the patient's written authorization for:
- Treatment — providing and coordinating care, consultations and referrals. A nurse sharing information with the physician, or a clinic sending records to a specialist the patient is referred to, is treatment.
- Payment — billing, claims, eligibility checks and collecting payment.
- Health care operations — quality improvement, training, staff reviews, audits, legal services and business management.
Other permitted uses and disclosures
- Family and friends involved in care. If the patient is present and does not object, or if it is reasonable to infer they do not object, staff may share information relevant to that person's involvement in care or payment. If the patient is not able to agree, staff may use professional judgment about what is in the patient's best interest.
- Facility directories — a hospital may list a patient's name, location and general condition, unless the patient objects.
- Public interest purposes — for example, when required by law; for public health reporting; reports of abuse, neglect or domestic violence; health oversight; court orders; certain law enforcement purposes; to prevent a serious threat to health or safety; workers' compensation; organ donation; and certain research. Each has conditions, and these disclosures are usually handled by trained staff following written procedures.
- Incidental disclosures — a visitor overhearing part of a conversation, or seeing a name on a sign-in sheet, is not a violation if reasonable safeguards and minimum necessary were applied. An incidental disclosure is a by-product of a permitted use, not an excuse for carelessness.
When written authorization is needed
For uses and disclosures not otherwise permitted, the patient must sign an authorization. Examples: most marketing, the sale of PHI, most uses of psychotherapy notes, and sending records to an employer or life insurer at the patient's request. A valid authorization is specific about what may be disclosed, to whom and for what purpose, has an expiry date or event, and can be revoked in writing.
Minimum necessary
When using, disclosing or requesting PHI, the organization must make reasonable efforts to limit it to the minimum necessary to accomplish the purpose.
- Access is usually role-based: a scheduler needs appointment information, not full clinical notes.
- When sending records for billing, send what the claim needs, not the entire chart.
Minimum necessary does not apply to disclosures to a provider for treatment, disclosures to the patient, disclosures made under a signed authorization, disclosures to HHS, and disclosures required by law.
Personal representatives
A personal representative — for example, a parent of a minor child in most cases, or someone with a health care power of attorney — generally has the same rights as the patient for the relevant information. State law affects who counts, so follow your organization's procedure.
Scenarios
A call from a neighbor. A caller says she is a patient's neighbor and asks how he is doing. She is not known to be involved in his care, and he has not said he wants her told. Do not confirm or share information; offer to pass on a message instead, following your facility's procedure.
A police officer at the desk. An officer asks for a patient's records. Some disclosures to law enforcement are permitted, but only under specific conditions. Do not hand over records on the spot — refer the request to the person or department that handles release of information.
A colleague who is not on the care team. A nurse from another unit asks you about a patient you are caring for, "just to know how she is". If the colleague has no treatment or work reason, sharing is not a permitted use. Minimum necessary applies inside the organization too.
Key points
- PHI may be used or disclosed only as the Privacy Rule permits or requires, or with the patient's authorization.
- Treatment, payment and health care operations do not need written authorization.
- Required disclosures: to the patient on request, and to HHS.
- Use and share only the minimum necessary — except for treatment and a few other cases.