+--------+-------------------------------------------------+----+----+
| **P    | **Standard/Subsection Summary**                 | ** | ** |
| rivacy |                                                 | Co | No |
| Rule   |                                                 | nt | n- |
| Sec    |                                                 | in | Co |
| tion** |                                                 | ge | nt |
|        |                                                 | nt | in |
|        |                                                 | ** | ge |
|        |                                                 |    | nt |
|        |                                                 |    | ** |
+========+=================================================+====+====+
| §      | \(a\) Standard. A CE may not use or disclose    |    |    |
| 1      | PHI, except as permitted or required.           |    |    |
| 64.502 |                                                 |    |    |
| Uses   | A CE is permitted to use or disclose PHI:       |    |    |
| and    |                                                 |    |    |
| discl  | -   To the individual;                          |    |    |
| osures |                                                 |    |    |
| of     | -   For treatment, payment, or health care      |    |    |
| PHI:   |     operations                                  |    |    |
| g      |                                                 |    |    |
| eneral | -   For other reasons pursuant to or as         |    |    |
| rules. |     permitted by other sections of the Privacy  |    |    |
|        |     Rule.                                       |    |    |
|        |                                                 |    |    |
|        | \* To reduce duplication §164.506 should be     |    |    |
|        | included in this discussion.                    |    |    |
+--------+-------------------------------------------------+----+----+
|        | \(b\) Standard: Minimum necessary               |    |    |
|        |                                                 |    |    |
|        | Minimum necessary applies when using or         |    |    |
|        | disclosing PHI or when requesting PHI from      |    |    |
|        | another CE                                      |    |    |
|        |                                                 |    |    |
|        | Minimum necessary does not apply to:            |    |    |
|        |                                                 |    |    |
|        | -   Disclosures to or requests by a health care |    |    |
|        |     provider for treatment;                     |    |    |
|        |                                                 |    |    |
|        | -   Uses or disclosures made to the individual; |    |    |
|        |                                                 |    |    |
|        | -   Other uses or disclosures required under    |    |    |
|        |     another section of the Privacy Rule         |    |    |
+--------+-------------------------------------------------+----+----+
|        | \(c\) Standard: Uses and disclosures of PHI     |    |    |
|        | subject to an agreed upon restriction.          |    |    |
|        |                                                 |    |    |
|        | A CE that has agreed to a restriction pursuant  |    |    |
|        | to §164.522(a)(1) may not use or disclose the   |    |    |
|        | PHI covered by the restriction in violation of  |    |    |
|        | such restriction, with certain exceptions       |    |    |
+--------+-------------------------------------------------+----+----+
|        | \(d\) Standard: Uses and disclosures of         |    |    |
|        | de-identified PHI.                              |    |    |
|        |                                                 |    |    |
|        | A CE may use PHI to create information that is  |    |    |
|        | not individually identifiable health            |    |    |
|        | information or disclose PHI only to a BA for    |    |    |
|        | such purpose, whether or not the de-identified  |    |    |
|        | information is to be used by the CE. The        |    |    |
|        | requirements of this subpart do not apply to    |    |    |
|        | information that has been de-identified in      |    |    |
|        | accordance with the applicable requirements,    |    |    |
|        | provided that there is not a code or other      |    |    |
|        | means that would allow the information to be    |    |    |
|        | re-identified and de-identified information is  |    |    |
|        | re-identified, a CE may use or disclose such    |    |    |
|        | re-identified information only as permitted or  |    |    |
|        | required by this subpart.                       |    |    |
|        |                                                 |    |    |
|        | \* To reduce duplication §164.514(a) should be  |    |    |
|        | included in this discussion.                    |    |    |
+--------+-------------------------------------------------+----+----+
|        | \(e\) Standard: Disclosures to BAs.             |    |    |
|        |                                                 |    |    |
|        | A CE may disclose PHI to a BA and may allow a   |    |    |
|        | BA to create or receive PHI on its behalf, if   |    |    |
|        | the covered entity obtains satisfactory         |    |    |
|        | assurance that the business associate will      |    |    |
|        | appropriately safeguard the information.        |    |    |
+--------+-------------------------------------------------+----+----+
|        | \(f\) Standard: Deceased individuals.           |    |    |
+--------+-------------------------------------------------+----+----+
|        | (g)(1) Standard: Personal representatives. As   |    |    |
|        | specified in this paragraph, a CE must, with    |    |    |
|        | certain exceptions treat a personal             |    |    |
|        | representative as the individual for purposes   |    |    |
|        | of this subchapter.                             |    |    |
+--------+-------------------------------------------------+----+----+
|        | \(h\) Standard: Confidential communications.    |    |    |
+--------+-------------------------------------------------+----+----+
|        | \(i\) Standard: Uses and disclosures consistent |    |    |
|        | with notice.                                    |    |    |
+--------+-------------------------------------------------+----+----+
|        | \(j\) Standard: Disclosures by whistleblowers   |    |    |
|        | and workforce member crime victims              |    |    |
+--------+-------------------------------------------------+----+----+
|        |                                                 |    |    |
+--------+-------------------------------------------------+----+----+
| §      | (a)(3) A CE must obtain an authorization for    |    |    |
| 1      | any use or disclosure of PHI for marketing,     |    |    |
| 64.508 | except if the communication is in the form of:  |    |    |
| Uses   |                                                 |    |    |
| and    | -   A face-to-face communication made by a CE   |    |    |
| discl  |     to an individual;                           |    |    |
| osures |                                                 |    |    |
| for    | -   A promotional gift of nominal value         |    |    |
| which  |     provided by the CE.                         |    |    |
| an     |                                                 |    |    |
| a      | -   If the marketing involves direct or         |    |    |
| uthori |     indirect remuneration to the CE from a      |    |    |
| zation |     third party, the authorization must state   |    |    |
| is     |     that such remuneration is involved.         |    |    |
| req    |                                                 |    |    |
| uired. |                                                 |    |    |
+--------+-------------------------------------------------+----+----+
|        | Definition of Marketing:                        |    |    |
|        |                                                 |    |    |
|        | -   To make a communication about a product or  |    |    |
|        |     service that encourages recipients of the   |    |    |
|        |     communication to purchase or use the        |    |    |
|        |     product or service, unless the              |    |    |
|        |     communication is made:                      |    |    |
|        |                                                 |    |    |
|        |     -   To describe a health-related product or |    |    |
|        |         service (or payment for such product or |    |    |
|        |         service) that is provided by, or        |    |    |
|        |         included in a plan of benefits of, the  |    |    |
|        |         covered entity making the               |    |    |
|        |         communication, including communications |    |    |
|        |         about: the entities participating in a  |    |    |
|        |         health care provider network or health  |    |    |
|        |         plan network; replacement of, or        |    |    |
|        |         enhancements to, a health plan; and     |    |    |
|        |         health-related products or services     |    |    |
|        |         available only to a health plan         |    |    |
|        |         enrollee that add value to, but are not |    |    |
|        |         part of, a plan of benefits.            |    |    |
|        |                                                 |    |    |
|        |     -   For treatment of the individual; or     |    |    |
|        |                                                 |    |    |
|        |     -   For case management or care             |    |    |
|        |         coordination for the individual, or to  |    |    |
|        |         direct or recommend alternative         |    |    |
|        |         treatments, therapies, health care      |    |    |
|        |         providers, or settings of care to the   |    |    |
|        |         individual.                             |    |    |
|        |                                                 |    |    |
|        | -   An arrangement between a covered entity and |    |    |
|        |     any other entity whereby the covered entity |    |    |
|        |     discloses protected health information to   |    |    |
|        |     the other entity, in exchange for direct or |    |    |
|        |     indirect remuneration, for the other entity |    |    |
|        |     or its affiliate to make a communication    |    |    |
|        |     about its own product or service that       |    |    |
|        |     encourages recipients of the communication  |    |    |
|        |     to purchase or use that product or service. |    |    |
+--------+-------------------------------------------------+----+----+
|        |                                                 |    |    |
+--------+-------------------------------------------------+----+----+
| §      | A CE may use or disclose PHI, provided that the |    |    |
| 1      | individual is informed in advance of the use or |    |    |
| 64.510 | disclosure and has the opportunity to agree to  |    |    |
| Uses   | or prohibit or restrict the use or disclosure,  |    |    |
| and    | in accordance with the applicable requirements  |    |    |
| discl  | of this section.                                |    |    |
| osures |                                                 |    |    |
| req    | \(b\) Standard: Uses and disclosures for        |    |    |
| uiring | involvement in the individual\'s care and       |    |    |
| an     | notification purposes.                          |    |    |
| oppor  |                                                 |    |    |
| tunity |                                                 |    |    |
| for    |                                                 |    |    |
| the    |                                                 |    |    |
| indi   |                                                 |    |    |
| vidual |                                                 |    |    |
| to     |                                                 |    |    |
| agree  |                                                 |    |    |
| or to  |                                                 |    |    |
| o      |                                                 |    |    |
| bject. |                                                 |    |    |
+--------+-------------------------------------------------+----+----+
|        |                                                 |    |    |
+--------+-------------------------------------------------+----+----+
| §      | \(a\) Standard: Uses and disclosures required   |    |    |
| 1      | by law. A CE may use or disclose PHI to the     |    |    |
| 64.512 | extent that such use or disclosure is required  |    |    |
| Uses   | by law and the use or disclosure complies with  |    |    |
| and    | and is limited to the relevant requirements of  |    |    |
| discl  | such law.                                       |    |    |
| osures |                                                 |    |    |
| for    |                                                 |    |    |
| which  |                                                 |    |    |
| an     |                                                 |    |    |
| a      |                                                 |    |    |
| uthori |                                                 |    |    |
| zation |                                                 |    |    |
| or     |                                                 |    |    |
| oppor  |                                                 |    |    |
| tunity |                                                 |    |    |
| to     |                                                 |    |    |
| agree  |                                                 |    |    |
| or     |                                                 |    |    |
| object |                                                 |    |    |
| is not |                                                 |    |    |
| req    |                                                 |    |    |
| uired. |                                                 |    |    |
+--------+-------------------------------------------------+----+----+
|        | \(b\) Standard: uses and disclosures for public |    |    |
|        | health activities                               |    |    |
+--------+-------------------------------------------------+----+----+
|        | \(c\) Standard: Disclosures about victims of    |    |    |
|        | abuse, neglect or domestic violence             |    |    |
+--------+-------------------------------------------------+----+----+
|        | \(d\) Standard: Uses and disclosures for health |    |    |
|        | oversight activities                            |    |    |
+--------+-------------------------------------------------+----+----+
|        | \(e\) Standard: Disclosures for judicial and    |    |    |
|        | administrative proceedings.                     |    |    |
+--------+-------------------------------------------------+----+----+
|        | \(f\) Standard: Disclosures for law enforcement |    |    |
|        | purposes.                                       |    |    |
+--------+-------------------------------------------------+----+----+
|        | \(g\) Standard: Uses and disclosures about      |    |    |
|        | decedents.                                      |    |    |
+--------+-------------------------------------------------+----+----+
|        | \(h\) Standard: Uses and disclosures for        |    |    |
|        | cadaveric organ, eye or tissue donation         |    |    |
|        | purposes.                                       |    |    |
+--------+-------------------------------------------------+----+----+
|        | \(i\) Standard: Uses and disclosures for        |    |    |
|        | research purposes.                              |    |    |
+--------+-------------------------------------------------+----+----+
|        | \(j\) Standard: Uses and disclosures to avert a |    |    |
|        | serious threat to health or safety.             |    |    |
+--------+-------------------------------------------------+----+----+
|        | \(k\) Standard: Uses and disclosures for        |    |    |
|        | specialized government functions                |    |    |
+--------+-------------------------------------------------+----+----+
|        | \(l\) Standard: Disclosures for workers\'       |    |    |
|        | compensation.                                   |    |    |
+--------+-------------------------------------------------+----+----+
|        |                                                 |    |    |
+--------+-------------------------------------------------+----+----+
| §      | (d)(1) Standard: Minimum necessary              |    |    |
| 1      | requirements.                                   |    |    |
| 64.514 |                                                 |    |    |
| Other  | In order to comply with §164.502(b) and this    |    |    |
| requir | section, a CE must meet the following           |    |    |
| ements | requirements with respect to a request for, or  |    |    |
| re     | the use and disclosure of, PHI.                 |    |    |
| lating |                                                 |    |    |
| to     | Minimum necessary *uses* of PHI.                |    |    |
| uses   |                                                 |    |    |
| and    | -   A CE must make reasonable efforts to limit  |    |    |
| discl  |     the access of such persons or classes of    |    |    |
| osures |     persons in its workforce who need access to |    |    |
| of     |     PHI and the category or categories of PHI   |    |    |
| PHI.   |     to which access is needed and any           |    |    |
|        |     conditions appropriate to such access.      |    |    |
|        |                                                 |    |    |
|        | Minimum necessary *disclosures* of PHI.         |    |    |
|        |                                                 |    |    |
|        | -   A CE must implement policies and procedures |    |    |
|        |     for any routine and recurring disclosures.  |    |    |
|        |                                                 |    |    |
|        | -   For all other disclosures, a CE must        |    |    |
|        |     develop limiting criteria and review        |    |    |
|        |     requests for disclosure on an individual    |    |    |
|        |     basis in accordance with such criteria.     |    |    |
|        |                                                 |    |    |
|        | -   A CE may rely, if such reliance is          |    |    |
|        |     reasonable under the circumstances, on a    |    |    |
|        |     requested disclosure as the minimum         |    |    |
|        |     necessary for the stated purpose when:      |    |    |
|        |                                                 |    |    |
|        |     -   Making disclosures to public officials, |    |    |
|        |         if it is represented as the minimum     |    |    |
|        |         necessary;                              |    |    |
|        |                                                 |    |    |
|        |     -   The information is requested by another |    |    |
|        |         CE;                                     |    |    |
|        |                                                 |    |    |
|        |     -   The information is requested by a       |    |    |
|        |         professional who is a member of its     |    |    |
|        |         workforce or is a BA of the CE for the  |    |    |
|        |         purpose of providing professional       |    |    |
|        |         services to the CE, if the professional |    |    |
|        |         represents that the information         |    |    |
|        |         requested is the minimum necessary for  |    |    |
|        |         the stated purpose(s); or               |    |    |
|        |                                                 |    |    |
|        |     -   For research purposes in accordance     |    |    |
|        |         with §164.512(i)                        |    |    |
|        |                                                 |    |    |
|        | For all uses, disclosures, or requests to which |    |    |
|        | the requirements above apply, a CE may not use, |    |    |
|        | disclose or request an entire medical record,   |    |    |
|        | except when it is specifically justified as the |    |    |
|        | amount that is reasonably necessary to          |    |    |
|        | accomplish the purpose of the use, disclosure,  |    |    |
|        | or request.                                     |    |    |
+--------+-------------------------------------------------+----+----+
|        | (e)(1) Standard: Limited data set. A covered    |    |    |
|        | entity may use or disclose a limited data set   |    |    |
|        | that meets the following requirements           |    |    |
|        |                                                 |    |    |
|        | -   A limited data set is protected health      |    |    |
|        |     information that excludes a set of direct   |    |    |
|        |     identifiers                                 |    |    |
|        |                                                 |    |    |
|        | -   Permitted purposes for uses and             |    |    |
|        |     disclosures.                                |    |    |
|        |                                                 |    |    |
|        |     -   A covered entity may use or disclose a  |    |    |
|        |         limited data set only for the purposes  |    |    |
|        |         of research, public health, or health   |    |    |
|        |         care operations.                        |    |    |
|        |                                                 |    |    |
|        |     -   A covered entity may use protected      |    |    |
|        |         health information to create a limited  |    |    |
|        |         data set, or disclose protected health  |    |    |
|        |         information only to a business          |    |    |
|        |         associate for such purpose, whether or  |    |    |
|        |         not the limited data set is to be used  |    |    |
|        |         by the covered entity.                  |    |    |
|        |                                                 |    |    |
|        | -   A covered entity may use or disclose a      |    |    |
|        |     limited data set only if the covered entity |    |    |
|        |     obtains satisfactory assurance, in the form |    |    |
|        |     of a data use agreement that the limited    |    |    |
|        |     data set recipient will only use or         |    |    |
|        |     disclose the protected health information   |    |    |
|        |     for limited purposes.                       |    |    |
+--------+-------------------------------------------------+----+----+
|        | (f)(1) Standard: Uses and disclosures for       |    |    |
|        | fundraising.                                    |    |    |
|        |                                                 |    |    |
|        | A covered entity may use, or disclose to a      |    |    |
|        | business associate or to an institutionally     |    |    |
|        | related foundation, the following protected     |    |    |
|        | health information for the purpose of raising   |    |    |
|        | funds for its own benefit, without an           |    |    |
|        | authorization.                                  |    |    |
+--------+-------------------------------------------------+----+----+
|        | \(g\) Standard: Uses and disclosures for        |    |    |
|        | underwriting and related purposes.              |    |    |
|        |                                                 |    |    |
|        | If a health plan receives protected heath       |    |    |
|        | information for the purpose of underwriting,    |    |    |
|        | premium rating, or other activities relating to |    |    |
|        | the creation, renewal, or replacement of a      |    |    |
|        | contract of health insurance or health          |    |    |
|        | benefits, and if such health insurance or       |    |    |
|        | health benefits are not placed with the health  |    |    |
|        | plan, such health plan may not use or disclose  |    |    |
|        | such protected health information for any other |    |    |
|        | purpose, except as may be required by law.      |    |    |
+--------+-------------------------------------------------+----+----+
|        | (h)(1) Standard: Verification requirements.     |    |    |
|        |                                                 |    |    |
|        | Prior to any disclosure permitted by this       |    |    |
|        | subpart, a covered entity must:                 |    |    |
|        |                                                 |    |    |
|        | -   Except with respect to disclosures under    |    |    |
|        |     §164.510, verify the identity of a person   |    |    |
|        |     requesting protected health information and |    |    |
|        |     the authority of any such person to have    |    |    |
|        |     access to protected health information      |    |    |
|        |     under this subpart, if the identity or any  |    |    |
|        |     such authority of such person is not known  |    |    |
|        |     to the covered entity; and                  |    |    |
|        |                                                 |    |    |
|        | -   Obtain any documentation, statements, or    |    |    |
|        |     representations, whether oral or written,   |    |    |
|        |     from the person requesting the protected    |    |    |
|        |     health information when such documentation, |    |    |
|        |     statement, or representation is a condition |    |    |
|        |     of the disclosure under this subpart.       |    |    |
+--------+-------------------------------------------------+----+----+
|        |                                                 |    |    |
+--------+-------------------------------------------------+----+----+
| §      | \(a\) Standard: notice of privacy practices.    |    |    |
| 1      | Right to notice. Except as provided, an         |    |    |
| 64.520 | individual has a right to adequate notice of    |    |    |
| Notice | the uses and disclosures of PHI that may be     |    |    |
| of     | made by the CE and of the individual\'s rights  |    |    |
| p      | and the CE\'s legal duties with respect to PHI. |    |    |
| rivacy |                                                 |    |    |
| pra    |                                                 |    |    |
| ctices |                                                 |    |    |
| for    |                                                 |    |    |
| PHI.   |                                                 |    |    |
+--------+-------------------------------------------------+----+----+
|        |                                                 |    |    |
+--------+-------------------------------------------------+----+----+
| §      | (a)(1) Standard: Right of an individual to      |    |    |
| 1      | request restriction of uses and disclosures.    |    |    |
| 64.522 |                                                 |    |    |
| Rights | -   A CE must permit an individual to request   |    |    |
| to     |     that the CE restrict: (A) Uses or           |    |    |
| r      |     disclosures of PHI about the individual to  |    |    |
| equest |     carry out treatment, payment, or health     |    |    |
| p      |     care operations; and (B) Disclosures        |    |    |
| rivacy |     permitted under §164.510(b).                |    |    |
| prot   |                                                 |    |    |
| ection | -   A CE is not required to agree to a          |    |    |
| for    |     restriction.                                |    |    |
| PHI.   |                                                 |    |    |
+--------+-------------------------------------------------+----+----+
|        | (b)(1) Standard: Confidential communications    |    |    |
|        | requirements.                                   |    |    |
|        |                                                 |    |    |
|        | -   A covered health care provider must permit  |    |    |
|        |     individuals to request and must accommodate |    |    |
|        |     reasonable requests by individuals to       |    |    |
|        |     receive communications of PHI from the      |    |    |
|        |     covered health care provider by alternative |    |    |
|        |     means or at alternative locations.          |    |    |
|        |                                                 |    |    |
|        | -   A health plan must permit individuals to    |    |    |
|        |     request and must accommodate reasonable     |    |    |
|        |     requests by individuals to receive          |    |    |
|        |     communications of PHI from the health plan  |    |    |
|        |     by alternative means or at alternative      |    |    |
|        |     locations, if the individual clearly states |    |    |
|        |     that the disclosure of all or part of that  |    |    |
|        |     information could endanger the individual.  |    |    |
+--------+-------------------------------------------------+----+----+
|        |                                                 |    |    |
+--------+-------------------------------------------------+----+----+
| §      | \(a\) Standard: Access to PHI.                  |    |    |
| 1      |                                                 |    |    |
| 64.524 | -   Except as otherwise provided, an individual |    |    |
| Access |     has a right of access to inspect and obtain |    |    |
| of     |     a copy of PHI about the individual in a     |    |    |
| indiv  |     designated record set, for as long as the   |    |    |
| iduals |     PHI is maintained in the designated record  |    |    |
| to     |     set, except for psychotherapy notes;        |    |    |
| PHI.   |     information compiled in reasonable          |    |    |
|        |     anticipation of, or for use in, a civil,    |    |    |
|        |     criminal, or administrative action or       |    |    |
|        |     proceeding; and PHI maintained by a CE that |    |    |
|        |     is subject to CLIA to the extent the        |    |    |
|        |     provision of access to the individual would |    |    |
|        |     be prohibited by law or exempt from CLIA    |    |    |
|        |     pursuant to CFR 493.3(a)(2)                 |    |    |
+--------+-------------------------------------------------+----+----+
|        | \(b\) Implementation specifications: Requests   |    |    |
|        | for access and timely action.                   |    |    |
|        |                                                 |    |    |
|        | -   the CE must act on a request for access no  |    |    |
|        |     later than 30 days after receipt of the     |    |    |
|        |     request as follows.                         |    |    |
|        |                                                 |    |    |
|        | -   If the request for access is for PHI that   |    |    |
|        |     is not maintained or accessible to the CE   |    |    |
|        |     on-site, the CE must take an action no      |    |    |
|        |     later than 60 days from the receipt of such |    |    |
|        |     a request.                                  |    |    |
|        |                                                 |    |    |
|        | -   If the CE is unable to take an action       |    |    |
|        |     required within the time required by        |    |    |
|        |     paragraph the CE may extend the time for    |    |    |
|        |     such actions by no more than 30 days if it  |    |    |
|        |     meets certain requirements                  |    |    |
+--------+-------------------------------------------------+----+----+
|        | \(c\) Implementation specifications: Provision  |    |    |
|        | of access. If the CE provides an individual     |    |    |
|        | with access, in whole or in part, to PHI, the   |    |    |
|        | CE must comply with the following requirements. |    |    |
|        |                                                 |    |    |
|        | -   The CE must provide the access requested by |    |    |
|        |     individuals.                                |    |    |
|        |                                                 |    |    |
|        | -   The CE must provide the individual with     |    |    |
|        |     access to the PHI in the form or format     |    |    |
|        |     requested by the individual, if it is       |    |    |
|        |     readily producible in such form or format;  |    |    |
|        |     or, if not, in a readable hard copy form or |    |    |
|        |     such other form or format as agreed to by   |    |    |
|        |     the CE and the individual.                  |    |    |
|        |                                                 |    |    |
|        | -   The CE may provide the individual with a    |    |    |
|        |     summary of the PHI requested, in lieu of    |    |    |
|        |     providing access to the PHI or may provide  |    |    |
|        |     an explanation of the PHI to which access   |    |    |
|        |     has been provided under certain conditions. |    |    |
|        |                                                 |    |    |
|        | -   The CE may impose a reasonable, cost-based  |    |    |
|        |     fee, provided that the fee includes only    |    |    |
|        |     the cost of: Copying, Postage, and          |    |    |
|        |     Preparing an explanation or summary         |    |    |
+--------+-------------------------------------------------+----+----+
|        |                                                 |    |    |
+--------+-------------------------------------------------+----+----+
| §      | \(a\) Standard: Right to amend. An individual   |    |    |
| 1      | has the right to have a CE amend PHI or a       |    |    |
| 64.526 | record about the individual in a designated     |    |    |
| Ame    | record set for as long as the PHI is maintained |    |    |
| ndment | in the designated record set.                   |    |    |
| of PHI |                                                 |    |    |
|        | -   The CE must act on the individual\'s        |    |    |
|        |     request for an amendment no later than 60   |    |    |
|        |     days after receipt of such a request        |    |    |
|        |     (accepting or denying)                      |    |    |
|        |                                                 |    |    |
|        | -   Informing the individual. The CE must       |    |    |
|        |     timely inform the individual that the       |    |    |
|        |     amendment is accepted and obtain the        |    |    |
|        |     individual\'s identification of and         |    |    |
|        |     agreement to have the CE notify the         |    |    |
|        |     relevant persons with which the amendment   |    |    |
|        |     needs to be shared in accordance with the   |    |    |
|        |     informing other requirement.                |    |    |
|        |                                                 |    |    |
|        | -   Informing others. The CE must make          |    |    |
|        |     reasonable efforts to inform and provide    |    |    |
|        |     the amendment within a reasonable time      |    |    |
|        |     to: (i) Persons identified by the           |    |    |
|        |     individual as having received PHI about the |    |    |
|        |     individual and needing the amendment;       |    |    |
|        |     and (ii) Persons, including BAs, that the   |    |    |
|        |     CE knows have the PHI that is the subject   |    |    |
|        |     of the amendment and that may have relied,  |    |    |
|        |     or could foreseeably rely, on such          |    |    |
|        |     information to the detriment of the         |    |    |
|        |     individual.                                 |    |    |
+--------+-------------------------------------------------+----+----+
|        |                                                 |    |    |
+--------+-------------------------------------------------+----+----+
| §      | \(a\) Standard: Right to an accounting of       |    |    |
| 1      | disclosures of PHI.                             |    |    |
| 64.528 |                                                 |    |    |
| Acco   | An individual has a right to receive an         |    |    |
| unting | accounting of disclosures of PHI made by a CE   |    |    |
| of     | in the six years prior to the date on which the |    |    |
| discl  | accounting is requested, except for             |    |    |
| osures | disclosures:                                    |    |    |
| of     |                                                 |    |    |
| PHI.   | -   To carry out treatment, payment and health  |    |    |
|        |     care operations as provided in §164.506;    |    |    |
|        |                                                 |    |    |
|        | -   To individuals of PHI about them as         |    |    |
|        |     provided in §164.502;                       |    |    |
|        |                                                 |    |    |
|        | -   Incident to a use or disclosure otherwise   |    |    |
|        |     permitted or required by this subpart, as   |    |    |
|        |     provided in §164.502;                       |    |    |
|        |                                                 |    |    |
|        | -   Pursuant to an authorization as provided in |    |    |
|        |     §164.508;                                   |    |    |
|        |                                                 |    |    |
|        | -   For the facility\'s directory or to persons |    |    |
|        |     involved in the individual\'s care or other |    |    |
|        |     notification purposes as provided in        |    |    |
|        |     §164.510;                                   |    |    |
|        |                                                 |    |    |
|        | -   For national security or intelligence       |    |    |
|        |     purposes as provided in §164.512(k)(2);     |    |    |
|        |                                                 |    |    |
|        | -   To correctional institutions or law         |    |    |
|        |     enforcement officials as provided in        |    |    |
|        |     §164.512(k)(5);                             |    |    |
|        |                                                 |    |    |
|        | -   As part of a limited data set in accordance |    |    |
|        |     with §164.514(e); or                        |    |    |
|        |                                                 |    |    |
|        | -   That occurred prior to the compliance date  |    |    |
|        |     for the CE.                                 |    |    |
+--------+-------------------------------------------------+----+----+
|        |                                                 |    |    |
+--------+-------------------------------------------------+----+----+

**Definition:** Health care operations means any of the following
activities of the covered entity to the extent that the activities are
related to covered functions:

> **(1)** Conducting quality assessment and improvement activities,
> including outcomes evaluation and development of clinical guidelines,
> provided that the obtaining of generalizable knowledge is not the
> primary purpose of any studies resulting from such activities;
> population-based activities relating to improving health or reducing
> health care costs, protocol development, case management and care
> coordination, contacting of health care providers and patients with
> information about treatment alternatives; and related functions that
> do not include treatment;
>
> **(2)** Reviewing the competence or qualifications of health care
> professionals, evaluating practitioner and provider performance,
> health plan performance, conducting training programs in which
> students, trainees, or practitioners in areas of health care learn
> under supervision to practice or improve their skills as health care
> providers, training of non-health care professionals, accreditation,
> certification, licensing, or credentialing activities;
>
> **(3)** Underwriting, premium rating, and other activities relating to
> the creation, renewal or replacement of a contract of health insurance
> or health benefits, and ceding, securing, or placing a contract for
> reinsurance of risk relating to claims for health care (including
> stop-loss insurance and excess of loss insurance), provided that the
> requirements of §164.514(g) are met, if applicable;
>
> **(4)** Conducting or arranging for medical review, legal services,
> and auditing functions, including fraud and abuse detection and
> compliance programs;
>
> **(5)** Business planning and development, such as conducting
> cost-management and planning-related analyses related to managing and
> operating the entity, including formulary development and
> administration, development or improvement of methods of payment or
> coverage policies; and
>
> **(6)** Business management and general administrative activities of
> the entity, including, but not limited to:
>
> \(i\) Management activities relating to implementation of and
> compliance with the requirements of this subchapter;
>
> \(ii\) Customer service, including the provision of data analyses for
> policy holders, plan sponsors, or other customers, provided that
> protected health information is not disclosed to such policy holder,
> plan sponsor, or customer.
>
> \(iii\) Resolution of internal grievances;
>
> \(iv\) The sale, transfer, merger, or consolidation of all or part of
> the covered entity with another covered entity, or an entity that
> following such activity will become a covered entity and due diligence
> related to such activity; and
>
> \(v\) Consistent with the applicable requirements of §164.514,
> creating de-identified health information or a limited data set, and
> fundraising for the benefit of the covered entity.