+-----------+-----------------------------+-------------+-------------+
| Section   | HIPAA Requirement           | Existing\   | To Do List  |
|           |                             | Policies &  |             |
|           |                             | Practices   |             |
+===========+=============================+=============+=============+
| Subpart   | The provisions of this part |             |             |
| A\        | are adopted pursuant to the |             |             |
| --General | Secretary\'s authority to   |             |             |
| P         | prescribe standards,        |             |             |
| rovisions | requirements, and           |             |             |
|           | implementation standards    |             |             |
| [§        | under part C of title XI of |             |             |
| 164.102   | the Act and section 264 of  |             |             |
| Statutory | Public Law 104-191.         |             |             |
| ba        |                             |             |             |
| sis](../H |                             |             |             |
| IPAA%20Pr |                             |             |             |
| ivacy%20R |                             |             |             |
| ule.doc#O |                             |             |             |
| LE_LINK1) |                             |             |             |
+-----------+-----------------------------+-------------+-------------+
| [§        | Except as otherwise         | PA applies  |             |
| 164.104   | provided, the provisions of | only to     |             |
| Appli     | this part apply to covered  | Federal     |             |
| cability] | entities: health plans,     | Records,    |             |
| (../HIPAA | health care clearinghouses, | which may   |             |
| %20Privac | and health care providers   | include     |             |
| y%20Rule. | who transmit health         | medical     |             |
| doc#_Hlk5 | information in electronic   | records     |             |
| 16542825) | form in connection with any |             |             |
|           | transaction referred to in  | Covered     |             |
|           | section 1173(a)(1) of the   | entity,     |             |
|           | Act.                        | health plan |             |
|           |                             | &           |             |
|           |                             | cl          |             |
|           |                             | earinghouse |             |
|           |                             | defined at  |             |
|           |                             | 160.103     |             |
+-----------+-----------------------------+-------------+-------------+
| [§        | In complying with the       | 5 USC 552a; | Update SOR  |
| 164.106   | requirements of this part,  | 45 CFR 5b;  | and/or      |
| Rel       | covered entities are        | IHS SOR     | policy.     |
| ationship | required to comply with the | 09-17-0001. |             |
| to other  | applicable provisions of    |             |             |
| parts]    | parts 160 and 162 of this   |             |             |
| (../HIPAA | subchapter.                 |             |             |
| %20Privac |                             |             |             |
| y%20Rule. |                             |             |             |
| doc#_Hlk5 |                             |             |             |
| 16542863) |                             |             |             |
+-----------+-----------------------------+-------------+-------------+
| Subpart   | \(a\) Except as otherwise   | 5 USC 552a; | Update SOR  |
| E -       | provided herein, the        | 45 CFR 5b;  | and/or      |
| Privacy   | standards, requirements,    | IHS SOR     | policy.     |
| of        | and implementation          | 09-17-0001. |             |
| Ind       | specifications of this      |             | Update SOR  |
| ividually | subpart apply to covered    | Refer to    | and/or      |
| Ide       | entities with respect to    | 160.103 for | policy.     |
| ntifiable | protected health            | meaning and |             |
| Health    | information.                | examples of | Update SOR  |
| In        |                             | cl          | and/or      |
| formation | \(b\) Health care           | earinghouse | policy.     |
|           | clearinghouses must comply  |             |             |
| [§        | with the standards,         | Not covered | Same as     |
| 164.500]  | requirements, and           | in PA, HHS, | above.      |
| (../HIPAA | implementation              | or IHS.     |             |
| %20Privac | specifications as follows:  |             | Same as     |
| y%20Rule. |                             | Same as     | above.      |
| doc#_Hlk5 | \(1\) When a health care    | above.      | Requires    |
| 16542897) | clearinghouse creates or    |             | business    |
| Appl      | receives protected health   | Same as     | associate   |
| icability | information as a business   | above.      | contract    |
|           | associate of another        |             |             |
|           | covered entity, the         | Same as     | Same as     |
|           | clearinghouse must comply   | above.      | above.      |
|           | with:                       |             |             |
|           |                             | Same as     | Same as     |
|           | \(i\) Section 164.500       | above.      | above.      |
|           | relating to applicability;  |             |             |
|           |                             | Same as     | Same as     |
|           | \(ii\) Section 164.501      | above.      | above.      |
|           | relating to definitions;    |             |             |
|           |                             | Same as     | Not         |
|           | \(iii\) Section 164.502     | above.      | applicable  |
|           | relating to uses and        |             | to IHS.     |
|           | disclosures of protected    |             |             |
|           | health information, except  |             |             |
|           | that a clearinghouse is     |             |             |
|           | prohibited from using or    |             |             |
|           | disclosing protected health |             |             |
|           | information other than as   |             |             |
|           | permitted in the business   |             |             |
|           | associate contract under    |             |             |
|           | which it created or         |             |             |
|           | received the protected      |             |             |
|           | health information;         |             |             |
|           |                             |             |             |
|           | \(iv\) Section 164.504      |             |             |
|           | relating to the             |             |             |
|           | organizational requirements |             |             |
|           | for covered entities,       |             |             |
|           | including the designation   |             |             |
|           | of health care components   |             |             |
|           | of a covered entity;        |             |             |
|           |                             |             |             |
|           | \(v\) Section 164.512       |             |             |
|           | relating to uses and        |             |             |
|           | disclosures for which       |             |             |
|           | consent, individual         |             |             |
|           | authorization or an         |             |             |
|           | opportunity to agree or     |             |             |
|           | object is not required,     |             |             |
|           | except that a clearinghouse |             |             |
|           | is prohibited from using or |             |             |
|           | disclosing protected health |             |             |
|           | information other than as   |             |             |
|           | permitted in the business   |             |             |
|           | associate contract under    |             |             |
|           | which it created or         |             |             |
|           | received the protected      |             |             |
|           | health information;         |             |             |
|           |                             |             |             |
|           | \(vi\) Section 164.532      |             |             |
|           | relating to transition      |             |             |
|           | requirements; and           |             |             |
|           |                             |             |             |
|           | \(vii\) Section 164.534     |             |             |
|           | relating to compliance      |             |             |
|           | dates for initial           |             |             |
|           | implementation of the       |             |             |
|           | privacy standards.          |             |             |
|           |                             |             |             |
|           | \(2\) When a health care    |             |             |
|           | clearinghouse creates or    |             |             |
|           | receives protected health   |             |             |
|           | information other than as a |             |             |
|           | business associate of a     |             |             |
|           | covered entity, the         |             |             |
|           | clearinghouse must comply   |             |             |
|           | with all of the standards,  |             |             |
|           | requirements, and           |             |             |
|           | implementation              |             |             |
|           | specifications of this      |             |             |
|           | subpart.                    |             |             |
|           |                             |             |             |
|           | \(c\) The standards,        |             |             |
|           | requirements, and           |             |             |
|           | implementation              |             |             |
|           | specifications of this      |             |             |
|           | subpart do not apply to the |             |             |
|           | Department of Defense or to |             |             |
|           | any other federal agency,   |             |             |
|           | or non- governmental        |             |             |
|           | organization acting on its  |             |             |
|           | behalf, when providing      |             |             |
|           | health care to overseas     |             |             |
|           | foreign national            |             |             |
|           | beneficiaries.              |             |             |
+-----------+-----------------------------+-------------+-------------+
| [§        | As used in this subpart,    | Some terms  | Update SOR  |
| 164.501   | the following terms have    | are covered | and/or      |
| Def       | the following meanings:     | in PA, HHS, | policy.     |
| initions] |                             | and IHS.    | Legal       |
| (../HIPAA | ***Correctional             |             | review of   |
| %20Privac | institution*** means any    | Not in PA   | some        |
| y%20Rule. | penal or correctional       |             | definitions |
| doc#_Hlk5 | facility, jail,             | Not in PA   | for IHS.    |
| 16543234) | reformatory, detention      |             |             |
|           | center, work farm, halfway  | IHS PA SOR  | Need to     |
|           | house, or residential       | 09-17-0001  | explain how |
|           | community program center    | is for      | this will   |
|           | operated by, or under       | medical &   | impact IHS  |
|           | contract to, the United     | billing     | facility    |
|           | States, a State, a          | records     | interaction |
|           | territory, a political      |             | with tribes |
|           | subdivision of a State or   | Reference   | and tribal  |
|           | territory, or an Indian     | Page 3 top  | or          |
|           | tribe, for the confinement  | of this     | ganizations |
|           | or rehabilitation of        | report.     |             |
|           | persons charged with or     |             | Need to     |
|           | convicted of a criminal     | In PA       | provide the |
|           | offense or other persons    | record      | functions   |
|           | held in lawful custody.     | means any   | in the      |
|           | *Other persons held in      | item,       | definition  |
|           | lawful custody* includes    | collection, |             |
|           | juvenile offenders          | or grouping | Send to     |
|           | adjudicated delinquent,     | of info     | research,   |
|           | aliens detained awaiting    | about an    | statistics  |
|           | deportation, persons        | individual  | for input   |
|           | committed to mental         | that is     | regarding   |
|           | institutions through the    | maintained  | policy &    |
|           | criminal justice system,    | by the      | procedure   |
|           | witnesses, or others        | Dept,       | imp         |
|           | awaiting charges or trial.  | incl'g but  | lementation |
|           |                             | not limited |             |
|           | ***Covered functions***     | to the      | Need to     |
|           | means those functions of a  | individuals | expand      |
|           | covered entity the          | education,  | definition  |
|           | performance of which makes  | financial   | of medical  |
|           | the entity a health plan,   | tr          | record to   |
|           | health care provider, or    | ansactions, | include     |
|           | health care clearinghouse.  | medical     | billing     |
|           |                             | history,    | records     |
|           | ***Data aggregation***      | and         |             |
|           | means, with respect to      | criminal or | Reference   |
|           | protected health            | employment  | Page 3 top  |
|           | information created or      | history and | of this     |
|           | received by a business      | that        | report.     |
|           | associate in its capacity   | contains    |             |
|           | as the business associate   | his name,   | HIPAA rule  |
|           | of a covered entity, the    | or an       | does not    |
|           | combining of such protected | identifying | include     |
|           | health information by the   | number,     | 'system of  |
|           | business associate with the | symbol, or  | records"    |
|           | protected health            | other       | concept     |
|           | information received by the | identifying |             |
|           | business associate in its   | particular  | Add to      |
|           | capacity as a business      | assigned to | definitions |
|           | associate of another        | the         |             |
|           | covered entity, to permit   | individual, | HIPAA       |
|           | data analyses that relate   | such as a   | expands     |
|           | to the health care          | finger or   | definition  |
|           | operations of the           | voice       | of          |
|           | respective covered          | print, or a | disclosure  |
|           | entities.                   | p           |             |
|           |                             | hotograph,. | Explain     |
|           | ***Designated record set*** | When used   | what is     |
|           | means:                      | in this     | meant by    |
|           |                             | part,       | and provide |
|           | \(1\) A group of records    | record      | examples of |
|           | maintained by or for a      | means only  | quality     |
|           | covered entity that is:     | a record    | a           |
|           |                             | that is in  | ssessments, |
|           | \(i\) The medical records   | a system of | improvement |
|           | and billing records about   | records.    | activities, |
|           | individuals maintained by   |             | outcomes    |
|           | or for a covered health     | Not in PA   | evaluation  |
|           | care provider;              | or IHS SOR  | and         |
|           |                             |             | development |
|           | \(ii\) The enrollment,      | 45 CFR      | of clinical |
|           | payment, claims             | 5b(1)(d)    | guidelines  |
|           | adjudication, and case or   | Disclosure  |             |
|           | medical management record   | means the   | Send to OPH |
|           | systems maintained by or    | a           | medical and |
|           | for a health plan; or       | vailability | research    |
|           |                             | or release  | staff for   |
|           | \(iii\) Used, in whole or   | of a record | input       |
|           | in part, by or for the      | to anyone   | regarding   |
|           | covered entity to make      | other than  | policy and  |
|           | decisions about             | the subject | procedure   |
|           | individuals.                | individual  | imp         |
|           |                             |             | lementation |
|           | \(2\) For purposes of this  | All IHS     |             |
|           | paragraph, the term         | activities  | Send to OPH |
|           | *record* means any item,    | that relate | medical     |
|           | collection, or grouping of  | to health   | staff for   |
|           | information that includes   | care        | input       |
|           | protected health            |             | regarding   |
|           | information and is          | Would this  | policy and  |
|           | maintained, collected,      | include     | procedure   |
|           | used, or disseminated by or | risk        | impl        |
|           | for a covered entity        | a           | ement-ation |
|           |                             | ssessments? |             |
|           | ***Direct treatment         |             | Consider    |
|           | relationship*** means a     | Apparently, | combining   |
|           | treatment relationship      | does not    | 0003 into   |
|           | between an individual and a | include     | 0001        |
|           | health care provider that   | Research    |             |
|           | is not an indirect          | activities  | Send to     |
|           | treatment relationship.     |             | 3^rd^ Party |
|           |                             | IHS PA SOR  | & CHS staff |
|           | ***Disclosur**e* means the  | 09-17-0003, | for input   |
|           | release, transfer,          | Medical     | regarding   |
|           | provision of access to, or  | staff       | imp         |
|           | divulging in any other      | credentials | lementation |
|           | manner of information       | and         |             |
|           | outside the entity holding  | privileges  | Identify    |
|           | the information.            | records     | appropriate |
|           |                             | includes    | office and  |
|           | ***Health care              | peer        | send for    |
|           | operations*** means any of  | reviews     | input       |
|           | the following activities of |             | regarding   |
|           | the covered entity to the   | Does CHS    | imp         |
|           | extent that the activities  | program     | lementation |
|           | are related to covered      | perform any |             |
|           | functions, and any of the   | of these    | Send to     |
|           | following activities of an  | functions?  | business    |
|           | organized health care       |             | office,     |
|           | arrangement in which the    | IHS         | finance,    |
|           | covered entity              | business    | pharmacy    |
|           | participates:               | office,     | for input   |
|           |                             | finance     | regarding   |
|           | \(1\) Conducting quality    | office,     | imp         |
|           | assessment and improvement  | pharmacy    | lementation |
|           | activities, including       | and other   |             |
|           | outcomes evaluation and     | program     | Send to     |
|           | development of clinical     | offices     | Statistics  |
|           | guidelines, provided that   |             | staff for   |
|           | the obtaining of            | IHS HQs,    | input       |
|           | generalizable knowledge is  | Area, SU    | regarding   |
|           | not the primary purpose of  | management  | imp         |
|           | any studies resulting from  |             | lementation |
|           | such activities;            | IHS privacy |             |
|           | population-based activities | advocate    | Need        |
|           | relating to improving       |             | written     |
|           | health or reducing health   | What office | policy and  |
|           | care costs, protocol        | does        | procedure   |
|           | development, case           | customer    | for         |
|           | management and care         | service?    | handling    |
|           | coordination, contacting of |             | internal    |
|           | health care providers and   | Data        | grievances  |
|           | patients with information   | analysis    |             |
|           | about treatment             |             | Send to OTA |
|           | alternatives; and related   | Would this  | & SG office |
|           | functions that do not       | include a   | for input   |
|           | include treatment;          | 638         | regarding   |
|           |                             | contract or | imp         |
|           | \(2\) Reviewing the         | compact     | lementation |
|           | competence or               | transfer    |             |
|           | qualifications of health    |             | Send to     |
|           | care professionals,         | Would IHS   | research    |
|           | evaluating practitioner and | be          | and         |
|           | provider performance,       | considered  | statistics  |
|           | health plan performance,    | a health    | staff for   |
|           | conducting training         | oversight   | input       |
|           | programs in which students, | agency?     | regarding   |
|           | trainees, or practitioners  |             | imp         |
|           | in areas of health care     | How about   | lementation |
|           | learn under supervision to  | the Alaska  |             |
|           | practice or improve their   | consortium? | Legal       |
|           | skills as health care       |             | Review by   |
|           | providers, training of      | What IHS    | OGC.        |
|           | non-health care             | offices     |             |
|           | professionals,              | would this  | Send to OPH |
|           | accreditation,              | apply to?   | staff for   |
|           | certification, licensing,   |             | input       |
|           | or credentialing            | 45 CFR Part | regarding   |
|           | activities;                 | 5b(1)(e)    | imp         |
|           |                             | Individual  | lementation |
|           | \(3\) Underwriting, premium | means a     |             |
|           | rating, and other           | living      | Broader     |
|           | activities relating to the  | person who  | definition  |
|           | creation, renewal or        | is a        |             |
|           | replacement of a contract   | citizen of  | Send to     |
|           | of health insurance or      | the US or   | CHS, Third  |
|           | health benefits, and        | an alien    | Party       |
|           | ceding, securing, or        | lawfully    | Collections |
|           | placing a contract for      | admitted    | for review  |
|           | reinsurance of risk         | for         | and comment |
|           | relating to claims for      | permanent   |             |
|           | health care (including      | residence.  | Send to OPH |
|           | stop-loss insurance and     | It does not | for input   |
|           | excess of loss insurance),  | include     | re:         |
|           | provided that the           | persons     | imp         |
|           | requirements of §           | such as     | lementation |
|           | 164.514(g) are met, if      | sole        |             |
|           | applicable;                 | propr       | Will impact |
|           |                             | ietorships, | IHS         |
|           | \(4\) Conducting or         | pa          | faci        |
|           | arranging for medical       | rtnerships, | lity/tribal |
|           | review, legal services, and | or          | activities  |
|           | auditing functions,         | co          |             |
|           | including fraud and abuse   | rporations. | Send to     |
|           | detection and compliance    | A business  | OPH, OTA &  |
|           | programs;                   | firm that   | SG offices  |
|           |                             | is          | for input   |
|           | \(5\) Business planning and | identified  | for         |
|           | development, such as        | by the name | impl        |
|           | conducting cost-management  | or one or   | ementation. |
|           | and planning-related        | more        |             |
|           | analyses related to         | persons in  | Not         |
|           | managing and operating the  | not an      | applicable  |
|           | entity, including formulary | individual  | to IHS      |
|           | development and             | within the  | operated    |
|           | administration, development | meaning of  | facilities  |
|           | or improvement of methods   | this part.  |             |
|           | of payment or coverage      |             | T           |
|           | policies; and               | Not defined | ribal/Urban |
|           |                             | in PA       | facilities  |
|           | \(6\) Business management   |             | may market  |
|           | and general administrative  | Not in PA   | their       |
|           | activities of the entity,   |             | services    |
|           | including, but not limited  | Not in PA   | and thus be |
|           | to:                         |             | impacted by |
|           |                             | I/T/U       | this        |
|           | \(i\) Management activities | facilities  | section.    |
|           | relating to implementation  | may market  |             |
|           | of and compliance with the  | their       | IHS may     |
|           | requirements of this        | services    | meet        |
|           | subchapter;                 |             | definition  |
|           |                             | We believe  |             |
|           | \(ii\) Customer service,    | IHS meets   | Send to     |
|           | including the provision of  | the         | OPH, OTA &  |
|           | data analyses for policy    | definition  | SG offices  |
|           | holders, plan sponsors, or  | of an       | for input   |
|           | other customers, provided   | organized   | re:         |
|           | that protected health       | health care | imp         |
|           | information is not          | arrangement | lementation |
|           | disclosed to such policy    |             |             |
|           | holder, plan sponsor, or    | Tribes      | See Page 10 |
|           | customer.                   | maybe?      | on          |
|           |                             |             | "Organized  |
|           | \(iii\) Resolution of       | Urbans ?    | health care |
|           | internal grievances;        |             | ar          |
|           |                             | See Page 10 | rangements" |
|           | \(iv\) Due diligence in     | on          |             |
|           | connection with the sale or | "Organized  | Send to     |
|           | transfer of assets to a     | health care | OPH, OTA &  |
|           | potential successor in      | ar          | SG, Urban,  |
|           | interest, if the potential  | rangements" | 3^rd^ Party |
|           | successor in interest is a  |             | and CHS     |
|           | covered entity or,          | I/T/U each  | offices for |
|           | following completion of the | perform     | input re:   |
|           | sale or transfer, will      | this        | imp         |
|           | become a covered entity;    | activity    | lementation |
|           | and                         |             |             |
|           |                             | 5 USC,      | Send OPH    |
|           | \(v\) Consistent with the   | Section     | mental      |
|           | applicable requirements of  | 5           | health      |
|           | § 164.514, creating de-     | 52a.(b)(12) | office for  |
|           | identified health           | to a        | input       |
|           | information, fundraising    | consumer    | regarding   |
|           | for the benefit of the      | reporting   | imp         |
|           | covered entity, and         | agency in   | lementation |
|           | marketing for which an      | accordance  |             |
|           | individual authorization is | with        | Send to OGC |
|           | not required as described   | section     | for legal   |
|           | in § 164.514(e)(2).         | 37119e) of  | review to   |
|           |                             | title 31.   | find out if |
|           | ***Health oversight         |             | this        |
|           | agency*** means an agency   | Not in PA   | definition  |
|           | or authority of the United  |             | includes    |
|           | States, a State, a          | Get the     | I/T/U and   |
|           | territory, a political      | definition! | their       |
|           | subdivision of a State or   |             | employees   |
|           | territory, or an Indian     | Not in PA   |             |
|           | tribe, or a person or       |             | Send to     |
|           | entity acting under a grant | Incl's      | OPH, OTA &  |
|           | of authority from or        | paper       | SG for      |
|           | contract with such public   | records     | input       |
|           | agency, including the       |             | regarding   |
|           | employees or agents of such | ??          | imp         |
|           | public agency or its        |             | lementation |
|           | contractors or persons or   | ??          |             |
|           | entities to whom it has     |             | Send to OGC |
|           | granted authority, that is  | Not in PA   | for legal   |
|           | authorized by law to        | or SOR      | cl          |
|           | oversee the health care     |             | arification |
|           | system (whether public or   | May include |             |
|           | private) or government      | I/T/U &     | Provide     |
|           | programs in which health    | their       | examples,   |
|           | information is necessary to | employees   | clarify,    |
|           | determine eligibility or    |             | effects     |
|           | compliance, or to enforce   | PA, b-11    | I/T/U,      |
|           | civil rights laws for which | exemption   |             |
|           | health information is       | :court of   | Send to OTA |
|           | relevant.                   | competent   | & SG for    |
|           |                             | j           | input       |
|           | ***Indirect treatment       | urisdiction | regarding   |
|           | relationship*** means a     | does not    | imp         |
|           | relationship between an     | include     | lementation |
|           | individual and a health     | tribal      |             |
|           | care provider in which:     | court       | Send to     |
|           |                             | orders      | research    |
|           | \(1\) The health care       |             | office      |
|           | provider delivers health    | PA more     | staff for   |
|           | care to the individual      | restrictive | input       |
|           | based on the orders of      | than HIPAA  | regarding   |
|           | another health care         | rule on the | imp         |
|           | provider; and               | subject of  | lementation |
|           |                             | court       |             |
|           | \(2\) The health care       | orders      | Send to OPH |
|           | provider typically provides |             | for input   |
|           | services or products, or    | Definition  | re:         |
|           | reports the diagnosis or    | not in PA   | imp         |
|           | results associated with the |             | lementation |
|           | health care, directly to    | Definition  |             |
|           | another health care         | not in PA   | Uses made   |
|           | provider, who provides the  |             | within the  |
|           | services or products or     | Definition  | covered     |
|           | reports to the individual.  | not in PA   | entity...   |
|           |                             |             | send to OPH |
|           | ***Individual*** means the  |             | for input   |
|           | person who is the subject   |             | regarding   |
|           | of protected health         |             | imp         |
|           | information.                |             | lementation |
|           |                             |             |             |
|           | ***Individually             |             |             |
|           | identifiable health         |             |             |
|           | information*** is           |             |             |
|           | information that is a       |             |             |
|           | subset of health            |             |             |
|           | information, including      |             |             |
|           | demographic information     |             |             |
|           | collected from an           |             |             |
|           | individual, and:            |             |             |
|           |                             |             |             |
|           | \(1\) Is created or         |             |             |
|           | received by a health care   |             |             |
|           | provider, health plan,      |             |             |
|           | employer, or health care    |             |             |
|           | clearinghouse; and          |             |             |
|           |                             |             |             |
|           | \(2\) Relates to the past,  |             |             |
|           | present, or future physical |             |             |
|           | or mental health or         |             |             |
|           | condition of an individual; |             |             |
|           | the provision of health     |             |             |
|           | care to an individual; or   |             |             |
|           | the past, present, or       |             |             |
|           | future payment for the      |             |             |
|           | provision of health care to |             |             |
|           | an individual; and          |             |             |
|           |                             |             |             |
|           | \(i\) That identifies the   |             |             |
|           | individual; or              |             |             |
|           |                             |             |             |
|           | \(ii\) With respect to      |             |             |
|           | which there is a reasonable |             |             |
|           | basis to believe the        |             |             |
|           | information can be used to  |             |             |
|           | identify the individual.    |             |             |
|           |                             |             |             |
|           | ***Inmate*** means a person |             |             |
|           | incarcerated in or          |             |             |
|           | otherwise confined to a     |             |             |
|           | correctional institution.   |             |             |
|           |                             |             |             |
|           | ***Law enforcement          |             |             |
|           | official*** means an        |             |             |
|           | officer or employee of any  |             |             |
|           | agency or authority of the  |             |             |
|           | United States, a State, a   |             |             |
|           | territory, a political      |             |             |
|           | subdivision of a State or   |             |             |
|           | territory, or an Indian     |             |             |
|           | tribe, who is empowered by  |             |             |
|           | law to:                     |             |             |
|           |                             |             |             |
|           | \(1\) Investigate or        |             |             |
|           | conduct an official inquiry |             |             |
|           | into a potential violation  |             |             |
|           | of law; or                  |             |             |
|           |                             |             |             |
|           | \(2\) Prosecute or          |             |             |
|           | otherwise conduct a         |             |             |
|           | criminal, civil, or         |             |             |
|           | administrative proceeding   |             |             |
|           | arising from an alleged     |             |             |
|           | violation of law.           |             |             |
|           |                             |             |             |
|           | ***Marketing*** means to    |             |             |
|           | make a communication about  |             |             |
|           | a product or service a      |             |             |
|           | purpose of which is to      |             |             |
|           | encourage recipients of the |             |             |
|           | communication to purchase   |             |             |
|           | or use the product or       |             |             |
|           | service.                    |             |             |
|           |                             |             |             |
|           | \(1\) *Marketing* does not  |             |             |
|           | include communications that |             |             |
|           | meet the requirements of    |             |             |
|           | paragraph (2) of this       |             |             |
|           | definition and that are     |             |             |
|           | made by a covered entity:   |             |             |
|           |                             |             |             |
|           | \(i\) For the purpose of    |             |             |
|           | describing the entities     |             |             |
|           | participating in a health   |             |             |
|           | care provider network or    |             |             |
|           | health plan network, or for |             |             |
|           | the purpose of describing   |             |             |
|           | if and the extent to which  |             |             |
|           | a product or service (or    |             |             |
|           | payment for such product or |             |             |
|           | service) is provided by a   |             |             |
|           | covered entity or included  |             |             |
|           | in a plan of benefits; or   |             |             |
|           |                             |             |             |
|           | \(ii\) That are tailored to |             |             |
|           | the circumstances of a      |             |             |
|           | particular individual and   |             |             |
|           | the communications are:     |             |             |
|           |                             |             |             |
|           | \(A\) Made by a health care |             |             |
|           | provider to an individual   |             |             |
|           | as part of the treatment of |             |             |
|           | the individual, and for the |             |             |
|           | purpose of furthering the   |             |             |
|           | treatment of that           |             |             |
|           | individual; or              |             |             |
|           |                             |             |             |
|           | \(B\) Made by a health care |             |             |
|           | provider or health plan to  |             |             |
|           | an individual in the course |             |             |
|           | of managing the treatment   |             |             |
|           | of that individual, or for  |             |             |
|           | the purpose of directing or |             |             |
|           | recommending to that        |             |             |
|           | individual alternative      |             |             |
|           | treatments, therapies,      |             |             |
|           | health care providers, or   |             |             |
|           | settings of care.           |             |             |
|           |                             |             |             |
|           | \(2\) A communication       |             |             |
|           | described in paragraph (1)  |             |             |
|           | of this definition is not   |             |             |
|           | included in marketing if:   |             |             |
|           |                             |             |             |
|           | \(i\) The communication is  |             |             |
|           | made orally; or             |             |             |
|           |                             |             |             |
|           | \(ii\) The communication is |             |             |
|           | in writing and the covered  |             |             |
|           | entity does not receive     |             |             |
|           | direct or indirect          |             |             |
|           | remuneration from a third   |             |             |
|           | party for making the        |             |             |
|           | communication.              |             |             |
|           |                             |             |             |
|           | ***Organized health care    |             |             |
|           | arrangement*** means:       |             |             |
|           |                             |             |             |
|           | \(1\) A clinically          |             |             |
|           | integrated care setting in  |             |             |
|           | which individuals typically |             |             |
|           | receive health care from    |             |             |
|           | more than one health care   |             |             |
|           | provider;                   |             |             |
|           |                             |             |             |
|           | \(2\) An organized system   |             |             |
|           | of health care in which     |             |             |
|           | more than one covered       |             |             |
|           | entity participates, and in |             |             |
|           | which the participating     |             |             |
|           | covered entities:           |             |             |
|           |                             |             |             |
|           | \(i\) Hold themselves out   |             |             |
|           | to the public as            |             |             |
|           | participating in a joint    |             |             |
|           | arrangement; and            |             |             |
|           |                             |             |             |
|           | \(ii\) Participate in joint |             |             |
|           | activities that include at  |             |             |
|           | least one of the following: |             |             |
|           |                             |             |             |
|           | \(A\) Utilization review,   |             |             |
|           | in which health care        |             |             |
|           | decisions by participating  |             |             |
|           | covered entities are        |             |             |
|           | reviewed by other           |             |             |
|           | participating covered       |             |             |
|           | entities or by a third      |             |             |
|           | party on their behalf;      |             |             |
|           |                             |             |             |
|           | \(B\) Quality assessment    |             |             |
|           | and improvement activities, |             |             |
|           | in which treatment provided |             |             |
|           | by participating covered    |             |             |
|           | entities is assessed by     |             |             |
|           | other participating covered |             |             |
|           | entities or by a third      |             |             |
|           | party on their behalf; or   |             |             |
|           |                             |             |             |
|           | \(C\) Payment activities,   |             |             |
|           | if the financial risk for   |             |             |
|           | delivering health care is   |             |             |
|           | shared, in part or in       |             |             |
|           | whole, by participating     |             |             |
|           | covered entities through    |             |             |
|           | the joint arrangement and   |             |             |
|           | if protected health         |             |             |
|           | information created or      |             |             |
|           | received by a covered       |             |             |
|           | entity is reviewed by other |             |             |
|           | participating covered       |             |             |
|           | entities or by a third      |             |             |
|           | party on their behalf for   |             |             |
|           | the purpose of              |             |             |
|           | administering the sharing   |             |             |
|           | of financial risk.          |             |             |
|           |                             |             |             |
|           | \(3\) A group health plan   |             |             |
|           | and a health insurance      |             |             |
|           | issuer or HMO with respect  |             |             |
|           | to such group health plan,  |             |             |
|           | but only with respect to    |             |             |
|           | protected health            |             |             |
|           | information created or      |             |             |
|           | received by such health     |             |             |
|           | insurance issuer or HMO     |             |             |
|           | that relates to individuals |             |             |
|           | who are or who have been    |             |             |
|           | participants or             |             |             |
|           | beneficiaries in such group |             |             |
|           | health plan;                |             |             |
|           |                             |             |             |
|           | \(4\) A group health plan   |             |             |
|           | and one or more other group |             |             |
|           | health plans each of which  |             |             |
|           | are maintained by the same  |             |             |
|           | plan sponsor; or            |             |             |
|           |                             |             |             |
|           | \(5\) The group health      |             |             |
|           | plans described in          |             |             |
|           | paragraph (4) of this       |             |             |
|           | definition and health       |             |             |
|           | insurance issuers or HMOs   |             |             |
|           | with respect to such group  |             |             |
|           | health plans, but only with |             |             |
|           | respect to protected health |             |             |
|           | information created or      |             |             |
|           | received by such health     |             |             |
|           | insurance issuers or HMOs   |             |             |
|           | that relates to individuals |             |             |
|           | who are or have been        |             |             |
|           | participants or             |             |             |
|           | beneficiaries in any of     |             |             |
|           | such group health plans.    |             |             |
|           |                             |             |             |
|           | ***Payment*** means:        |             |             |
|           |                             |             |             |
|           | \(1\) The activities        |             |             |
|           | undertaken by:              |             |             |
|           |                             |             |             |
|           | \(i\) A health plan to      |             |             |
|           | obtain premiums or to       |             |             |
|           | determine or fulfill its    |             |             |
|           | responsibility for coverage |             |             |
|           | and provision of benefits   |             |             |
|           | under the health plan; or   |             |             |
|           |                             |             |             |
|           | \(ii\) A covered health     |             |             |
|           | care provider or health     |             |             |
|           | plan to obtain or provide   |             |             |
|           | reimbursement for the       |             |             |
|           | provision of health care;   |             |             |
|           | and                         |             |             |
|           |                             |             |             |
|           | \(2\) The activities in     |             |             |
|           | paragraph (1) of this       |             |             |
|           | definition relate to the    |             |             |
|           | individual to whom health   |             |             |
|           | care is provided and        |             |             |
|           | include, but are not        |             |             |
|           | limited to:                 |             |             |
|           |                             |             |             |
|           | \(i\) Determinations of     |             |             |
|           | eligibility or coverage     |             |             |
|           | (including coordination of  |             |             |
|           | benefits or the             |             |             |
|           | determination of cost       |             |             |
|           | sharing amounts), and       |             |             |
|           | adjudication or subrogation |             |             |
|           | of health benefit claims;   |             |             |
|           |                             |             |             |
|           | \(ii\) Risk adjusting       |             |             |
|           | amounts due based on        |             |             |
|           | enrollee health status and  |             |             |
|           | demographic                 |             |             |
|           | characteristics;            |             |             |
|           |                             |             |             |
|           | \(iii\) Billing, claims     |             |             |
|           | management, collection      |             |             |
|           | activities, obtaining       |             |             |
|           | payment under a contract    |             |             |
|           | for reinsurance (including  |             |             |
|           | stop-loss insurance and     |             |             |
|           | excess of loss insurance),  |             |             |
|           | and related health care     |             |             |
|           | data processing;            |             |             |
|           |                             |             |             |
|           | \(iv\) Review of health     |             |             |
|           | care services with respect  |             |             |
|           | to medical necessity,       |             |             |
|           | coverage under a health     |             |             |
|           | plan, appropriateness of    |             |             |
|           | care, or justification of   |             |             |
|           | charges;                    |             |             |
|           |                             |             |             |
|           | \(v\) Utilization review    |             |             |
|           | activities, including       |             |             |
|           | pre-certification and       |             |             |
|           | preauthorization of         |             |             |
|           | services, concurrent and    |             |             |
|           | retrospective review of     |             |             |
|           | services; and               |             |             |
|           |                             |             |             |
|           | \(vi\) Disclosure to        |             |             |
|           | consumer reporting agencies |             |             |
|           | of any of the following     |             |             |
|           | protected health            |             |             |
|           | information relating to     |             |             |
|           | collection of premiums or   |             |             |
|           | reimbursement:              |             |             |
|           |                             |             |             |
|           | \(A\) Name and address;     |             |             |
|           |                             |             |             |
|           | \(B\) Date of birth;        |             |             |
|           |                             |             |             |
|           | \(C\) Social security       |             |             |
|           | number;                     |             |             |
|           |                             |             |             |
|           | \(D\) Payment history;      |             |             |
|           |                             |             |             |
|           | \(E\) Account number; and   |             |             |
|           |                             |             |             |
|           | \(F\) Name and address of   |             |             |
|           | the health care provider    |             |             |
|           | and/or health plan.         |             |             |
|           |                             |             |             |
|           | ***Plan sponsor*** is       |             |             |
|           | defined as defined at       |             |             |
|           | section 3(16)(B) of ERISA,  |             |             |
|           | 29 U.S.C. 1002(16)(B).      |             |             |
|           |                             |             |             |
|           | ***Protected health         |             |             |
|           | information*** means        |             |             |
|           | individually identifiable   |             |             |
|           | health information:         |             |             |
|           |                             |             |             |
|           | \(1\) Except as provided in |             |             |
|           | paragraph (2) of this       |             |             |
|           | definition, that is:        |             |             |
|           |                             |             |             |
|           | \(i\) Transmitted by        |             |             |
|           | electronic media;           |             |             |
|           |                             |             |             |
|           | \(ii\) Maintained in any    |             |             |
|           | medium described in the     |             |             |
|           | definition of *electronic   |             |             |
|           | media* at § 162.103 of this |             |             |
|           | subchapter; or              |             |             |
|           |                             |             |             |
|           | \(iii\) Transmitted or      |             |             |
|           | maintained in any other     |             |             |
|           | form or medium.             |             |             |
|           |                             |             |             |
|           | \(2\) *Protected health     |             |             |
|           | information* excludes       |             |             |
|           | individually identifiable   |             |             |
|           | health information in:      |             |             |
|           |                             |             |             |
|           | \(i\) Education records     |             |             |
|           | covered by the Family       |             |             |
|           | Educational Right and       |             |             |
|           | Privacy Act, as amended, 20 |             |             |
|           | U.S.C. 1232g; and           |             |             |
|           |                             |             |             |
|           | \(ii\) Records described at |             |             |
|           | 20 U.S.C.                   |             |             |
|           | 1232g(a)(4)(B)(iv).         |             |             |
|           |                             |             |             |
|           | ***Psychotherapy notes***   |             |             |
|           | means notes recorded (in    |             |             |
|           | any medium) by a health     |             |             |
|           | care provider who is a      |             |             |
|           | mental health professional  |             |             |
|           | documenting or analyzing    |             |             |
|           | the contents of             |             |             |
|           | conversation during a       |             |             |
|           | private counseling session  |             |             |
|           | or a group, joint, or       |             |             |
|           | family counseling session   |             |             |
|           | and that are separated from |             |             |
|           | the rest of the             |             |             |
|           | individual's medical        |             |             |
|           | record. *Psychotherapy      |             |             |
|           | notes* excludes medication  |             |             |
|           | prescription and            |             |             |
|           | monitoring, counseling      |             |             |
|           | session start and stop      |             |             |
|           | times, the modalities and   |             |             |
|           | frequencies of treatment    |             |             |
|           | furnished, results of       |             |             |
|           | clinical tests, and any     |             |             |
|           | summary of the following    |             |             |
|           | items: diagnosis,           |             |             |
|           | functional status, the      |             |             |
|           | treatment plan, symptoms,   |             |             |
|           | prognosis, and progress to  |             |             |
|           | date.                       |             |             |
|           |                             |             |             |
|           | ***Public health            |             |             |
|           | authority*** means an       |             |             |
|           | agency or authority of the  |             |             |
|           | United States, a State, a   |             |             |
|           | territory, a political      |             |             |
|           | subdivision of a State or   |             |             |
|           | territory, or an Indian     |             |             |
|           | tribe, or a person or       |             |             |
|           | entity acting under a grant |             |             |
|           | of authority from or        |             |             |
|           | contract with such public   |             |             |
|           | agency, including the       |             |             |
|           | employees or agents of such |             |             |
|           | public agency or its        |             |             |
|           | contractors or persons or   |             |             |
|           | entities to whom it has     |             |             |
|           | granted authority, that is  |             |             |
|           | responsible for public      |             |             |
|           | health matters as part of   |             |             |
|           | its official mandate.       |             |             |
|           |                             |             |             |
|           | ***Required by law*** means |             |             |
|           | a mandate contained in law  |             |             |
|           | that compels a covered      |             |             |
|           | entity to make a use or     |             |             |
|           | disclosure of protected     |             |             |
|           | health information and that |             |             |
|           | is enforceable in a court   |             |             |
|           | of law. *Required by law*   |             |             |
|           | includes, but is not        |             |             |
|           | limited to, court orders    |             |             |
|           | and court- ordered          |             |             |
|           | warrants; subpoenas or      |             |             |
|           | summons issued by a court,  |             |             |
|           | grand jury, a governmental  |             |             |
|           | or tribal inspector         |             |             |
|           | general, or an              |             |             |
|           | administrative body         |             |             |
|           | authorized to require the   |             |             |
|           | production of information;  |             |             |
|           | a civil or an authorized    |             |             |
|           | investigative demand;       |             |             |
|           | Medicare conditions of      |             |             |
|           | participation with respect  |             |             |
|           | to health care providers    |             |             |
|           | participating in the        |             |             |
|           | program; and statutes or    |             |             |
|           | regulations that require    |             |             |
|           | the production of           |             |             |
|           | information, including      |             |             |
|           | statutes or regulations     |             |             |
|           | that require such           |             |             |
|           | information if payment is   |             |             |
|           | sought under a government   |             |             |
|           | program providing public    |             |             |
|           | benefits.                   |             |             |
|           |                             |             |             |
|           | ***Research*** means a      |             |             |
|           | systematic investigation,   |             |             |
|           | including research          |             |             |
|           | development, testing, and   |             |             |
|           | evaluation, designed to     |             |             |
|           | develop or contribute to    |             |             |
|           | generalizable knowledge.    |             |             |
|           |                             |             |             |
|           | ***Treatment*** means the   |             |             |
|           | provision, coordination, or |             |             |
|           | management of health care   |             |             |
|           | and related services by one |             |             |
|           | or more health care         |             |             |
|           | providers, including the    |             |             |
|           | coordination or management  |             |             |
|           | of health care by a health  |             |             |
|           | care provider with a third  |             |             |
|           | party; consultation between |             |             |
|           | health care providers       |             |             |
|           | relating to a patient; or   |             |             |
|           | the referral of a patient   |             |             |
|           | for health care from one    |             |             |
|           | health care provider to     |             |             |
|           | another.                    |             |             |
|           |                             |             |             |
|           | ***Use*** means, with       |             |             |
|           | respect to individually     |             |             |
|           | identifiable health         |             |             |
|           | information, the sharing,   |             |             |
|           | employment, application,    |             |             |
|           | utilization, examination,   |             |             |
|           | or analysis of such         |             |             |
|           | information within an       |             |             |
|           | entity that maintains such  |             |             |
|           | information.                |             |             |
+-----------+-----------------------------+-------------+-------------+
| [§        | \(a\)                       | 5 USC 552a; | Update SOR  |
| 164.502   | [Standard.]{.underline} A   | 45 CFR 5b.; | and/or      |
| Uses and  | covered entity may not use  | IHS SOR     | policy.     |
| di        | or disclose protected       | 09-17-0001. | Have work   |
| sclosures | health information, except  |             | group       |
| of        | as permitted or required by | 5 USC 552a; | consisting  |
| protected | this subpart or by subpart  | 45 CFR 5b.; | of          |
| health    | C of part 160 of this       | IHS SOR     | appropriate |
| inf       | subchapter.                 | 09-17-0001  | staff       |
| ormation: |                             |             | develop the |
| general   | \(1\) [Permitted uses and   | 5 USC       | policy and  |
| rules]    | disclosures.]{.underline} A | 552a(d); 45 | procedure   |
| (../HIPAA | covered entity is permitted | CFR 5b.;    |             |
| %20Privac | to use or disclose          | IHS SOR     | (OPH,       |
| y%20Rule. | protected health            | 09-17-0001. | medical     |
| doc#_Hlk5 | information as follows:     |             | staff, med  |
| 16629277) |                             | Not covered | records,    |
|           | \(i\) To the individual;    | in PA.      | privacy,    |
|           |                             |             | etc)        |
|           | \(ii\) Pursuant to and in   | PA language |             |
|           | compliance with a consent   | similar to  | Update SOR  |
|           | that complies with §        |             | and/or      |
|           | 164.506, to carry out       | "need to    | policy.     |
|           | treatment, payment, or      | know"       | Have work   |
|           | health care operations;     | provision.  | group       |
|           |                             |             | consisting  |
|           | \(iii\) Without consent, if | Does the    | of          |
|           | consent is not required     | option for  | appropriate |
|           | under § 164.506(a) and has  | a           | staff       |
|           | not been sought under §     | restriction | develop the |
|           | 164.506(a)(4), to carry out | have to be  | policy and  |
|           | treatment, payment, or      | provided?   | procedure   |
|           | health care operations,     |             |             |
|           | except with respect to      | Not in the  | (OPH,       |
|           | psychotherapy notes;        | PA          | medical     |
|           |                             | definition. | staff, med  |
|           | \(iv\) Pursuant to and in   |             | records,    |
|           | compliance with an          | Not covered | privacy,    |
|           | authorization that complies | in PA.      | etc)        |
|           | with § 164.508;             |             |             |
|           |                             | HIPAA       | Update SOR  |
|           | \(v\) Pursuant to an        | 160.103 for | and/or      |
|           | agreement under, or as      | definition. | policy.     |
|           | otherwise permitted by, §   |             |             |
|           | 164.510; and                | Written     | Have        |
|           |                             | assurance?  | workgroup   |
|           | \(vi\) As permitted by and  |             | consisting  |
|           | in compliance with this     | IHS is a    | of          |
|           | section, § 164.512, or §    | health plan | appropriate |
|           | 164.514(e), (f), and (g).   | 160.103.    | staff       |
|           |                             |             | developing  |
|           | \(2\) [Required             | Assurance   | the policy  |
|           | disclosures.]{.underline} A | must be     | and         |
|           | covered entity is required  | written     | procedure   |
|           | to disclose protected       |             | for         |
|           | health information:         | Not covered | imple       |
|           |                             | in PA, HHS, | menta-tion. |
|           | \(i\) To an individual,     | or IHS.     | (OPH,       |
|           | when requested under, and   |             | medical     |
|           | as required by §§ 164.524   | 5 USC 552a; | staff,      |
|           | or 164.528; and             | 45 CFR      | medical     |
|           |                             | 5b          | records,    |
|           | \(ii\) When required by the | .5(b)(iii); | privacy,    |
|           | Secretary under subpart C   | 5b.6(ii);   | etc.)       |
|           | of part 160 of this         | and 5b.10;  |             |
|           | subchapter to investigate   | IHS SOR     | Have        |
|           | or determine the covered    | 09-17-0001. | workgroup   |
|           | entity\'s compliance with   |             | consisting  |
|           | this subpart.               | IHS SOR     | of          |
|           |                             | 09-17-0001  | appropriate |
|           | \(b\) [Standard: minimum    | under       | staff       |
|           | necessary.]{.underline}     | routine     | developing  |
|           |                             | uses        | the policy  |
|           | \(1\) [Minimum necessary    |             | and         |
|           | applies.]{.underline} When  | Not covered | procedure   |
|           | using or disclosing         | in PA, HHS, | for         |
|           | protected health            | or IHS.     | imple       |
|           | information or when         |             | menta-tion. |
|           | requesting protected health | Not covered | (OPH,       |
|           | information from another    | in PA, HHS, | medical     |
|           | covered entity, a covered   | or IHS.     | staff,      |
|           | entity must make reasonable |             | medical     |
|           | efforts to limit protected  | HIPAA rule  | records,    |
|           | health information to the   | applies to  | privacy,    |
|           | minimum necessary to        | all forms   | etc.)       |
|           | accomplish the intended     | of          |             |
|           | purpose of the use,         | co          | Have        |
|           | disclosure, or request.     | mmunication | workgroup   |
|           |                             | including   | consisting  |
|           | \(2\) [Minimum necessary    | oral.       | of          |
|           | does not                    |             | appropriate |
|           | apply.]{.underline} This    | Rule        | staff       |
|           | requirement does not apply  | eliminates  | develop the |
|           | to:                         | nexus to    | policy and  |
|           |                             | electronic  | procedure.  |
|           | \(i\) Disclosures to or     | i           | (Research,  |
|           | requests by a health care   | nformation; | statistics, |
|           | provider for treatment;     | all         | privacy     |
|           |                             | i           | staff,      |
|           | \(ii\) Uses or disclosures  | ndividually | etc.)       |
|           | made to the individual, as  | i           |             |
|           | permitted under paragraph   | dentifiable | Have        |
|           | (a)(1)(i) of this section,  | health info | workgroup   |
|           | as required by paragraph    | of the      | consisting  |
|           | (a)(2)(i) of this section,  | covered     | of          |
|           | or pursuant to an           | entity is   | appropriate |
|           | authorization under §       | covered by  | staff       |
|           | 164.508, except for         | the Rule.   | develop the |
|           | authorizations requested by |             | policy and  |
|           | the covered entity under §  | Not covered | procedure.  |
|           | 164.508(d), (e), or (f);    | in PA, HHS, | (OPH,       |
|           |                             | or IHS.     | business    |
|           | \(iii\) Disclosures made to |             | office,     |
|           | the Secretary in accordance |             | contract,   |
|           | with subpart C of part 160  |             | medical     |
|           | of this subchapter;         |             | records,    |
|           |                             |             | privacy     |
|           | \(iv\) Uses or disclosures  |             | staff,      |
|           | that are required by law,   |             | etc.)       |
|           | as described by §           |             |             |
|           | 164.512(a); and             |             | Have        |
|           |                             |             | workgroup   |
|           | \(v\) Uses or disclosures   |             | consisting  |
|           | that are required for       |             | of          |
|           | compliance with applicable  |             | appropriate |
|           | requirements of this        |             | staff       |
|           | subchapter.                 |             | develop the |
|           |                             |             | policy and  |
|           | \(c\) [Standard: uses and   |             | procedure   |
|           | disclosures of protected    |             | to          |
|           | health information subject  |             | implement.  |
|           | to an agreed upon           |             |             |
|           | restriction.]{.underline} A |             | (OPH,       |
|           | covered entity that has     |             | medical,    |
|           | agreed to a restriction     |             | business    |
|           | pursuant to § 164.522(a)(1) |             | office,     |
|           | may not use or disclose the |             | CHS,        |
|           | protected health            |             | medical     |
|           | information covered by the  |             | records,    |
|           | restriction in violation of |             | privacy     |
|           | such restriction, except as |             | staff,      |
|           | otherwise provided in §     |             | etc.)       |
|           | 164.522(a).                 |             |             |
|           |                             |             | Have        |
|           | **(d)** [Standard: uses and |             | workgroup   |
|           | disclosures of              |             | consisting  |
|           | de-identified protected     |             | of          |
|           | health                      |             | appropriate |
|           | information.]{.underline}   |             | staff       |
|           |                             |             | develop the |
|           | \(1\) [Uses and disclosures |             | policy and  |
|           | to create de-identified     |             | procedure   |
|           | information.]{.underline} A |             | to          |
|           | covered entity may use      |             | implement   |
|           | protected health            |             |             |
|           | information to create       |             | Have        |
|           | information that is not     |             | workgroup   |
|           | individually identifiable   |             | consisting  |
|           | health information or       |             | of          |
|           | disclose protected health   |             | appropriate |
|           | information only to a       |             | staff       |
|           | business associate for such |             | develop the |
|           | purpose, whether or not the |             | policy and  |
|           | de-identified information   |             | procedure   |
|           | is to be used by the        |             | to          |
|           | covered entity.             |             | implement   |
|           |                             |             |             |
|           | \(2\) [Uses and disclosures |             |             |
|           | of de-identified            |             |             |
|           | information.]{.underline}   |             |             |
|           | Health information that     |             |             |
|           | meets the standard and      |             |             |
|           | implementation              |             |             |
|           | specifications for          |             |             |
|           | de-identification under §   |             |             |
|           | 164.514(a) and (b) is       |             |             |
|           | considered not to be        |             |             |
|           | individually identifiable   |             |             |
|           | health information, i.e.,   |             |             |
|           | de-identified. The          |             |             |
|           | requirements of this        |             |             |
|           | subpart do not apply to     |             |             |
|           | information that has been   |             |             |
|           | de-identified in accordance |             |             |
|           | with the applicable         |             |             |
|           | requirements of § 164.514,  |             |             |
|           | provided that:              |             |             |
|           |                             |             |             |
|           | \(i\) Disclosure of a code  |             |             |
|           | or other means of record    |             |             |
|           | identification designed to  |             |             |
|           | enable coded or otherwise   |             |             |
|           | de-identified information   |             |             |
|           | to be re-identified         |             |             |
|           | constitutes disclosure of   |             |             |
|           | protected health            |             |             |
|           | information; and            |             |             |
|           |                             |             |             |
|           | \(ii\) If de-identified     |             |             |
|           | information is              |             |             |
|           | re-identified, a covered    |             |             |
|           | entity may use or disclose  |             |             |
|           | such re-identified          |             |             |
|           | information only as         |             |             |
|           | permitted or required by    |             |             |
|           | this subpart.               |             |             |
|           |                             |             |             |
|           | **(e)(1)** [Standard:       |             |             |
|           | disclosures to business     |             |             |
|           | associates.]{.underline}    |             |             |
|           |                             |             |             |
|           | \(i\) A covered entity may  |             |             |
|           | disclose protected health   |             |             |
|           | information to a business   |             |             |
|           | associate and may allow a   |             |             |
|           | business associate to       |             |             |
|           | create or receive protected |             |             |
|           | health information on its   |             |             |
|           | behalf, if the covered      |             |             |
|           | entity obtains satisfactory |             |             |
|           | assurance that the business |             |             |
|           | associate will              |             |             |
|           | appropriately safeguard the |             |             |
|           | information.                |             |             |
|           |                             |             |             |
|           | \(ii\) This standard does   |             |             |
|           | not apply:                  |             |             |
|           |                             |             |             |
|           | \(A\) With respect to       |             |             |
|           | disclosures by a covered    |             |             |
|           | entity to a health care     |             |             |
|           | provider concerning the     |             |             |
|           | treatment of the            |             |             |
|           | individual;                 |             |             |
|           |                             |             |             |
|           | \(B\) With respect to       |             |             |
|           | disclosures by a group      |             |             |
|           | health plan or a health     |             |             |
|           | insurance issuer or HMO     |             |             |
|           | with respect to a group     |             |             |
|           | health plan to the plan     |             |             |
|           | sponsor, to the extent that |             |             |
|           | the requirements of §       |             |             |
|           | 164.504(f) apply and are    |             |             |
|           | met; or                     |             |             |
|           |                             |             |             |
|           | \(C\) With respect to uses  |             |             |
|           | or disclosures by a health  |             |             |
|           | plan that is a government   |             |             |
|           | program providing public    |             |             |
|           | benefits, if eligibility    |             |             |
|           | for, or enrollment in, the  |             |             |
|           | health plan is determined   |             |             |
|           | by an agency other than the |             |             |
|           | agency administering the    |             |             |
|           | health plan, or if the      |             |             |
|           | protected health            |             |             |
|           | information used to         |             |             |
|           | determine enrollment or     |             |             |
|           | eligibility in the health   |             |             |
|           | plan is collected by an     |             |             |
|           | agency other than the       |             |             |
|           | agency administering the    |             |             |
|           | health plan, and such       |             |             |
|           | activity is authorized by   |             |             |
|           | law, with respect to the    |             |             |
|           | collection and sharing of   |             |             |
|           | individually identifiable   |             |             |
|           | health information for the  |             |             |
|           | performance of such         |             |             |
|           | functions by the health     |             |             |
|           | plan and the agency other   |             |             |
|           | than the agency             |             |             |
|           | administering the health    |             |             |
|           | plan.                       |             |             |
|           |                             |             |             |
|           | \(iii\) A covered entity    |             |             |
|           | that violates the           |             |             |
|           | satisfactory assurances it  |             |             |
|           | provided as a business      |             |             |
|           | associate of another        |             |             |
|           | covered entity will be in   |             |             |
|           | noncompliance with the      |             |             |
|           | standards, implementation   |             |             |
|           | specifications, and         |             |             |
|           | requirements of this        |             |             |
|           | paragraph and § 164.504(e). |             |             |
|           |                             |             |             |
|           | \(2\) [Implementation       |             |             |
|           | specification:              |             |             |
|           | documentation.]{.underline} |             |             |
|           | A covered entity must       |             |             |
|           | document the satisfactory   |             |             |
|           | assurances required by      |             |             |
|           | paragraph (e)(1) of this    |             |             |
|           | section through a written   |             |             |
|           | contract or other written   |             |             |
|           | agreement or arrangement    |             |             |
|           | with the business associate |             |             |
|           | that meets the applicable   |             |             |
|           | requirements of             |             |             |
|           | §164.504(e).                |             |             |
|           |                             |             |             |
|           | \(f\) [Standard: deceased   |             |             |
|           | individuals.]{.underline} A |             |             |
|           | covered entity must comply  |             |             |
|           | with the requirements of    |             |             |
|           | this subpart with respect   |             |             |
|           | to the protected health     |             |             |
|           | information of a deceased   |             |             |
|           | individual.                 |             |             |
|           |                             |             |             |
|           | (g)(1) [Standard: personal  |             |             |
|           | re                          |             |             |
|           | presentatives.]{.underline} |             |             |
|           | As specified in this        |             |             |
|           | paragraph, a covered entity |             |             |
|           | must, except as provided in |             |             |
|           | paragraphs (g)(3) and       |             |             |
|           | (g)(5) of this section,     |             |             |
|           | treat a personal            |             |             |
|           | representative as the       |             |             |
|           | individual for purposes of  |             |             |
|           | this subchapter.            |             |             |
|           |                             |             |             |
|           | \(2\) [Implementation       |             |             |
|           | specification: adults and   |             |             |
|           | emancipated                 |             |             |
|           | minors.]{.underline} If     |             |             |
|           | under applicable law a      |             |             |
|           | person has authority to act |             |             |
|           | on behalf of an individual  |             |             |
|           | who is an adult or an       |             |             |
|           | emancipated minor in making |             |             |
|           | decisions related to health |             |             |
|           | care, a covered entity must |             |             |
|           | treat such person as a      |             |             |
|           | personal representative     |             |             |
|           | under this subchapter, with |             |             |
|           | respect to protected health |             |             |
|           | information relevant to     |             |             |
|           | such personal               |             |             |
|           | representation.             |             |             |
|           |                             |             |             |
|           | \(3\) [Implementation       |             |             |
|           | specification:              |             |             |
|           | unemancipated               |             |             |
|           | minors.]{.underline} If     |             |             |
|           | under applicable law a      |             |             |
|           | parent, guardian, or other  |             |             |
|           | person acting *in loco      |             |             |
|           | parentis* has authority to  |             |             |
|           | act on behalf of an         |             |             |
|           | individual who is an        |             |             |
|           | unemancipated minor in      |             |             |
|           | making decisions related to |             |             |
|           | health care, a covered      |             |             |
|           | entity must treat such      |             |             |
|           | person as a personal        |             |             |
|           | representative under this   |             |             |
|           | subchapter, with respect to |             |             |
|           | protected health            |             |             |
|           | information relevant to     |             |             |
|           | such personal               |             |             |
|           | representation, except that |             |             |
|           | such person may not be a    |             |             |
|           | personal representative of  |             |             |
|           | an unemancipated minor, and |             |             |
|           | the minor has the authority |             |             |
|           | to act as an individual,    |             |             |
|           | with respect to protected   |             |             |
|           | health information          |             |             |
|           | pertaining to a health care |             |             |
|           | service, if:                |             |             |
|           |                             |             |             |
|           | \(i\) The minor consents to |             |             |
|           | such health care service;   |             |             |
|           | no other consent to such    |             |             |
|           | health care service is      |             |             |
|           | required by law, regardless |             |             |
|           | of whether the consent of   |             |             |
|           | another person has also     |             |             |
|           | been obtained; and the      |             |             |
|           | minor has not requested     |             |             |
|           | that such person be treated |             |             |
|           | as the personal             |             |             |
|           | representative;             |             |             |
|           |                             |             |             |
|           | \(ii\) The minor may        |             |             |
|           | lawfully obtain such health |             |             |
|           | care service without the    |             |             |
|           | consent of a parent,        |             |             |
|           | guardian, or other person   |             |             |
|           | acting *in loco parentis*,  |             |             |
|           | and the minor, a court, or  |             |             |
|           | another person authorized   |             |             |
|           | by law consents to such     |             |             |
|           | health care service; or     |             |             |
|           |                             |             |             |
|           | \(iii\) A parent, guardian, |             |             |
|           | or other person acting *in  |             |             |
|           | loco parentis* assents to   |             |             |
|           | an agreement of             |             |             |
|           | confidentiality between a   |             |             |
|           | covered health care         |             |             |
|           | provider and the minor with |             |             |
|           | respect to such health care |             |             |
|           | service.                    |             |             |
|           |                             |             |             |
|           | \(4\) [Implementation       |             |             |
|           | specification: deceased     |             |             |
|           | individuals.]{.underline}   |             |             |
|           | If under applicable law an  |             |             |
|           | executor, administrator, or |             |             |
|           | other person has authority  |             |             |
|           | to act on behalf of a       |             |             |
|           | deceased individual or of   |             |             |
|           | the individual\'s estate, a |             |             |
|           | covered entity must treat   |             |             |
|           | such person as a personal   |             |             |
|           | representative under this   |             |             |
|           | subchapter, with respect to |             |             |
|           | protected health            |             |             |
|           | information relevant to     |             |             |
|           | such personal               |             |             |
|           | representation.             |             |             |
|           |                             |             |             |
|           | \(5\) [Implementation       |             |             |
|           | specification: abuse,       |             |             |
|           | neglect, endangerment       |             |             |
|           | situations.]{.underline}    |             |             |
|           | Notwithstanding a State law |             |             |
|           | or any requirement of this  |             |             |
|           | paragraph to the contrary,  |             |             |
|           | a covered entity may elect  |             |             |
|           | not to treat a person as    |             |             |
|           | the personal representative |             |             |
|           | of an individual if:        |             |             |
|           |                             |             |             |
|           | \(i\) The covered entity    |             |             |
|           | has a reasonable belief     |             |             |
|           | that:                       |             |             |
|           |                             |             |             |
|           | \(A\) The individual has    |             |             |
|           | been or may be subjected to |             |             |
|           | domestic violence, abuse,   |             |             |
|           | or neglect by such person;  |             |             |
|           | or                          |             |             |
|           |                             |             |             |
|           | \(B\) Treating such person  |             |             |
|           | as the personal             |             |             |
|           | representative could        |             |             |
|           | endanger the individual;    |             |             |
|           | and                         |             |             |
|           |                             |             |             |
|           | \(ii\) The covered entity,  |             |             |
|           | in the exercise of          |             |             |
|           | professional judgment,      |             |             |
|           | decides that it is not in   |             |             |
|           | the best interest of the    |             |             |
|           | individual to treat the     |             |             |
|           | person as the individual's  |             |             |
|           | personal representative.    |             |             |
|           |                             |             |             |
|           | \(h\) [Standard:            |             |             |
|           | confidential                |             |             |
|           | c                           |             |             |
|           | ommunications.]{.underline} |             |             |
|           | A covered health care       |             |             |
|           | provider or health plan     |             |             |
|           | must comply with the        |             |             |
|           | applicable requirements of  |             |             |
|           | § 164.522(b) in             |             |             |
|           | communicating protected     |             |             |
|           | health information.         |             |             |
|           |                             |             |             |
|           | \(i\) [Standard: uses and   |             |             |
|           | disclosures consistent with |             |             |
|           | notice.]{.underline} A      |             |             |
|           | covered entity that is      |             |             |
|           | required by § 164.520 to    |             |             |
|           | have a notice may not use   |             |             |
|           | or disclose protected       |             |             |
|           | health information in a     |             |             |
|           | manner inconsistent with    |             |             |
|           | such notice. A covered      |             |             |
|           | entity that is required by  |             |             |
|           | § 164.520(b)(1)(iii) to     |             |             |
|           | include a specific          |             |             |
|           | statement in its notice if  |             |             |
|           | it intends to engage in an  |             |             |
|           | activity listed in §        |             |             |
|           | 164.520(b)(1)(iii)(A)-(C),  |             |             |
|           | may not use or disclose     |             |             |
|           | protected health            |             |             |
|           | information for such        |             |             |
|           | activities, unless the      |             |             |
|           | required statement is       |             |             |
|           | included in the notice.     |             |             |
|           |                             |             |             |
|           | \(j\) [Standard:            |             |             |
|           | disclosures by              |             |             |
|           | whistleblowers and          |             |             |
|           | workforce member crime      |             |             |
|           | victims.]{.underline}       |             |             |
|           |                             |             |             |
|           | \(1\) [Disclosures by       |             |             |
|           | w                           |             |             |
|           | histleblowers.]{.underline} |             |             |
|           | A covered entity is not     |             |             |
|           | considered to have violated |             |             |
|           | the requirements of this    |             |             |
|           | subpart if a member of its  |             |             |
|           | workforce or a business     |             |             |
|           | associate discloses         |             |             |
|           | protected health            |             |             |
|           | information, provided that: |             |             |
|           |                             |             |             |
|           | \(i\) The workforce member  |             |             |
|           | or business associate       |             |             |
|           | believes in good faith that |             |             |
|           | the covered entity has      |             |             |
|           | engaged in conduct that is  |             |             |
|           | unlawful or otherwise       |             |             |
|           | violates professional or    |             |             |
|           | clinical standards, or that |             |             |
|           | the care, services, or      |             |             |
|           | conditions provided by the  |             |             |
|           | covered entity potentially  |             |             |
|           | endangers one or more       |             |             |
|           | patients, workers, or the   |             |             |
|           | public; and                 |             |             |
|           |                             |             |             |
|           | \(ii\) The disclosure is    |             |             |
|           | to:                         |             |             |
|           |                             |             |             |
|           | \(A\) A health oversight    |             |             |
|           | agency or public health     |             |             |
|           | authority authorized by law |             |             |
|           | to investigate or otherwise |             |             |
|           | oversee the relevant        |             |             |
|           | conduct or conditions of    |             |             |
|           | the covered entity or to an |             |             |
|           | appropriate health care     |             |             |
|           | accreditation organization  |             |             |
|           | for the purpose of          |             |             |
|           | reporting the allegation of |             |             |
|           | failure to meet             |             |             |
|           | professional standards or   |             |             |
|           | misconduct by the covered   |             |             |
|           | entity; or                  |             |             |
|           |                             |             |             |
|           | \(B\) An attorney retained  |             |             |
|           | by or on behalf of the      |             |             |
|           | workforce member or         |             |             |
|           | business associate for the  |             |             |
|           | purpose of determining the  |             |             |
|           | legal options of the        |             |             |
|           | workforce member or         |             |             |
|           | business associate with     |             |             |
|           | regard to the conduct       |             |             |
|           | described in paragraph      |             |             |
|           | (j)(1)(i) of this section.  |             |             |
|           |                             |             |             |
|           | \(2\) [Disclosures by       |             |             |
|           | workforce members who are   |             |             |
|           | victims of a                |             |             |
|           | crime.]{.underline} A       |             |             |
|           | covered entity is not       |             |             |
|           | considered to have violated |             |             |
|           | the requirements of this    |             |             |
|           | subpart if a member of its  |             |             |
|           | workforce who is the victim |             |             |
|           | of a criminal act discloses |             |             |
|           | protected health            |             |             |
|           | information to a law        |             |             |
|           | enforcement official,       |             |             |
|           | provided that:              |             |             |
|           |                             |             |             |
|           | \(i\) The protected health  |             |             |
|           | information disclosed is    |             |             |
|           | about the suspected         |             |             |
|           | perpetrator of the criminal |             |             |
|           | act; and                    |             |             |
|           |                             |             |             |
|           | \(ii\) The protected health |             |             |
|           | information disclosed is    |             |             |
|           | limited to the information  |             |             |
|           | listed in §                 |             |             |
|           | 164.512(f)(2)(i).           |             |             |
+-----------+-----------------------------+-------------+-------------+
| [**§      | **(a)**                     | This        | May require |
| 164.504   | [Definitions.]{.underline}  | section     | legal       |
| Uses and  | As used in this section:    | applies to  | review from |
| dis       |                             | IHS.        | OGC to      |
| closures: | *Common control* exists if  |             | determine   |
| organ     | an entity has the power,    | IHS may     | if this     |
| izational | directly or indirectly,     | want to     | applies.    |
| requir    | significantly to influence  | consider    | Also IHS    |
| ements**] | or direct the actions or    | being       | and 638     |
| (../HIPAA | policies of another entity. | designated  | facilities  |
| %20Privac |                             | as a single | may be      |
| y%20Rule. | *Common ownership* exists   | affiliated  | construed   |
| doc#_Hlk5 | if an entity or entities    | covered     | as common   |
| 16629339) | possess an ownership or     | entity.     | control.    |
|           | equity interest of 5        |             |             |
|           | percent or more in another  | All         | Have        |
|           | entity.                     | affiliated  | workgroup   |
|           |                             | covered     | consisting  |
|           | *Health care component* has | entities    | of          |
|           | the following meaning:      | must        | appropriate |
|           |                             | comply.     | staff to    |
|           | \(1\) Components of a       |             | develop the |
|           | covered entity that perform | Not covered | policy and  |
|           | covered functions are part  | in PA, HHS, | procedure   |
|           | of the health care          | or IHS.     | to          |
|           | component.                  |             | implement.  |
|           |                             | Business    |             |
|           | \(2\) Another component of  | associate   | Determine   |
|           | the covered entity is part  | contract    | whether     |
|           | of the entity's health care | establishes | this        |
|           | component to the extent     | the         | applies to  |
|           | that:                       | permitted   | IHS,        |
|           |                             | and         | require OGC |
|           | \(i\) It performs, with     | required    | legal       |
|           | respect to a component that | uses and    | review.     |
|           | performs covered functions, | d           |             |
|           | activities that would make  | isclosures. | Have        |
|           | such other component a      |             | workgroup   |
|           | business associate of the   | Data        | consisting  |
|           | component that performs     | aggregation | of          |
|           | covered functions if the    | must be in  | appropriate |
|           | two components were         | the         | staff       |
|           | separate legal entities;    | contract.   | develop the |
|           | and                         |             | policy and  |
|           |                             | Business    | procedure   |
|           | \(ii\) The activities       | associates  | to          |
|           | involve the use or          | of business | implement.  |
|           | disclosure of protected     | associate   |             |
|           | health information that     | must agree  | Have        |
|           | such other component        | to same     | workgroup   |
|           | creates or receives from or | r           | consisting  |
|           | on behalf of the component  | estrictions | of          |
|           | that performs covered       | and         | appropriate |
|           | functions.                  | conditions  | staff       |
|           |                             | that apply  | develop the |
|           | *Hybrid entity* means a     | to the      | written     |
|           | single legal entity that is | business    | business    |
|           | a covered entity and whose  | associate.  | associate   |
|           | covered functions are not   |             | contracts   |
|           | its primary functions.      | State in    | and the     |
|           |                             | contract    | policy and  |
|           | *Plan administration        | that        | procedure   |
|           | functions* means            | business    | to          |
|           | administration functions    | associate   | implement.  |
|           | performed by the plan       | must return | (OPH,       |
|           | sponsor of a group health   | or destroy  | business    |
|           | plan on behalf of the group | phi.        | office,     |
|           | health plan and excludes    |             | CHS,        |
|           | functions performed by the  | Covered     | contract,   |
|           | plan sponsor in connection  | entity can  | privacy     |
|           | with any other benefit or   | terminate   | staff,      |
|           | benefit plan of the plan    | contract if | etc.)       |
|           | sponsor.                    | business    |             |
|           |                             | associate   | Legal       |
|           | *Summary health             | is          | review by   |
|           | information* means          | determined  | OGC to      |
|           | information, that may be    | to be in    | determine   |
|           | individually identifiable   | violation.  | if this     |
|           | health information, and:    |             | applies to  |
|           |                             | Provide     | IHS.        |
|           | \(1\) That summarizes the   | example     |             |
|           | claims history, claims      |             |             |
|           | expenses, or type of claims | Provide     |             |
|           | experienced by individuals  | example     |             |
|           | for whom a plan sponsor has |             |             |
|           | provided health benefits    | Define      |             |
|           | under a group health plan;  | "other      |             |
|           | and                         | ar          |             |
|           |                             | rangements" |             |
|           | \(2\) From which the        | and provide |             |
|           | information described at §  | examples.   |             |
|           | 164.514(b)(2)(i) has been   |             |             |
|           | deleted, except that the    | Provide     |             |
|           | geographic information      | example.    |             |
|           | described in §              |             |             |
|           | 164.514(b)(2)(i)(B) need    | See         |             |
|           | only be aggregated to the   | definition  |             |
|           | level of a five digit zip   | at 160.103; |             |
|           | code.                       | define plan |             |
|           |                             | sponsor;    |             |
|           | \(b\) [Standard: health     | and this    |             |
|           | care                        | section may |             |
|           | component.]{.underline} If  | not apply   |             |
|           | a covered entity is a       | to IHS.     |             |
|           | hybrid entity, the          |             |             |
|           | requirements of this        | May not be  |             |
|           | subpart, other than the     | applicable  |             |
|           | requirements of this        | to IHS.     |             |
|           | section, apply only to the  |             |             |
|           | health care component(s) of |             |             |
|           | the entity, as specified in |             |             |
|           | this section.               |             |             |
|           |                             |             |             |
|           | (c)(1) [Implementation      |             |             |
|           | specification: application  |             |             |
|           | of other                    |             |             |
|           | provisions.]{.underline} In |             |             |
|           | applying a provision of     |             |             |
|           | this subpart, other than    |             |             |
|           | this section, to a hybrid   |             |             |
|           | entity:                     |             |             |
|           |                             |             |             |
|           | \(i\) A reference in such   |             |             |
|           | provision to a "covered     |             |             |
|           | entity" refers to a health  |             |             |
|           | care component of the       |             |             |
|           | covered entity;             |             |             |
|           |                             |             |             |
|           | \(ii\) A reference in such  |             |             |
|           | provision to a "health      |             |             |
|           | plan," "covered health care |             |             |
|           | provider," or "health care  |             |             |
|           | clearinghouse" refers to a  |             |             |
|           | health care component of    |             |             |
|           | the covered entity if such  |             |             |
|           | health care component       |             |             |
|           | performs the functions of a |             |             |
|           | health plan, covered health |             |             |
|           | care provider, or health    |             |             |
|           | care clearinghouse, as      |             |             |
|           | applicable; and             |             |             |
|           |                             |             |             |
|           | \(iii\) A reference in such |             |             |
|           | provision to "protected     |             |             |
|           | health information" refers  |             |             |
|           | to protected health         |             |             |
|           | information that is created |             |             |
|           | or received by or on behalf |             |             |
|           | of the health care          |             |             |
|           | component of the covered    |             |             |
|           | entity.                     |             |             |
|           |                             |             |             |
|           | \(2\) [Implementation       |             |             |
|           | specifications: safeguard   |             |             |
|           | requirements.]{.underline}  |             |             |
|           | The covered entity that is  |             |             |
|           | a hybrid entity must ensure |             |             |
|           | that a health care          |             |             |
|           | component of the entity     |             |             |
|           | complies with the           |             |             |
|           | applicable requirements of  |             |             |
|           | this subpart. In            |             |             |
|           | particular, and without     |             |             |
|           | limiting this requirement,  |             |             |
|           | such covered entity must    |             |             |
|           | ensure that:                |             |             |
|           |                             |             |             |
|           | \(i\) Its health care       |             |             |
|           | component does not disclose |             |             |
|           | protected health            |             |             |
|           | information to another      |             |             |
|           | component of the covered    |             |             |
|           | entity in circumstances in  |             |             |
|           | which this subpart would    |             |             |
|           | prohibit such disclosure if |             |             |
|           | the health care component   |             |             |
|           | and the other component     |             |             |
|           | were separate and distinct  |             |             |
|           | legal entities;             |             |             |
|           |                             |             |             |
|           | \(ii\) A component that is  |             |             |
|           | described by paragraph      |             |             |
|           | (2)(i) of the definition of |             |             |
|           | *health care component* in  |             |             |
|           | this section does not use   |             |             |
|           | or disclose protected       |             |             |
|           | health information that is  |             |             |
|           | within paragraph (2)(ii) of |             |             |
|           | such definition for         |             |             |
|           | purposes of its activities  |             |             |
|           | other than those described  |             |             |
|           | by paragraph (2)(i) of such |             |             |
|           | definition in a way         |             |             |
|           | prohibited by this subpart; |             |             |
|           | and                         |             |             |
|           |                             |             |             |
|           | \(iii\) If a person         |             |             |
|           | performs duties for both    |             |             |
|           | the health care component   |             |             |
|           | in the capacity of a member |             |             |
|           | of the workforce of such    |             |             |
|           | component and for another   |             |             |
|           | component of the entity in  |             |             |
|           | the same capacity with      |             |             |
|           | respect to that component,  |             |             |
|           | such workforce member must  |             |             |
|           | not use or disclose         |             |             |
|           | protected health            |             |             |
|           | information created or      |             |             |
|           | received in the course of   |             |             |
|           | or incident to the member's |             |             |
|           | work for the health care    |             |             |
|           | component in a way          |             |             |
|           | prohibited by this subpart. |             |             |
|           |                             |             |             |
|           | \(3\) [Implementation       |             |             |
|           | specifications:             |             |             |
|           | responsibilities of the     |             |             |
|           | covered                     |             |             |
|           | entity.]{.underline} A      |             |             |
|           | covered entity that is a    |             |             |
|           | hybrid entity has the       |             |             |
|           | following responsibilities: |             |             |
|           |                             |             |             |
|           | \(i\) For purposes of       |             |             |
|           | subpart C of part 160 of    |             |             |
|           | this subchapter, pertaining |             |             |
|           | to compliance and           |             |             |
|           | enforcement, the covered    |             |             |
|           | entity has the              |             |             |
|           | responsibility to comply    |             |             |
|           | with this subpart.          |             |             |
|           |                             |             |             |
|           | \(ii\) The covered entity   |             |             |
|           | has the responsibility for  |             |             |
|           | complying with §            |             |             |
|           | 164.530(i), pertaining to   |             |             |
|           | the implementation of       |             |             |
|           | policies and procedures to  |             |             |
|           | ensure compliance with this |             |             |
|           | subpart, including the      |             |             |
|           | safeguard requirements in   |             |             |
|           | paragraph (c)(2) of this    |             |             |
|           | section.                    |             |             |
|           |                             |             |             |
|           | \(iii\) The covered entity  |             |             |
|           | is responsible for          |             |             |
|           | designating the components  |             |             |
|           | that are part of one or     |             |             |
|           | more health care components |             |             |
|           | of the covered entity and   |             |             |
|           | documenting the designation |             |             |
|           | as required by §            |             |             |
|           | 164.530(j).                 |             |             |
|           |                             |             |             |
|           | **(d)(1)** [Standard:       |             |             |
|           | affiliated covered          |             |             |
|           | entities.]{.underline}      |             |             |
|           | Legally separate covered    |             |             |
|           | entities that are           |             |             |
|           | affiliated may designate    |             |             |
|           | themselves as a single      |             |             |
|           | covered entity for purposes |             |             |
|           | of this subpart.            |             |             |
|           |                             |             |             |
|           | \(2\) [Implementation       |             |             |
|           | specifications:             |             |             |
|           | requirements for            |             |             |
|           | designation of an           |             |             |
|           | affiliated covered          |             |             |
|           | entity.]{.underline}        |             |             |
|           |                             |             |             |
|           | \(i\) Legally separate      |             |             |
|           | covered entities may        |             |             |
|           | designate themselves        |             |             |
|           | (including any health care  |             |             |
|           | component of such covered   |             |             |
|           | entity) as a single         |             |             |
|           | affiliated covered entity,  |             |             |
|           | for purposes of this        |             |             |
|           | subpart, if all of the      |             |             |
|           | covered entities designated |             |             |
|           | are under common ownership  |             |             |
|           | or control.                 |             |             |
|           |                             |             |             |
|           | \(ii\) The designation of   |             |             |
|           | an affiliated covered       |             |             |
|           | entity must be documented   |             |             |
|           | and the documentation       |             |             |
|           | maintained as required by § |             |             |
|           | 164.530(j).                 |             |             |
|           |                             |             |             |
|           | \(3\) [Implementation       |             |             |
|           | specifications: safeguard   |             |             |
|           | requirements.]{.underline}  |             |             |
|           | An affiliated covered       |             |             |
|           | entity must ensure that:    |             |             |
|           |                             |             |             |
|           | \(i\) The affiliated        |             |             |
|           | covered entity's use and    |             |             |
|           | disclosure of protected     |             |             |
|           | health information comply   |             |             |
|           | with the applicable         |             |             |
|           | requirements of this        |             |             |
|           | subpart; and                |             |             |
|           |                             |             |             |
|           | \(ii\) If the affiliated    |             |             |
|           | covered entity combines the |             |             |
|           | functions of a health plan, |             |             |
|           | health care provider, or    |             |             |
|           | health care clearinghouse,  |             |             |
|           | the affiliated covered      |             |             |
|           | entity complies with        |             |             |
|           | paragraph (g) of this       |             |             |
|           | section.                    |             |             |
|           |                             |             |             |
|           | **(e)(1)** [Standard:       |             |             |
|           | business associate          |             |             |
|           | contracts.]{.underline}     |             |             |
|           |                             |             |             |
|           | \(i\) The contract or other |             |             |
|           | arrangement between the     |             |             |
|           | covered entity and the      |             |             |
|           | business associate required |             |             |
|           | by § 164.502(e)(2) must     |             |             |
|           | meet the requirements of    |             |             |
|           | paragraph (e)(2) or (e)(3)  |             |             |
|           | of this section, as         |             |             |
|           | applicable.                 |             |             |
|           |                             |             |             |
|           | \(ii\) A covered entity is  |             |             |
|           | not in compliance with the  |             |             |
|           | standards in § 164.502(e)   |             |             |
|           | and paragraph (e) of this   |             |             |
|           | section, if the covered     |             |             |
|           | entity knew of a pattern of |             |             |
|           | activity or practice of the |             |             |
|           | business associate that     |             |             |
|           | constituted a material      |             |             |
|           | breach or violation of the  |             |             |
|           | business associate's        |             |             |
|           | obligation under the        |             |             |
|           | contract or other           |             |             |
|           | arrangement, unless the     |             |             |
|           | covered entity took         |             |             |
|           | reasonable steps to cure    |             |             |
|           | the breach or end the       |             |             |
|           | violation, as applicable,   |             |             |
|           | and, if such steps were     |             |             |
|           | unsuccessful:               |             |             |
|           |                             |             |             |
|           | \(A\) Terminated the        |             |             |
|           | contract or arrangement, if |             |             |
|           | feasible; or                |             |             |
|           |                             |             |             |
|           | \(B\) If termination is not |             |             |
|           | feasible, reported the      |             |             |
|           | problem to the Secretary.   |             |             |
|           |                             |             |             |
|           | \(2\) [Implementation       |             |             |
|           | specifications: business    |             |             |
|           | associate                   |             |             |
|           | contracts.]{.underline} A   |             |             |
|           | contract between the        |             |             |
|           | covered entity and a        |             |             |
|           | business associate must:    |             |             |
|           |                             |             |             |
|           | \(i\) Establish the         |             |             |
|           | permitted and required uses |             |             |
|           | and disclosures of such     |             |             |
|           | information by the business |             |             |
|           | associate. The contract may |             |             |
|           | not authorize the business  |             |             |
|           | associate to use or further |             |             |
|           | disclose the information in |             |             |
|           | a manner that would violate |             |             |
|           | the requirements of this    |             |             |
|           | subpart, if done by the     |             |             |
|           | covered entity, except      |             |             |
|           | that:                       |             |             |
|           |                             |             |             |
|           | \(A\) The contract may      |             |             |
|           | permit the business         |             |             |
|           | associate to use and        |             |             |
|           | disclose protected health   |             |             |
|           | information for the proper  |             |             |
|           | management and              |             |             |
|           | administration of the       |             |             |
|           | business associate, as      |             |             |
|           | provided in paragraph       |             |             |
|           | (e)(4) of this section; and |             |             |
|           |                             |             |             |
|           | \(B\) The contract may      |             |             |
|           | permit the business         |             |             |
|           | associate to provide data   |             |             |
|           | aggregation services        |             |             |
|           | relating to the health care |             |             |
|           | operations of the covered   |             |             |
|           | entity.                     |             |             |
|           |                             |             |             |
|           | \(ii\) Provide that the     |             |             |
|           | business associate will:    |             |             |
|           |                             |             |             |
|           | \(A\) Not use or further    |             |             |
|           | disclose the information    |             |             |
|           | other than as permitted or  |             |             |
|           | required by the contract or |             |             |
|           | as required by law;         |             |             |
|           |                             |             |             |
|           | \(B\) Use appropriate       |             |             |
|           | safeguards to prevent use   |             |             |
|           | or disclosure of the        |             |             |
|           | information other than as   |             |             |
|           | provided for by its         |             |             |
|           | contract;                   |             |             |
|           |                             |             |             |
|           | \(C\) Report to the covered |             |             |
|           | entity any use or           |             |             |
|           | disclosure of the           |             |             |
|           | information not provided    |             |             |
|           | for by its contract of      |             |             |
|           | which it becomes aware;     |             |             |
|           |                             |             |             |
|           | \(D\) Ensure that any       |             |             |
|           | agents, including a         |             |             |
|           | subcontractor, to whom it   |             |             |
|           | provides protected health   |             |             |
|           | information received from,  |             |             |
|           | or created or received by   |             |             |
|           | the business associate on   |             |             |
|           | behalf of, the covered      |             |             |
|           | entity agrees to the same   |             |             |
|           | restrictions and conditions |             |             |
|           | that apply to the business  |             |             |
|           | associate with respect to   |             |             |
|           | such information;           |             |             |
|           |                             |             |             |
|           | \(E\) Make available        |             |             |
|           | protected health            |             |             |
|           | information in accordance   |             |             |
|           | with § 164.524;             |             |             |
|           |                             |             |             |
|           | \(F\) Make available        |             |             |
|           | protected health            |             |             |
|           | information for amendment   |             |             |
|           | and incorporate any         |             |             |
|           | amendments to protected     |             |             |
|           | health information in       |             |             |
|           | accordance with §164.526;   |             |             |
|           |                             |             |             |
|           | \(G\) Make available the    |             |             |
|           | information required to     |             |             |
|           | provide an accounting of    |             |             |
|           | disclosures in accordance   |             |             |
|           | with § 164.528;             |             |             |
|           |                             |             |             |
|           | \(H\) Make its internal     |             |             |
|           | practices, books, and       |             |             |
|           | records relating to the use |             |             |
|           | and disclosure of protected |             |             |
|           | health information received |             |             |
|           | from, or created or         |             |             |
|           | received by the business    |             |             |
|           | associate on behalf of, the |             |             |
|           | covered entity available to |             |             |
|           | the Secretary for purposes  |             |             |
|           | of determining the covered  |             |             |
|           | entity\'s compliance with   |             |             |
|           | this subpart; and           |             |             |
|           |                             |             |             |
|           | \(I\) At termination of the |             |             |
|           | contract, if feasible,      |             |             |
|           | return or destroy all       |             |             |
|           | protected health            |             |             |
|           | information received from,  |             |             |
|           | or created or received by   |             |             |
|           | the business associate on   |             |             |
|           | behalf of, the covered      |             |             |
|           | entity that the business    |             |             |
|           | associate still maintains   |             |             |
|           | in any form and retain no   |             |             |
|           | copies of such information  |             |             |
|           | or, if such return or       |             |             |
|           | destruction is not          |             |             |
|           | feasible, extend the        |             |             |
|           | protections of the contract |             |             |
|           | to the information and      |             |             |
|           | limit further uses and      |             |             |
|           | disclosures to those        |             |             |
|           | purposes that make the      |             |             |
|           | return or destruction of    |             |             |
|           | the information infeasible. |             |             |
|           |                             |             |             |
|           | \(iii\) Authorize           |             |             |
|           | termination of the contract |             |             |
|           | by the covered entity, if   |             |             |
|           | the covered entity          |             |             |
|           | determines that the         |             |             |
|           | business associate has      |             |             |
|           | violated a material term of |             |             |
|           | the contract.               |             |             |
|           |                             |             |             |
|           | \(3\) [Implementation       |             |             |
|           | specifications: other       |             |             |
|           | arrangements.]{.underline}  |             |             |
|           |                             |             |             |
|           | \(i\) If a covered entity   |             |             |
|           | and its business associate  |             |             |
|           | are both governmental       |             |             |
|           | entities:                   |             |             |
|           |                             |             |             |
|           | \(A\) The covered entity    |             |             |
|           | may comply with paragraph   |             |             |
|           | (e) of this section by      |             |             |
|           | entering into a memorandum  |             |             |
|           | of understanding with the   |             |             |
|           | business associate that     |             |             |
|           | contains terms that         |             |             |
|           | accomplish the objectives   |             |             |
|           | of paragraph (e)(2) of this |             |             |
|           | section.                    |             |             |
|           |                             |             |             |
|           | \(B\) The covered entity    |             |             |
|           | may comply with paragraph   |             |             |
|           | (e) of this section, if     |             |             |
|           | other law (including        |             |             |
|           | regulations adopted by the  |             |             |
|           | covered entity or its       |             |             |
|           | business associate)         |             |             |
|           | contains requirements       |             |             |
|           | applicable to the business  |             |             |
|           | associate that accomplish   |             |             |
|           | the objectives of paragraph |             |             |
|           | (e)(2) of this section.     |             |             |
|           |                             |             |             |
|           | \(ii\) If a business        |             |             |
|           | associate is required by    |             |             |
|           | law to perform a function   |             |             |
|           | or activity on behalf of a  |             |             |
|           | covered entity or to        |             |             |
|           | provide a service described |             |             |
|           | in the definition of        |             |             |
|           | *business associate* in §   |             |             |
|           | 160.103 of this subchapter  |             |             |
|           | to a covered entity, such   |             |             |
|           | covered entity may disclose |             |             |
|           | protected health            |             |             |
|           | information to the business |             |             |
|           | associate to the extent     |             |             |
|           | necessary to comply with    |             |             |
|           | the legal mandate without   |             |             |
|           | meeting the requirements of |             |             |
|           | this paragraph (e),         |             |             |
|           | provided that the covered   |             |             |
|           | entity attempts in good     |             |             |
|           | faith to obtain             |             |             |
|           | satisfactory assurances as  |             |             |
|           | required by paragraph       |             |             |
|           | (e)(3)(i) of this section,  |             |             |
|           | and, if such attempt fails, |             |             |
|           | documents the attempt and   |             |             |
|           | the reasons that such       |             |             |
|           | assurances cannot be        |             |             |
|           | obtained.                   |             |             |
|           |                             |             |             |
|           | \(iii\) The covered entity  |             |             |
|           | may omit from its other     |             |             |
|           | arrangements the            |             |             |
|           | termination authorization   |             |             |
|           | required by paragraph       |             |             |
|           | (e)(2)(iii)                 |             |             |
|           |                             |             |             |
|           | of this section, if such    |             |             |
|           | authorization is            |             |             |
|           | inconsistent with the       |             |             |
|           | statutory obligations of    |             |             |
|           | the covered entity or its   |             |             |
|           | business associate.         |             |             |
|           |                             |             |             |
|           | **(4)** [Implementation     |             |             |
|           | specifications: other       |             |             |
|           | requirements for contracts  |             |             |
|           | and other                   |             |             |
|           | arrangements.]{.underline}  |             |             |
|           |                             |             |             |
|           | \(i\) The contract or other |             |             |
|           | arrangement between the     |             |             |
|           | covered entity and the      |             |             |
|           | business associate may      |             |             |
|           | permit the business         |             |             |
|           | associate to use the        |             |             |
|           | information received by the |             |             |
|           | business associate in its   |             |             |
|           | capacity as a business      |             |             |
|           | associate to the covered    |             |             |
|           | entity, if necessary:       |             |             |
|           |                             |             |             |
|           | \(A\) For the proper        |             |             |
|           | management and              |             |             |
|           | administration of the       |             |             |
|           | business associate; or      |             |             |
|           |                             |             |             |
|           | \(B\) To carry out the      |             |             |
|           | legal responsibilities of   |             |             |
|           | the business associate.     |             |             |
|           |                             |             |             |
|           | \(ii\) The contract or      |             |             |
|           | other arrangement between   |             |             |
|           | the covered entity and the  |             |             |
|           | business associate may      |             |             |
|           | permit the business         |             |             |
|           | associate to disclose the   |             |             |
|           | information received by the |             |             |
|           | business associate in its   |             |             |
|           | capacity as a business      |             |             |
|           | associate for the purposes  |             |             |
|           | described in paragraph      |             |             |
|           | (e)(4)(i) of this section,  |             |             |
|           | if:                         |             |             |
|           |                             |             |             |
|           | \(A\) The disclosure is     |             |             |
|           | required by law; or         |             |             |
|           |                             |             |             |
|           | (B)(*1*) The business       |             |             |
|           | associate obtains           |             |             |
|           | reasonable assurances from  |             |             |
|           | the person to whom the      |             |             |
|           | information is disclosed    |             |             |
|           | that it will be held        |             |             |
|           | confidentially and used or  |             |             |
|           | further disclosed only as   |             |             |
|           | required by law or for the  |             |             |
|           | purpose for which it was    |             |             |
|           | disclosed to the person;    |             |             |
|           | and (2) The person notifies |             |             |
|           | the business associate of   |             |             |
|           | any instances of which it   |             |             |
|           | is aware in which the       |             |             |
|           | confidentiality of the      |             |             |
|           | information has been        |             |             |
|           | breached.                   |             |             |
|           |                             |             |             |
|           | **(f)(1)**[Standard:        |             |             |
|           | requirements for group      |             |             |
|           | health plans.]{.underline}  |             |             |
|           |                             |             |             |
|           | \(i\) Except as provided    |             |             |
|           | under paragraph (f)(1)(ii)  |             |             |
|           | of this section or as       |             |             |
|           | otherwise authorized under  |             |             |
|           | § 164.508, a group health   |             |             |
|           | plan, in order to disclose  |             |             |
|           | protected health            |             |             |
|           | information to the plan     |             |             |
|           | sponsor or to provide for   |             |             |
|           | or permit the disclosure of |             |             |
|           | protected health            |             |             |
|           | information to the plan     |             |             |
|           | sponsor by a health         |             |             |
|           | insurance issuer or HMO     |             |             |
|           | with respect to the group   |             |             |
|           | health plan, must ensure    |             |             |
|           | that the plan documents     |             |             |
|           | restrict uses and discloses |             |             |
|           | of such information by the  |             |             |
|           | plan sponsor consistent     |             |             |
|           | with the requirements of    |             |             |
|           | this subpart.               |             |             |
|           |                             |             |             |
|           | \(ii\) The group health     |             |             |
|           | plan, or a health insurance |             |             |
|           | issuer or HMO with respect  |             |             |
|           | to the group health plan,   |             |             |
|           | may disclose summary health |             |             |
|           | information to the plan     |             |             |
|           | sponsor, if the plan        |             |             |
|           | sponsor requests the        |             |             |
|           | summary health information  |             |             |
|           | for the purpose of :        |             |             |
|           |                             |             |             |
|           | \(A\) Obtaining premium     |             |             |
|           | bids from health plans for  |             |             |
|           | providing health insurance  |             |             |
|           | coverage under the group    |             |             |
|           | health plan; or             |             |             |
|           |                             |             |             |
|           | \(B\) Modifying, amending,  |             |             |
|           | or terminating the group    |             |             |
|           | health plan.                |             |             |
|           |                             |             |             |
|           | \(2\) [Implementation       |             |             |
|           | specifications:             |             |             |
|           | requirements for plan       |             |             |
|           | documents.]{.underline} The |             |             |
|           | plan documents of the group |             |             |
|           | health plan must be amended |             |             |
|           | to incorporate provisions   |             |             |
|           | to:                         |             |             |
|           |                             |             |             |
|           | \(i\) Establish the         |             |             |
|           | permitted and required uses |             |             |
|           | and disclosures of such     |             |             |
|           | information by the plan     |             |             |
|           | sponsor, provided that such |             |             |
|           | permitted and required uses |             |             |
|           | and disclosures may not be  |             |             |
|           | inconsistent with this      |             |             |
|           | subpart.                    |             |             |
|           |                             |             |             |
|           | \(ii\) Provide that the     |             |             |
|           | group health plan will      |             |             |
|           | disclose protected health   |             |             |
|           | information to the plan     |             |             |
|           | sponsor only upon receipt   |             |             |
|           | of a certification by the   |             |             |
|           | plan sponsor that the plan  |             |             |
|           | documents have been amended |             |             |
|           | to incorporate the          |             |             |
|           | following provisions and    |             |             |
|           | that the plan sponsor       |             |             |
|           | agrees to:                  |             |             |
|           |                             |             |             |
|           | \(A\) Not use or further    |             |             |
|           | disclose the information    |             |             |
|           | other than as permitted or  |             |             |
|           | required by the plan        |             |             |
|           | documents or as required by |             |             |
|           | law;                        |             |             |
|           |                             |             |             |
|           | \(B\) Ensure that any       |             |             |
|           | agents, including a         |             |             |
|           | subcontractor, to whom it   |             |             |
|           | provides protected health   |             |             |
|           | information received from   |             |             |
|           | the group health plan agree |             |             |
|           | to the same restrictions    |             |             |
|           | and conditions that apply   |             |             |
|           | to the plan sponsor with    |             |             |
|           | respect to such             |             |             |
|           | information;                |             |             |
|           |                             |             |             |
|           | \(C\) Not use or disclose   |             |             |
|           | the information for         |             |             |
|           | employment-related actions  |             |             |
|           | and decisions or in         |             |             |
|           | connection with any other   |             |             |
|           | benefit or employee benefit |             |             |
|           | plan of the plan sponsor;   |             |             |
|           |                             |             |             |
|           | \(D\) Report to the group   |             |             |
|           | health plan any use or      |             |             |
|           | disclosure of the           |             |             |
|           | information that is         |             |             |
|           | inconsistent with the uses  |             |             |
|           | or disclosures provided for |             |             |
|           | of which it becomes aware;  |             |             |
|           |                             |             |             |
|           | \(E\) Make available        |             |             |
|           | protected health            |             |             |
|           | information in accordance   |             |             |
|           | with § 164.524;             |             |             |
|           |                             |             |             |
|           | \(F\) Make available        |             |             |
|           | protected health            |             |             |
|           | information for amendment   |             |             |
|           | and incorporate any         |             |             |
|           | amendments to protected     |             |             |
|           | health information in       |             |             |
|           | accordance with §164.526;   |             |             |
|           |                             |             |             |
|           | \(G\) Make available the    |             |             |
|           | information required to     |             |             |
|           | provide an accounting of    |             |             |
|           | disclosures in accordance   |             |             |
|           | with § 164.528;             |             |             |
|           |                             |             |             |
|           | \(H\) Make its internal     |             |             |
|           | practices, books, and       |             |             |
|           | records relating to the use |             |             |
|           | and disclosure of protected |             |             |
|           | health information received |             |             |
|           | from the group health plan  |             |             |
|           | available to the Secretary  |             |             |
|           | for purposes of determining |             |             |
|           | compliance by the group     |             |             |
|           | health plan with this       |             |             |
|           | subpart;                    |             |             |
|           |                             |             |             |
|           | \(I\) If feasible, return   |             |             |
|           | or destroy all protected    |             |             |
|           | health information received |             |             |
|           | from the group health plan  |             |             |
|           | that the sponsor still      |             |             |
|           | maintains in any form and   |             |             |
|           | retain no copies of such    |             |             |
|           | information when no longer  |             |             |
|           | needed for the purpose for  |             |             |
|           | which disclosure was made,  |             |             |
|           | except that, if such return |             |             |
|           | or destruction is not       |             |             |
|           | feasible, limit further     |             |             |
|           | uses and disclosures to     |             |             |
|           | those purposes that make    |             |             |
|           | the return or destruction   |             |             |
|           | of the information          |             |             |
|           | infeasible; and             |             |             |
|           |                             |             |             |
|           | \(J\) Ensure that the       |             |             |
|           | adequate separation         |             |             |
|           | required in paragraph       |             |             |
|           | (f)(2)(iii) of this section |             |             |
|           | is established.             |             |             |
|           |                             |             |             |
|           | \(iii\) Provide for         |             |             |
|           | adequate separation between |             |             |
|           | the group health plan and   |             |             |
|           | the plan sponsor. The plan  |             |             |
|           | documents must:             |             |             |
|           |                             |             |             |
|           | \(A\) Describe those        |             |             |
|           | employees or classes of     |             |             |
|           | employees or other persons  |             |             |
|           | under the control of the    |             |             |
|           | plan sponsor to be given    |             |             |
|           | access to the protected     |             |             |
|           | health information to be    |             |             |
|           | disclosed, provided that    |             |             |
|           | any employee or person who  |             |             |
|           | receives protected health   |             |             |
|           | information relating to     |             |             |
|           | payment under, health care  |             |             |
|           | operations of, or other     |             |             |
|           | matters pertaining to the   |             |             |
|           | group health plan in the    |             |             |
|           | ordinary course of business |             |             |
|           | must be included in such    |             |             |
|           | description;                |             |             |
|           |                             |             |             |
|           | \(B\) Restrict the access   |             |             |
|           | to and use by such          |             |             |
|           | employees and other persons |             |             |
|           | described in paragraph      |             |             |
|           | (f)(2)(iii)(A) of this      |             |             |
|           | section to the plan         |             |             |
|           | administration functions    |             |             |
|           | that the plan sponsor       |             |             |
|           | performs for the group      |             |             |
|           | health plan; and            |             |             |
|           |                             |             |             |
|           | \(C\) Provide an effective  |             |             |
|           | mechanism for resolving any |             |             |
|           | issues of noncompliance by  |             |             |
|           | persons described in        |             |             |
|           | paragraph (f)(2)(iii)(A) of |             |             |
|           | this section with the plan  |             |             |
|           | document provisions         |             |             |
|           | required by this paragraph. |             |             |
|           |                             |             |             |
|           | \(3\) [Implementation       |             |             |
|           | specifications: uses and    |             |             |
|           | disclosures.]{.underline} A |             |             |
|           | group health plan may:      |             |             |
|           |                             |             |             |
|           | \(i\) Disclose protected    |             |             |
|           | health information to a     |             |             |
|           | plan sponsor to carry out   |             |             |
|           | plan administration         |             |             |
|           | functions that the plan     |             |             |
|           | sponsor performs only       |             |             |
|           | consistent with the         |             |             |
|           | provisions of paragraph     |             |             |
|           | (f)(2) of this section;     |             |             |
|           |                             |             |             |
|           | \(ii\) Not permit a health  |             |             |
|           | insurance issuer or HMO     |             |             |
|           | with respect to the group   |             |             |
|           | health plan to disclose     |             |             |
|           | protected health            |             |             |
|           | information to the plan     |             |             |
|           | sponsor except as permitted |             |             |
|           | by this paragraph;          |             |             |
|           |                             |             |             |
|           | \(iii\) Not disclose and    |             |             |
|           | may not permit a health     |             |             |
|           | insurance issuer or HMO to  |             |             |
|           | disclose protected health   |             |             |
|           | information to a plan       |             |             |
|           | sponsor as otherwise        |             |             |
|           | permitted by this paragraph |             |             |
|           | unless a statement required |             |             |
|           | by § 164.520(b)(1)(iii)(C)  |             |             |
|           | is included in the          |             |             |
|           | appropriate notice; and     |             |             |
|           |                             |             |             |
|           | \(iv\) Not disclose         |             |             |
|           | protected health            |             |             |
|           | information to the plan     |             |             |
|           | sponsor for the purpose of  |             |             |
|           | employment-related actions  |             |             |
|           | or decisions or in          |             |             |
|           | connection with any other   |             |             |
|           | benefit or employee benefit |             |             |
|           | plan of the plan sponsor.   |             |             |
|           |                             |             |             |
|           | \(g\) [Standard:            |             |             |
|           | requirements for a covered  |             |             |
|           | entity with multiple        |             |             |
|           | covered                     |             |             |
|           | functions.]{.underline}     |             |             |
|           |                             |             |             |
|           | \(1\) A covered entity that |             |             |
|           | performs multiple covered   |             |             |
|           | functions that would make   |             |             |
|           | the entity any combination  |             |             |
|           | of a health plan, a covered |             |             |
|           | health care provider, and a |             |             |
|           | health care clearinghouse,  |             |             |
|           | must comply with the        |             |             |
|           | standards, requirements,    |             |             |
|           | and implementation          |             |             |
|           | specifications of this      |             |             |
|           | subpart, as applicable to   |             |             |
|           | the health plan, health     |             |             |
|           | care provider, or health    |             |             |
|           | care clearinghouse covered  |             |             |
|           | functions performed.        |             |             |
|           |                             |             |             |
|           | \(2\) A covered entity that |             |             |
|           | performs multiple covered   |             |             |
|           | functions may use or        |             |             |
|           | disclose the protected      |             |             |
|           | health information of       |             |             |
|           | individuals who receive the |             |             |
|           | covered entity's health     |             |             |
|           | plan or health care         |             |             |
|           | provider services, but not  |             |             |
|           | both, only for purposes     |             |             |
|           | related to the appropriate  |             |             |
|           | function being performed.   |             |             |
+-----------+-----------------------------+-------------+-------------+
| [§        | \(a\) [Standard: consent    | 5 USC 552a; | Refer to    |
| 164.506   | requirement.]{.underline}   | 45 CFR 5b.; | OGC for     |
| Consent   |                             | IHS SOR     | legal       |
| for uses  | \(1\) Except as provided in | 09-17-0001. | review.     |
| or        | paragraph (a)(2) or (a)(3)  | Note: As a  |             |
| di        | of this section, a covered  | health      | Have        |
| sclosures | health care provider must   | plan, IHS   | workgroup   |
| to carry  | obtain the individual's     | may but is  | consisting  |
| out       | consent, in accordance with | not         | of          |
| t         | this section, prior to      | required to | appropriate |
| reatment, | using or disclosing         | obtain a    | staff       |
| payment,  | protected health            | consent but | develop the |
| or health | information to carry out    | would       | written     |
| care      | treatment, payment, or      | individual  | consent and |
| op        | health care operations.     | IHS direct  | the policy  |
| erations] |                             | health care | and         |
| (../HIPAA | \(2\) A covered health care | providers   | procedure   |
| %20Privac | provider may, without       | and         | to          |
| y%20Rule. | consent, use or disclose    | facilities  | implement.  |
| doc#_Hlk5 | protected health            | would need  |             |
| 16629525) | information to carry out    | to obtain a | (OPH,       |
|           | treatment, payment, or      | written     | medical,    |
|           | health care operations, if: | consent?    | business    |
|           |                             |             | office,     |
|           | \(i\) The covered health    | Can not     | CHS,        |
|           | care provider has an        | combine a   | privacy     |
|           | indirect treatment          | consent     | staff, OGC, |
|           | relationship with the       | with the    | etc.)       |
|           | individual; or              | notice.     |             |
|           |                             |             | Refer to    |
|           | \(ii\) The covered health   | Exception   | research    |
|           | care provider created or    |             | staff for   |
|           | received the protected      | Right to    | input       |
|           | health information in the   | revoke      | regarding   |
|           | course of providing health  | consent.    | imple       |
|           | care to an individual who   |             | ment-ation. |
|           | is an inmate.               | Retain      |             |
|           |                             | consent for | Initial     |
|           | (3)(i) A covered health     | 6 years.    | draft being |
|           | care provider may, without  |             | developed.  |
|           | prior consent, use or       | Written in  |             |
|           | disclose protected health   | plain       |             |
|           | information created or      | English     |             |
|           | received under paragraph    | language.   |             |
|           | (a)(3)(i)(A)-(C) of this    |             |             |
|           | section to carry out        | Right to    |             |
|           | treatment, payment, or      | change      |             |
|           | health care operations:     | notice      |             |
|           |                             |             |             |
|           | \(A\) In emergency          | Required    |             |
|           | treatment situations, if    |             |             |
|           | the covered health care     | Required    |             |
|           | provider attempts to obtain |             |             |
|           | such consent as soon as     | Required    |             |
|           | reasonably practicable      |             |             |
|           | after the delivery of such  | OCR "draft" |             |
|           | treatment;                  | guidance    |             |
|           |                             | discusses   |             |
|           | \(B\) If the covered health | this issue  |             |
|           | care provider is required   | (page 9 of  |             |
|           | by law to treat the         | 45).        |             |
|           | individual, and the covered |             |             |
|           | health care provider        | Use the     |             |
|           | attempts to obtain such     | more        |             |
|           | consent but is unable to    | restrictive |             |
|           | obtain such consent; or     |             |             |
|           |                             | Consent     |             |
|           | \(C\) If a covered health   | gives       |             |
|           | care provider attempts to   | direct      |             |
|           | obtain such consent from    | treatment   |             |
|           | the individual but is       | providers   |             |
|           | unable to obtain such       | permission  |             |
|           | consent due to substantial  | to use and  |             |
|           | barriers to communicating   | disclose    |             |
|           | with the individual, and    | all phi for |             |
|           | the covered health care     | TPO         |             |
|           | provider determines, in the |             |             |
|           | exercise of professional    | Au          |             |
|           | judgment, that the          | thorization |             |
|           | individual's consent to     | gives       |             |
|           | receive treatment is        | covered     |             |
|           | clearly inferred from the   | entities    |             |
|           | circumstances.              | permission  |             |
|           |                             | to use and  |             |
|           | \(ii\) A covered health     | disclose    |             |
|           | care provider that fails to | specified   |             |
|           | obtain such consent in      | TPO for     |             |
|           | accordance with paragraph   | specified   |             |
|           | (a)(3)(i) of this section   | purposes    |             |
|           | must document its attempt   | other than  |             |
|           | to obtain consent and the   | TPO.        |             |
|           | reason why consent was not  |             |             |
|           | obtained.                   | Get a new   |             |
|           |                             | consent     |             |
|           | \(4\) If a covered entity   |             |             |
|           | is not required to obtain   | Put oral    |             |
|           | consent by paragraph (a)(1) | agreement   |             |
|           | of this section, it may     | in writing. |             |
|           | obtain an individual's      |             |             |
|           | consent for the covered     | IHS may     |             |
|           | entity's own use or         | want to     |             |
|           | disclosure of protected     | consider    |             |
|           | health information to carry | using the   |             |
|           | out treatment, payment, or  | joint       |             |
|           | health care operations,     | consent.    |             |
|           | provided that such consent  |             |             |
|           | meets the requirements of   |             |             |
|           | this section.               |             |             |
|           |                             |             |             |
|           | \(5\) Except as provided in |             |             |
|           | paragraph (f)(1) of this    |             |             |
|           | section, a consent obtained |             |             |
|           | by a covered entity under   |             |             |
|           | this section is not         |             |             |
|           | effective to permit another |             |             |
|           | covered entity to use or    |             |             |
|           | disclose protected health   |             |             |
|           | information.                |             |             |
|           |                             |             |             |
|           | \(b\) [Implementation       |             |             |
|           | specifications: general     |             |             |
|           | requirements.]{.underline}  |             |             |
|           |                             |             |             |
|           | \(1\) A covered health care |             |             |
|           | provider may condition      |             |             |
|           | treatment on the provision  |             |             |
|           | by the individual of a      |             |             |
|           | consent under this section. |             |             |
|           |                             |             |             |
|           | \(2\) A health plan may     |             |             |
|           | condition enrollment in the |             |             |
|           | health plan on the          |             |             |
|           | provision by the individual |             |             |
|           | of a consent under this     |             |             |
|           | section sought in           |             |             |
|           | conjunction with such       |             |             |
|           | enrollment.                 |             |             |
|           |                             |             |             |
|           | \(3\) A consent under this  |             |             |
|           | section may not be combined |             |             |
|           | in a single document with   |             |             |
|           | the notice required by §    |             |             |
|           | 164.520.                    |             |             |
|           |                             |             |             |
|           | (4)(i) A consent for use or |             |             |
|           | disclosure may be combined  |             |             |
|           | with other types of written |             |             |
|           | legal permission from the   |             |             |
|           | individual (e.g., an        |             |             |
|           | informed consent for        |             |             |
|           | treatment or a consent to   |             |             |
|           | assignment of benefits), if |             |             |
|           | the consent under this      |             |             |
|           | section:                    |             |             |
|           |                             |             |             |
|           | \(A\) Is visually and       |             |             |
|           | organizationally separate   |             |             |
|           | from such other written     |             |             |
|           | legal permission; and       |             |             |
|           |                             |             |             |
|           | \(B\) Is separately signed  |             |             |
|           | by the individual and       |             |             |
|           | dated.                      |             |             |
|           |                             |             |             |
|           | \(ii\) A consent for use or |             |             |
|           | disclosure may be combined  |             |             |
|           | with a research             |             |             |
|           | authorization under §       |             |             |
|           | 164.508(f).                 |             |             |
|           |                             |             |             |
|           | \(5\) An individual may     |             |             |
|           | revoke a consent under this |             |             |
|           | section at any time, except |             |             |
|           | to the extent that the      |             |             |
|           | covered entity has taken    |             |             |
|           | action in reliance thereon. |             |             |
|           | Such revocation must be in  |             |             |
|           | writing.                    |             |             |
|           |                             |             |             |
|           | \(6\) A covered entity must |             |             |
|           | document and retain any     |             |             |
|           | signed consent under this   |             |             |
|           | section as required by §    |             |             |
|           | 164.530(j).                 |             |             |
|           |                             |             |             |
|           | \(c\) [Implementation       |             |             |
|           | specifications: content     |             |             |
|           | requirements.]{.underline}  |             |             |
|           | A consent under this        |             |             |
|           | section must be in plain    |             |             |
|           | language and:               |             |             |
|           |                             |             |             |
|           | \(1\) Inform the individual |             |             |
|           | that protected health       |             |             |
|           | information may be used and |             |             |
|           | disclosed to carry out      |             |             |
|           | treatment, payment, or      |             |             |
|           | health care operations;     |             |             |
|           |                             |             |             |
|           | \(2\) Refer the individual  |             |             |
|           | to the notice required by § |             |             |
|           | 164.520 for a more complete |             |             |
|           | description of such uses    |             |             |
|           | and disclosures and state   |             |             |
|           | that the individual has the |             |             |
|           | right to review the notice  |             |             |
|           | prior to signing the        |             |             |
|           | consent;                    |             |             |
|           |                             |             |             |
|           | \(3\) If the covered entity |             |             |
|           | has reserved the right to   |             |             |
|           | change its privacy          |             |             |
|           | practices that are          |             |             |
|           | described in the notice in  |             |             |
|           | accordance with §           |             |             |
|           | 164.520(b)(1)(v)(C), state  |             |             |
|           | that the terms of its       |             |             |
|           | notice may change and       |             |             |
|           | describe how the individual |             |             |
|           | may obtain a revised        |             |             |
|           | notice;                     |             |             |
|           |                             |             |             |
|           | \(4\) State that: (i) The   |             |             |
|           | individual has the right to |             |             |
|           | request that the covered    |             |             |
|           | entity restrict how         |             |             |
|           | protected health            |             |             |
|           | information is used or      |             |             |
|           | disclosed to carry out      |             |             |
|           | treatment, payment, or      |             |             |
|           | health care operations;     |             |             |
|           |                             |             |             |
|           | \(ii\) The covered entity   |             |             |
|           | is not required to agree to |             |             |
|           | requested restrictions; and |             |             |
|           |                             |             |             |
|           | \(iii\) If the covered      |             |             |
|           | entity agrees to a          |             |             |
|           | requested restriction, the  |             |             |
|           | restriction is binding on   |             |             |
|           | the covered entity;         |             |             |
|           |                             |             |             |
|           | \(5\) State that the        |             |             |
|           | individual has the right to |             |             |
|           | revoke the consent in       |             |             |
|           | writing, except to the      |             |             |
|           | extent that the covered     |             |             |
|           | entity has taken action in  |             |             |
|           | reliance thereon; and       |             |             |
|           |                             |             |             |
|           | \(6\) Be signed by the      |             |             |
|           | individual and dated.       |             |             |
|           |                             |             |             |
|           | \(d\) [Implementation       |             |             |
|           | specifications: defective   |             |             |
|           | consents.]{.underline}      |             |             |
|           | There is no consent under   |             |             |
|           | this section, if the        |             |             |
|           | document submitted has any  |             |             |
|           | of the following defects:   |             |             |
|           |                             |             |             |
|           | \(1\) The consent lacks an  |             |             |
|           | element required by         |             |             |
|           | paragraph (c) of this       |             |             |
|           | section, as applicable; or  |             |             |
|           |                             |             |             |
|           | \(2\) The consent has been  |             |             |
|           | revoked in accordance with  |             |             |
|           | paragraph (b)(5) of this    |             |             |
|           | section.                    |             |             |
|           |                             |             |             |
|           | **(e)** [Standard:          |             |             |
|           | resolving conflicting       |             |             |
|           | consents and                |             |             |
|           | a                           |             |             |
|           | uthorizations.]{.underline} |             |             |
|           |                             |             |             |
|           | \(1\) If a covered entity   |             |             |
|           | has obtained a consent      |             |             |
|           | under this section and      |             |             |
|           | receives any other          |             |             |
|           | authorization or written    |             |             |
|           | legal permission from the   |             |             |
|           | individual for a disclosure |             |             |
|           | of protected health         |             |             |
|           | information to carry out    |             |             |
|           | treatment, payment, or      |             |             |
|           | health care operations, the |             |             |
|           | covered entity may disclose |             |             |
|           | such protected health       |             |             |
|           | information only in         |             |             |
|           | accordance with the more    |             |             |
|           | restrictive consent,        |             |             |
|           | authorization, or other     |             |             |
|           | written legal permission    |             |             |
|           | from the individual.        |             |             |
|           |                             |             |             |
|           | \(2\) A covered entity may  |             |             |
|           | attempt to resolve a        |             |             |
|           | conflict between a consent  |             |             |
|           | and an authorization or     |             |             |
|           | other written legal         |             |             |
|           | permission from the         |             |             |
|           | individual described in     |             |             |
|           | paragraph (e)(1) of this    |             |             |
|           | section by:                 |             |             |
|           |                             |             |             |
|           | \(i\) Obtaining a new       |             |             |
|           | consent from the individual |             |             |
|           | under this section for the  |             |             |
|           | disclosure to carry out     |             |             |
|           | treatment, payment, or      |             |             |
|           | health care operations; or  |             |             |
|           |                             |             |             |
|           | \(ii\) Communicating orally |             |             |
|           | or in writing with the      |             |             |
|           | individual in order to      |             |             |
|           | determine the individual's  |             |             |
|           | preference in resolving the |             |             |
|           | conflict. The covered       |             |             |
|           | entity must document the    |             |             |
|           | individual's preference and |             |             |
|           | may only disclose protected |             |             |
|           | health information in       |             |             |
|           | accordance with the         |             |             |
|           | individual's preference.    |             |             |
|           |                             |             |             |
|           | **(f)(1)** [Standard: joint |             |             |
|           | consents.]{.underline}      |             |             |
|           | Covered entities that       |             |             |
|           | participate in an organized |             |             |
|           | health care arrangement and |             |             |
|           | that have a joint notice    |             |             |
|           | under § 164.520(d) may      |             |             |
|           | comply with this section by |             |             |
|           | a joint consent.            |             |             |
|           |                             |             |             |
|           | \(2\) [Implementation       |             |             |
|           | specifications:             |             |             |
|           | requirements for joint      |             |             |
|           | consents.]{.underline}      |             |             |
|           |                             |             |             |
|           | \(i\) A joint consent must: |             |             |
|           |                             |             |             |
|           | \(A\) Include the name or   |             |             |
|           | other specific              |             |             |
|           | identification of the       |             |             |
|           | covered entities, or        |             |             |
|           | classes of covered          |             |             |
|           | entities, to which the      |             |             |
|           | joint consent applies; and  |             |             |
|           |                             |             |             |
|           | \(B\) Meet the requirements |             |             |
|           | of this section, except     |             |             |
|           | that the statements         |             |             |
|           | required by this section    |             |             |
|           | may be altered to reflect   |             |             |
|           | the fact that the consent   |             |             |
|           | covers more than one        |             |             |
|           | covered entity.             |             |             |
|           |                             |             |             |
|           | \(ii\) If an individual     |             |             |
|           | revokes a joint consent,    |             |             |
|           | the covered entity that     |             |             |
|           | receives the revocation     |             |             |
|           | must inform the other       |             |             |
|           | entities covered by the     |             |             |
|           | joint consent of the        |             |             |
|           | revocation as soon as       |             |             |
|           | practicable.                |             |             |
+-----------+-----------------------------+-------------+-------------+
| [§164.508 | \(a\) [Standard:            | 5 USC       | Update SOR  |
| Uses and  | authorizations for uses and | 552a(b); 45 | and/or      |
| di        | disclosures.]{.underline}   | CFR 5b.9;   | policy.     |
| sclosures |                             | IHS SOR     |             |
| for which | **(1)** [Authorization      | 09-17-0001  | Send to OPH |
| an        | required: general           |             | mental      |
| auth      | rule.]{.underline} Except   | Not covered | health      |
| orization | as otherwise permitted or   | in PA, HHS, | office for  |
| is        | required by this            | or IHS.     | input       |
| required] | subchapter, a covered       |             | regarding   |
| (../HIPAA | entity may not use or       | 6 year      | impl        |
| %20Privac | disclose protected health   | retention.  | ementation. |
| y%20Rule. | information without an      |             |             |
| doc#_Hlk5 | authorization that is valid | Required.   | Have        |
| 16629583) | under this section. When a  |             | workgroup   |
|           | covered entity obtains or   | Required.   | consisting  |
|           | receives a valid            |             | of          |
|           | authorization for its use   | Required.   | appropriate |
|           | or disclosure of protected  |             | staff       |
|           | health information, such    | Required.   | develop the |
|           | use or disclosure must be   |             | written     |
|           | consistent with such        | Required.   | au          |
|           | authorization.              |             | thorization |
|           |                             | Required.   | and the     |
|           | **(2)** [Authorization      |             | policy and  |
|           | required: psychotherapy     | Required.   | procedure   |
|           | notes.]{.underline}         |             | to          |
|           | Notwithstanding any other   | Required.   | implement.  |
|           | provision of this subpart,  |             |             |
|           | other than transition       | Required.   | (OPH,       |
|           | provisions provided for in  |             | medical,    |
|           | § 164.532, a covered entity | Required.   | business    |
|           | must obtain an              |             | office,     |
|           | authorization for any use   | Required.   | chs,        |
|           | or disclosure of            |             | privacy     |
|           | psychotherapy notes,        | Required.   | staff, OGC, |
|           | except:                     |             | etc.)       |
|           |                             | Required.   |             |
|           | \(i\) To carry out the      |             | Send to     |
|           | following treatment,        | Required.   | research    |
|           | payment, or health care     |             | staff for   |
|           | operations, consistent with | Required.   | input re:   |
|           | consent requirements in §   |             | imp         |
|           | 164.506:                    | Required.   | lementation |
|           |                             |             |             |
|           | \(A\) Use by originator of  | Required.   | Send to     |
|           | the psychotherapy notes for |             | research    |
|           | treatment;                  | Required.   | staff for   |
|           |                             |             | input re:   |
|           | \(B\) Use or disclosure by  |             | imp         |
|           | the covered entity in       |             | lementation |
|           | training programs in which  |             |             |
|           | students, trainees, or      |             | Have        |
|           | practitioners in mental     |             | workgroup   |
|           | health learn under          |             | consisting  |
|           | supervision to practice or  |             | of          |
|           | improve their skills in     |             | appropriate |
|           | group, joint, family, or    |             | staff       |
|           | individual counseling; or   |             | develop the |
|           |                             |             | written     |
|           | \(C\) Use or disclosure by  |             | au          |
|           | the covered entity to       |             | thorization |
|           | defend a legal action or    |             | and the     |
|           | other proceeding brought by |             | policy and  |
|           | the individual; and         |             | procedure   |
|           |                             |             | to          |
|           | \(ii\) A use or disclosure  |             | implement.  |
|           | that is required by §       |             |             |
|           | 164.502(a)(2)(ii) or        |             | (OPH,       |
|           | permitted by § 164.512(a);  |             | medical,    |
|           | § 164.512(d) with respect   |             | business    |
|           | to the oversight of the     |             | office,     |
|           | originator of the           |             | chs,        |
|           | psychotherapy notes; §      |             | privacy     |
|           | 164.512(g)(1); or §         |             | staff, OGC, |
|           | 164.512(j)(1)(i).           |             | etc.)       |
|           |                             |             |             |
|           | \(b\) [Implementation       |             | Send to     |
|           | specifications: general     |             | research    |
|           | requirements.]{.underline}  |             | staff for   |
|           |                             |             | input re:   |
|           | \(1\) [Valid                |             | imp         |
|           | a                           |             | lementation |
|           | uthorizations.]{.underline} |             |             |
|           |                             |             |             |
|           | \(i\) A valid authorization |             |             |
|           | is a document that contains |             |             |
|           | the elements listed in      |             |             |
|           | paragraph (c) and, as       |             |             |
|           | applicable, paragraph (d),  |             |             |
|           | (e), or (f) of this         |             |             |
|           | section.                    |             |             |
|           |                             |             |             |
|           | \(ii\) A valid              |             |             |
|           | authorization may contain   |             |             |
|           | elements or information in  |             |             |
|           | addition to the elements    |             |             |
|           | required by this section,   |             |             |
|           | provided that such          |             |             |
|           | additional elements or      |             |             |
|           | information are not be      |             |             |
|           | inconsistent with the       |             |             |
|           | elements required by this   |             |             |
|           | section.                    |             |             |
|           |                             |             |             |
|           | \(2\) [Defective            |             |             |
|           | a                           |             |             |
|           | uthorizations.]{.underline} |             |             |
|           | An authorization is not     |             |             |
|           | valid, if the document      |             |             |
|           | submitted has any of the    |             |             |
|           | following defects:          |             |             |
|           |                             |             |             |
|           | \(i\) The expiration date   |             |             |
|           | has passed or the           |             |             |
|           | expiration event is known   |             |             |
|           | by the covered entity to    |             |             |
|           | have occurred;              |             |             |
|           |                             |             |             |
|           | \(ii\) The authorization    |             |             |
|           | has not been filled out     |             |             |
|           | completely, with respect to |             |             |
|           | an element described by     |             |             |
|           | paragraph (c), (d), (e), or |             |             |
|           | (f) of this section, if     |             |             |
|           | applicable;                 |             |             |
|           |                             |             |             |
|           | \(iii\) The authorization   |             |             |
|           | is known by the covered     |             |             |
|           | entity to have been         |             |             |
|           | revoked;                    |             |             |
|           |                             |             |             |
|           | \(iv\) The authorization    |             |             |
|           | lacks an element required   |             |             |
|           | by paragraph (c), (d), (e), |             |             |
|           | or (f) of this section, if  |             |             |
|           | applicable;                 |             |             |
|           |                             |             |             |
|           | \(v\) The authorization     |             |             |
|           | violates paragraph (b)(3)   |             |             |
|           | of this section, if         |             |             |
|           | applicable;                 |             |             |
|           |                             |             |             |
|           | \(vi\) Any material         |             |             |
|           | information in the          |             |             |
|           | authorization is known by   |             |             |
|           | the covered entity to be    |             |             |
|           | false.                      |             |             |
|           |                             |             |             |
|           | **(3)** [Compound           |             |             |
|           | a                           |             |             |
|           | uthorizations.]{.underline} |             |             |
|           | An authorization for use or |             |             |
|           | disclosure of protected     |             |             |
|           | health information may not  |             |             |
|           | be combined with any other  |             |             |
|           | document to create a        |             |             |
|           | compound authorization,     |             |             |
|           | except as follows:          |             |             |
|           |                             |             |             |
|           | \(i\) An authorization for  |             |             |
|           | the use or disclosure of    |             |             |
|           | protected health            |             |             |
|           | information created for     |             |             |
|           | research that includes      |             |             |
|           | treatment of the individual |             |             |
|           | may be combined as          |             |             |
|           | permitted by §              |             |             |
|           | 164.506(b)(4)(ii) or        |             |             |
|           | paragraph (f) of this       |             |             |
|           | section;                    |             |             |
|           |                             |             |             |
|           | \(ii\) An authorization for |             |             |
|           | a use or disclosure of      |             |             |
|           | psychotherapy notes may     |             |             |
|           | only be combined with       |             |             |
|           | another authorization for a |             |             |
|           | use or disclosure of        |             |             |
|           | psychotherapy notes;        |             |             |
|           |                             |             |             |
|           | \(iii\) An authorization    |             |             |
|           | under this section, other   |             |             |
|           | than an authorization for a |             |             |
|           | use or disclosure of        |             |             |
|           | psychotherapy notes may be  |             |             |
|           | combined with any other     |             |             |
|           | such authorization under    |             |             |
|           | this section, except when a |             |             |
|           | covered entity has          |             |             |
|           | conditioned the provision   |             |             |
|           | of treatment, payment,      |             |             |
|           | enrollment in the health    |             |             |
|           | plan, or eligibility for    |             |             |
|           | benefits under paragraph    |             |             |
|           | (b)(4) of this section on   |             |             |
|           | the provision of one of the |             |             |
|           | authorizations.             |             |             |
|           |                             |             |             |
|           | **(4)** [Prohibition on     |             |             |
|           | conditioning of             |             |             |
|           | a                           |             |             |
|           | uthorizations.]{.underline} |             |             |
|           | A covered entity may not    |             |             |
|           | condition the provision to  |             |             |
|           | an individual of treatment, |             |             |
|           | payment, enrollment in the  |             |             |
|           | health plan, or eligibility |             |             |
|           | for benefits on the         |             |             |
|           | provision of an             |             |             |
|           | authorization, except:      |             |             |
|           |                             |             |             |
|           | \(i\) A covered health care |             |             |
|           | provider may condition the  |             |             |
|           | provision of                |             |             |
|           | research-related treatment  |             |             |
|           | on provision of an          |             |             |
|           | authorization under         |             |             |
|           | paragraph (f) of this       |             |             |
|           | section;                    |             |             |
|           |                             |             |             |
|           | \(ii\) A health plan may    |             |             |
|           | condition enrollment in the |             |             |
|           | health plan or eligibility  |             |             |
|           | for benefits on provision   |             |             |
|           | of an authorization         |             |             |
|           | requested by the health     |             |             |
|           | plan prior to an            |             |             |
|           | individual\'s enrollment in |             |             |
|           | the health plan, if:        |             |             |
|           |                             |             |             |
|           | \(A\) The authorization     |             |             |
|           | sought is for the health    |             |             |
|           | plan's eligibility or       |             |             |
|           | enrollment determinations   |             |             |
|           | relating to the individual  |             |             |
|           | or for its underwriting or  |             |             |
|           | risk rating determinations; |             |             |
|           | and                         |             |             |
|           |                             |             |             |
|           | \(B\) The authorization is  |             |             |
|           | not for a use or disclosure |             |             |
|           | of psychotherapy notes      |             |             |
|           | under paragraph (a)(2) of   |             |             |
|           | this section;               |             |             |
|           |                             |             |             |
|           | \(iii\) A health plan may   |             |             |
|           | condition payment of a      |             |             |
|           | claim for specified         |             |             |
|           | benefits on provision of an |             |             |
|           | authorization under         |             |             |
|           | paragraph (e) of this       |             |             |
|           | section, if:                |             |             |
|           |                             |             |             |
|           | \(A\) The disclosure is     |             |             |
|           | necessary to determine      |             |             |
|           | payment of such claim; and  |             |             |
|           |                             |             |             |
|           | \(B\) The authorization is  |             |             |
|           | not for a use or disclosure |             |             |
|           | of psychotherapy notes      |             |             |
|           | under paragraph (a)(2) of   |             |             |
|           | this section; and           |             |             |
|           |                             |             |             |
|           | \(iv\) A covered entity may |             |             |
|           | condition the provision of  |             |             |
|           | health care that is solely  |             |             |
|           | for the purpose of creating |             |             |
|           | protected health            |             |             |
|           | information for disclosure  |             |             |
|           | to a third party on         |             |             |
|           | provision of an             |             |             |
|           | authorization for the       |             |             |
|           | disclosure of the protected |             |             |
|           | health information to such  |             |             |
|           | third party.                |             |             |
|           |                             |             |             |
|           | **(5)** [Revocation of      |             |             |
|           | a                           |             |             |
|           | uthorizations.]{.underline} |             |             |
|           | An individual may revoke an |             |             |
|           | authorization provided      |             |             |
|           | under this section at any   |             |             |
|           | time, provided that the     |             |             |
|           | revocation is in writing,   |             |             |
|           | except to the extent that:  |             |             |
|           |                             |             |             |
|           | \(i\) The covered entity    |             |             |
|           | has taken action in         |             |             |
|           | reliance thereon; or        |             |             |
|           |                             |             |             |
|           | \(ii\) If the authorization |             |             |
|           | was obtained as a condition |             |             |
|           | of obtaining insurance      |             |             |
|           | coverage, other law         |             |             |
|           | provides the insurer with   |             |             |
|           | the right to contest a      |             |             |
|           | claim under the policy.     |             |             |
|           |                             |             |             |
|           | **(6)**                     |             |             |
|           | [                           |             |             |
|           | Documentation.]{.underline} |             |             |
|           | A covered entity must       |             |             |
|           | document and retain any     |             |             |
|           | signed authorization under  |             |             |
|           | this section as required by |             |             |
|           | § 164.530(j).               |             |             |
|           |                             |             |             |
|           | **(c)** [Implementation     |             |             |
|           | specifications: core        |             |             |
|           | elements and                |             |             |
|           | requirements.]{.underline}  |             |             |
|           |                             |             |             |
|           | \(1\) [Core                 |             |             |
|           | elements.]{.underline} A    |             |             |
|           | valid authorization under   |             |             |
|           | this section must contain   |             |             |
|           | at least the following      |             |             |
|           | elements:                   |             |             |
|           |                             |             |             |
|           | \(i\) A description of the  |             |             |
|           | information to be used or   |             |             |
|           | disclosed that identifies   |             |             |
|           | the information in a        |             |             |
|           | specific and meaningful     |             |             |
|           | fashion;                    |             |             |
|           |                             |             |             |
|           | \(ii\) The name or other    |             |             |
|           | specific identification of  |             |             |
|           | the person(s), or class of  |             |             |
|           | persons, authorized to make |             |             |
|           | the requested use or        |             |             |
|           | disclosure;                 |             |             |
|           |                             |             |             |
|           | \(iii\) The name or other   |             |             |
|           | specific identification of  |             |             |
|           | the person(s), or class of  |             |             |
|           | persons, to whom the        |             |             |
|           | covered entity may make the |             |             |
|           | requested use or            |             |             |
|           | disclosure;                 |             |             |
|           |                             |             |             |
|           | \(iv\) An expiration date   |             |             |
|           | or an expiration event that |             |             |
|           | relates to the individual   |             |             |
|           | or the purpose of the use   |             |             |
|           | or disclosure;              |             |             |
|           |                             |             |             |
|           | \(v\) A statement of the    |             |             |
|           | individual's right to       |             |             |
|           | revoke the authorization in |             |             |
|           | writing and the exceptions  |             |             |
|           | to the right to revoke,     |             |             |
|           | together with a description |             |             |
|           | of how the individual may   |             |             |
|           | revoke the authorization;   |             |             |
|           |                             |             |             |
|           | \(vi\) A statement that     |             |             |
|           | information used or         |             |             |
|           | disclosed pursuant to the   |             |             |
|           | authorization may be        |             |             |
|           | subject to redisclosure by  |             |             |
|           | the recipient and no longer |             |             |
|           | be protected by this rule;  |             |             |
|           |                             |             |             |
|           | \(vii\) Signature of the    |             |             |
|           | individual and date; and    |             |             |
|           |                             |             |             |
|           | \(viii\) If the             |             |             |
|           | authorization is signed by  |             |             |
|           | a personal representative   |             |             |
|           | of the individual, a        |             |             |
|           | description of such         |             |             |
|           | representative's authority  |             |             |
|           | to act for the individual.  |             |             |
|           |                             |             |             |
|           | \(2\) [Plain language       |             |             |
|           | requirement.]{.underline}   |             |             |
|           | The authorization must be   |             |             |
|           | written in plain language.  |             |             |
|           |                             |             |             |
|           | **(d)** [Implementation     |             |             |
|           | specifications:             |             |             |
|           | authorizations requested by |             |             |
|           | a covered entity for its    |             |             |
|           | own uses and                |             |             |
|           | disclosures.]{.underline}   |             |             |
|           | If an authorization is      |             |             |
|           | requested by a covered      |             |             |
|           | entity for its own use or   |             |             |
|           | disclosure of protected     |             |             |
|           | health information that it  |             |             |
|           | maintains, the covered      |             |             |
|           | entity must comply with the |             |             |
|           | following requirements.     |             |             |
|           |                             |             |             |
|           | \(1\) [Required             |             |             |
|           | elements.]{.underline} The  |             |             |
|           | authorization for the uses  |             |             |
|           | or disclosures described in |             |             |
|           | this paragraph must, in     |             |             |
|           | addition to meeting the     |             |             |
|           | requirements of paragraph   |             |             |
|           | (c) of this section,        |             |             |
|           | contain the following       |             |             |
|           | elements:                   |             |             |
|           |                             |             |             |
|           | \(i\) For any authorization |             |             |
|           | to which the prohibition on |             |             |
|           | conditioning in paragraph   |             |             |
|           | (b)(4) of this section      |             |             |
|           | applies, a statement that   |             |             |
|           | the covered entity will not |             |             |
|           | condition treatment,        |             |             |
|           | payment, enrollment in the  |             |             |
|           | health plan, or eligibility |             |             |
|           | for benefits on the         |             |             |
|           | individual\'s providing     |             |             |
|           | authorization for the       |             |             |
|           | requested use or            |             |             |
|           | disclosure;                 |             |             |
|           |                             |             |             |
|           | \(ii\) A description of     |             |             |
|           | each purpose of the         |             |             |
|           | requested use or            |             |             |
|           | disclosure;                 |             |             |
|           |                             |             |             |
|           | \(iii\) A statement that    |             |             |
|           | the individual may:         |             |             |
|           |                             |             |             |
|           | \(A\) Inspect or copy the   |             |             |
|           | protected health            |             |             |
|           | information to be used or   |             |             |
|           | disclosed as provided in §  |             |             |
|           | 164.524; and                |             |             |
|           |                             |             |             |
|           | \(B\) Refuse to sign the    |             |             |
|           | authorization; and          |             |             |
|           |                             |             |             |
|           | \(iv\) If use or disclosure |             |             |
|           | of the requested            |             |             |
|           | information will result in  |             |             |
|           | direct or indirect          |             |             |
|           | remuneration to the covered |             |             |
|           | entity from a third party,  |             |             |
|           | a statement that such       |             |             |
|           | remuneration will result.   |             |             |
|           |                             |             |             |
|           | \(2\) [Copy to the          |             |             |
|           | individual.]{.underline} A  |             |             |
|           | covered entity must provide |             |             |
|           | the individual with a copy  |             |             |
|           | of the signed               |             |             |
|           | authorization.              |             |             |
|           |                             |             |             |
|           | **(e)** [Implementation     |             |             |
|           | specifications:             |             |             |
|           | authorizations requested by |             |             |
|           | a covered entity for        |             |             |
|           | disclosures by              |             |             |
|           | others.]{.underline} If an  |             |             |
|           | authorization is requested  |             |             |
|           | by a covered entity for     |             |             |
|           | another covered entity to   |             |             |
|           | disclose protected health   |             |             |
|           | information to the covered  |             |             |
|           | entity requesting the       |             |             |
|           | authorization to carry out  |             |             |
|           | treatment, payment, or      |             |             |
|           | health care operations, the |             |             |
|           | covered entity requesting   |             |             |
|           | the authorization must      |             |             |
|           | comply with the following   |             |             |
|           | requirements.               |             |             |
|           |                             |             |             |
|           | \(1\) [Required             |             |             |
|           | elements.]{.underline} The  |             |             |
|           | authorization for the       |             |             |
|           | disclosures described in    |             |             |
|           | this paragraph must, in     |             |             |
|           | addition to meeting the     |             |             |
|           | requirements of paragraph   |             |             |
|           | (c) of this section,        |             |             |
|           | contain the following       |             |             |
|           | elements:                   |             |             |
|           |                             |             |             |
|           | \(i\) A description of each |             |             |
|           | purpose of the requested    |             |             |
|           | disclosure;                 |             |             |
|           |                             |             |             |
|           | \(ii\) Except for an        |             |             |
|           | authorization on which      |             |             |
|           | payment may be conditioned  |             |             |
|           | under paragraph (b)(4)(iii) |             |             |
|           | of this section, a          |             |             |
|           | statement that the covered  |             |             |
|           | entity will not condition   |             |             |
|           | treatment, payment,         |             |             |
|           | enrollment in the health    |             |             |
|           | plan, or eligibility for    |             |             |
|           | benefits on the             |             |             |
|           | individual\'s providing     |             |             |
|           | authorization for the       |             |             |
|           | requested use or            |             |             |
|           | disclosure; and             |             |             |
|           |                             |             |             |
|           | \(iii\) A statement that    |             |             |
|           | the individual may refuse   |             |             |
|           | to sign the authorization.  |             |             |
|           |                             |             |             |
|           | \(2\) [Copy to the          |             |             |
|           | individual.]{.underline} A  |             |             |
|           | covered entity must provide |             |             |
|           | the individual with a copy  |             |             |
|           | of the signed               |             |             |
|           | authorization.              |             |             |
|           |                             |             |             |
|           | **(f)** [Implementation     |             |             |
|           | specifications:             |             |             |
|           | authorizations for uses and |             |             |
|           | disclosures of protected    |             |             |
|           | health information created  |             |             |
|           | for research that includes  |             |             |
|           | treatment of the            |             |             |
|           | individual.]{.underline}    |             |             |
|           |                             |             |             |
|           | \(1\) [Required             |             |             |
|           | elements.]{.underline}      |             |             |
|           | Except as otherwise         |             |             |
|           | permitted by § 164.512(i),  |             |             |
|           | a covered entity that       |             |             |
|           | creates protected health    |             |             |
|           | information for the         |             |             |
|           | purpose, in whole or in     |             |             |
|           | part, of research that      |             |             |
|           | includes treatment of       |             |             |
|           | individuals must obtain an  |             |             |
|           | authorization for the use   |             |             |
|           | or disclosure of such       |             |             |
|           | information. Such           |             |             |
|           | authorization must:         |             |             |
|           |                             |             |             |
|           | \(i\) For uses and          |             |             |
|           | disclosures not otherwise   |             |             |
|           | permitted or required under |             |             |
|           | this subpart, meet the      |             |             |
|           | requirements of paragraphs  |             |             |
|           | (c) and (d) of this         |             |             |
|           | section; and                |             |             |
|           |                             |             |             |
|           | \(ii\) Contain:             |             |             |
|           |                             |             |             |
|           | \(A\) A description of the  |             |             |
|           | extent to which such        |             |             |
|           | protected health            |             |             |
|           | information will be used or |             |             |
|           | disclosed to carry out      |             |             |
|           | treatment, payment, or      |             |             |
|           | health care operations;     |             |             |
|           |                             |             |             |
|           | \(B\) A description of any  |             |             |
|           | protected health            |             |             |
|           | information that will not   |             |             |
|           | be used or disclosed for    |             |             |
|           | purposes permitted in       |             |             |
|           | accordance with §§ 164.510  |             |             |
|           | and 164.512, provided that  |             |             |
|           | the covered entity may not  |             |             |
|           | include a limitation        |             |             |
|           | affecting its right to make |             |             |
|           | a use or disclosure that is |             |             |
|           | required by law or          |             |             |
|           | permitted by §              |             |             |
|           | 164.512(j)(1)(i); and       |             |             |
|           |                             |             |             |
|           | \(C\) If the covered entity |             |             |
|           | has obtained or intends to  |             |             |
|           | obtain the individual's     |             |             |
|           | consent under § 164.506, or |             |             |
|           | has provided or intends to  |             |             |
|           | provide the individual with |             |             |
|           | a notice under § 164.520,   |             |             |
|           | the authorization must      |             |             |
|           | refer to that consent or    |             |             |
|           | notice, as applicable, and  |             |             |
|           | state that the statements   |             |             |
|           | made pursuant to this       |             |             |
|           | section are binding.        |             |             |
|           |                             |             |             |
|           | \(2\) [Optional             |             |             |
|           | procedure.]{.underline} An  |             |             |
|           | authorization under this    |             |             |
|           | paragraph may be in the     |             |             |
|           | same document as: (i) A     |             |             |
|           | consent to participate in   |             |             |
|           | the research;               |             |             |
|           |                             |             |             |
|           | \(ii\) A consent to use or  |             |             |
|           | disclose protected health   |             |             |
|           | information to carry out    |             |             |
|           | treatment, payment, or      |             |             |
|           | health care operations      |             |             |
|           | under § 164.506; or         |             |             |
|           |                             |             |             |
|           | \(iii\) A notice of privacy |             |             |
|           | practices under § 164.520.  |             |             |
+-----------+-----------------------------+-------------+-------------+
| [§        | A covered entity may use or | Advance     | Have        |
| 164.510   | disclose protected health   | notice with | workgroup   |
| Uses and  | information without the     | opportunity | consisting  |
| di        | written consent or          | to agree or | of          |
| sclosures | authorization of the        | disagree.   | appropriate |
| requiring | individual as described by  |             | staff       |
| an        | §§ 164.506 and 164.508,     | Does the    | develop the |
| op        | respectively, provided that | oral notice | policy and  |
| portunity | the individual is informed  | and         | procedure   |
| for the   | in advance of the use or    | agreement   | to          |
| i         | disclosure and has the      | have to be  | implement.  |
| ndividual | opportunity to agree to or  | recorded in |             |
| to agree  | prohibit or restrict the    | writing by  | (OPH,       |
| or to     | disclosure in accordance    | the covered | medical,    |
| object]   | with the applicable         | entity?     | business    |
| (../HIPAA | requirements of this        |             | office,     |
| %20Privac | section. The covered entity | Required    | chs,        |
| y%20Rule. | may orally inform the       |             | privacy     |
| doc#_Hlk5 | individual of and obtain    | Verbally or | staff, OGC, |
| 16629643) | the individual's oral       | in writing. | etc.)       |
|           | agreement or objection to a | Can this be |             |
|           | use or disclosure permitted | a gesture   | Have        |
|           | by this section.            | or must it  | workgroup   |
|           |                             | be in       | consisting  |
|           | **(a)** [Standard: use and  | writing.    | of          |
|           | disclosure for facility     |             | appropriate |
|           | directories.]{.underline}   | P           | staff       |
|           |                             | rofessional | develop the |
|           | \(1\) [Permitted uses and   | judgment    | policy and  |
|           | disclosure.]{.underline}    |             | procedure   |
|           | Except when an objection is | #           | to          |
|           | expressed in accordance     |  Profession | implement.  |
|           | with paragraphs (a)(2) or   | al judgment |             |
|           | (3) of this section, a      |             | (OPH,       |
|           | covered health care         | #           | medical,    |
|           | provider may:               |  Profession | business    |
|           |                             | al judgment | office,     |
|           | \(i\) Use the following     |             | chs,        |
|           | protected health            |             | privacy     |
|           | information to maintain a   |             | staff, OGC, |
|           | directory of individuals in |             | etc.)       |
|           | its facility:               |             |             |
|           |                             |             | Have        |
|           | \(A\) The individual's      |             | workgroup   |
|           | name;                       |             | consisting  |
|           |                             |             | of          |
|           | \(B\) The individual's      |             | appropriate |
|           | location in the covered     |             | staff       |
|           | health care provider's      |             | develop the |
|           | facility;                   |             | policy and  |
|           |                             |             | procedure   |
|           | \(C\) The individual's      |             | to          |
|           | condition described in      |             | implement.  |
|           | general terms that does not |             |             |
|           | communicate specific        |             | (OPH,       |
|           | medical information about   |             | medical,    |
|           | the individual; and         |             | business    |
|           |                             |             | office,     |
|           | \(D\) The individual's      |             | chs,        |
|           | religious affiliation; and  |             | privacy     |
|           |                             |             | staff, OGC, |
|           | \(ii\) Disclose for         |             | etc.)       |
|           | directory purposes such     |             |             |
|           | information:                |             |             |
|           |                             |             |             |
|           | \(A\) To members of the     |             |             |
|           | clergy; or                  |             |             |
|           |                             |             |             |
|           | \(B\) Except for religious  |             |             |
|           | affiliation, to other       |             |             |
|           | persons who ask for the     |             |             |
|           | individual by name.         |             |             |
|           |                             |             |             |
|           | \(2\) [Opportunity to       |             |             |
|           | object.]{.underline} A      |             |             |
|           | covered health care         |             |             |
|           | provider must inform an     |             |             |
|           | individual of the protected |             |             |
|           | health information that it  |             |             |
|           | may include in a directory  |             |             |
|           | and the persons to whom it  |             |             |
|           | may disclose such           |             |             |
|           | information (including      |             |             |
|           | disclosures to clergy of    |             |             |
|           | information regarding       |             |             |
|           | religious affiliation) and  |             |             |
|           | provide the individual with |             |             |
|           | the opportunity to restrict |             |             |
|           | or prohibit some or all of  |             |             |
|           | the uses or disclosures     |             |             |
|           | permitted by paragraph      |             |             |
|           | (a)(1) of this section.     |             |             |
|           |                             |             |             |
|           | **(3)** [Emergency          |             |             |
|           | circumstances.]{.underline} |             |             |
|           |                             |             |             |
|           | \(i\) If the opportunity to |             |             |
|           | object to uses or           |             |             |
|           | disclosures required by     |             |             |
|           | paragraph (a)(2) of this    |             |             |
|           | section cannot practicably  |             |             |
|           | be provided because of the  |             |             |
|           | individual's incapacity or  |             |             |
|           | an emergency treatment      |             |             |
|           | circumstance, a covered     |             |             |
|           | health care provider may    |             |             |
|           | use or disclose some or all |             |             |
|           | of the protected health     |             |             |
|           | information permitted by    |             |             |
|           | paragraph (a)(1) of this    |             |             |
|           | section for the facility's  |             |             |
|           | directory, if such          |             |             |
|           | disclosure is:              |             |             |
|           |                             |             |             |
|           | \(A\) Consistent with a     |             |             |
|           | prior expressed preference  |             |             |
|           | of the individual, if any,  |             |             |
|           | that is known to the        |             |             |
|           | covered health care         |             |             |
|           | provider; and               |             |             |
|           |                             |             |             |
|           | \(B\) In the individual's   |             |             |
|           | best interest as determined |             |             |
|           | by the covered health care  |             |             |
|           | provider, in the exercise   |             |             |
|           | of professional judgment.   |             |             |
|           |                             |             |             |
|           | \(ii\) The covered health   |             |             |
|           | care provider must inform   |             |             |
|           | the individual and provide  |             |             |
|           | an opportunity to object to |             |             |
|           | uses or disclosures for     |             |             |
|           | directory purposes as       |             |             |
|           | required by paragraph       |             |             |
|           | (a)(2) of this section when |             |             |
|           | it becomes practicable to   |             |             |
|           | do so.                      |             |             |
|           |                             |             |             |
|           | **(b)** [Standard: uses and |             |             |
|           | disclosures for involvement |             |             |
|           | in the individual's care    |             |             |
|           | and notification            |             |             |
|           | purposes.]{.underline}      |             |             |
|           |                             |             |             |
|           | \(1\) [Permitted uses and   |             |             |
|           | disclosures.]{.underline}   |             |             |
|           |                             |             |             |
|           | \(i\) A covered entity may, |             |             |
|           | in accordance with          |             |             |
|           | paragraphs (b)(2) or (3) of |             |             |
|           | this section, disclose to a |             |             |
|           | family member, other        |             |             |
|           | relative, or a close        |             |             |
|           | personal friend of the      |             |             |
|           | individual, or any other    |             |             |
|           | person identified by the    |             |             |
|           | individual, the protected   |             |             |
|           | health information directly |             |             |
|           | relevant to such person's   |             |             |
|           | involvement with the        |             |             |
|           | individual's care or        |             |             |
|           | payment related to the      |             |             |
|           | individual's health care.   |             |             |
|           |                             |             |             |
|           | \(ii\) A covered entity may |             |             |
|           | use or disclose protected   |             |             |
|           | health information to       |             |             |
|           | notify, or assist in the    |             |             |
|           | notification of (including  |             |             |
|           | identifying or locating), a |             |             |
|           | family member, a personal   |             |             |
|           | representative of the       |             |             |
|           | individual, or another      |             |             |
|           | person responsible for the  |             |             |
|           | care of the individual of   |             |             |
|           | the individual's location,  |             |             |
|           | general condition, or       |             |             |
|           | death. Any such use or      |             |             |
|           | disclosure of protected     |             |             |
|           | health information for such |             |             |
|           | notification purposes must  |             |             |
|           | be in accordance with       |             |             |
|           | paragraphs (b)(2), (3), or  |             |             |
|           | (4) of this section, as     |             |             |
|           | applicable.                 |             |             |
|           |                             |             |             |
|           | **(2)** [Uses and           |             |             |
|           | disclosures with the        |             |             |
|           | individual                  |             |             |
|           | present.]{.underline} If    |             |             |
|           | the individual is present   |             |             |
|           | for, or otherwise available |             |             |
|           | prior to, a use or          |             |             |
|           | disclosure permitted by     |             |             |
|           | paragraph (b)(1) of this    |             |             |
|           | section and has the         |             |             |
|           | capacity to make health     |             |             |
|           | care decisions, the covered |             |             |
|           | entity may use or disclose  |             |             |
|           | the protected health        |             |             |
|           | information if it:          |             |             |
|           |                             |             |             |
|           | \(i\) Obtains the           |             |             |
|           | individual's agreement;     |             |             |
|           |                             |             |             |
|           | \(ii\) Provides the         |             |             |
|           | individual with the         |             |             |
|           | opportunity to object to    |             |             |
|           | the disclosure, and the     |             |             |
|           | individual does not express |             |             |
|           | an objection; or            |             |             |
|           |                             |             |             |
|           | \(iii\) Reasonably infers   |             |             |
|           | from the circumstances,     |             |             |
|           | based the exercise of       |             |             |
|           | professional judgment, that |             |             |
|           | the individual does not     |             |             |
|           | object to the disclosure.   |             |             |
|           |                             |             |             |
|           | **(3)** [Limited uses and   |             |             |
|           | disclosures when the        |             |             |
|           | individual is not           |             |             |
|           | present.]{.underline} If    |             |             |
|           | the individual is not       |             |             |
|           | present for, or the         |             |             |
|           | opportunity to agree or     |             |             |
|           | object to the use or        |             |             |
|           | disclosure cannot           |             |             |
|           | practicably be provided     |             |             |
|           | because of the individual's |             |             |
|           | incapacity or an emergency  |             |             |
|           | circumstance, the covered   |             |             |
|           | entity may, in the exercise |             |             |
|           | of professional judgment,   |             |             |
|           | determine whether the       |             |             |
|           | disclosure is in the best   |             |             |
|           | interests of the individual |             |             |
|           | and, if so, disclose only   |             |             |
|           | the protected health        |             |             |
|           | information that is         |             |             |
|           | directly relevant to the    |             |             |
|           | person's involvement with   |             |             |
|           | the individual's health     |             |             |
|           | care. A covered entity may  |             |             |
|           | use professional judgment   |             |             |
|           | and its experience with     |             |             |
|           | common practice to make     |             |             |
|           | reasonable inferences of    |             |             |
|           | the individual's best       |             |             |
|           | interest in allowing a      |             |             |
|           | person to act on behalf of  |             |             |
|           | the individual to pick up   |             |             |
|           | filled prescriptions,       |             |             |
|           | medical supplies, X-rays,   |             |             |
|           | or other similar forms of   |             |             |
|           | protected health            |             |             |
|           | information.                |             |             |
|           |                             |             |             |
|           | **(4)** [Use and            |             |             |
|           | disclosures for disaster    |             |             |
|           | relief                      |             |             |
|           | purposes.]{.underline} A    |             |             |
|           | covered entity may use or   |             |             |
|           | disclose protected health   |             |             |
|           | information to a public or  |             |             |
|           | private entity authorized   |             |             |
|           | by law or by its charter to |             |             |
|           | assist in disaster relief   |             |             |
|           | efforts, for the purpose of |             |             |
|           | coordinating with such      |             |             |
|           | entities the uses or        |             |             |
|           | disclosures permitted by    |             |             |
|           | paragraph (b)(1)(ii) of     |             |             |
|           | this section. The           |             |             |
|           | requirements in paragraphs  |             |             |
|           | (b)(2) and (3) of this      |             |             |
|           | section apply to such uses  |             |             |
|           | and disclosure to the       |             |             |
|           | extent that the covered     |             |             |
|           | entity, in the exercise of  |             |             |
|           | professional judgment,      |             |             |
|           | determines that the         |             |             |
|           | requirements do not         |             |             |
|           | interfere with the ability  |             |             |
|           | to respond to the emergency |             |             |
|           | circumstances.              |             |             |
+-----------+-----------------------------+-------------+-------------+
| [§        | A covered entity may use or | Provide     | Have        |
| 164.512   | disclose protected health   | examples    | workgroup   |
| Uses and  | information without the     |             | consisting  |
| di        | written consent or          | Provide     | of          |
| sclosures | authorization of the        | examples    | appropriate |
| for which | individual as described in  |             | staff       |
| consent,  | §§ 164.506 and 164.508,     | IHS SOR     | develop the |
| an        | respectively, or the        | 09-17-0001, | policy and  |
| autho     | opportunity for the         | Routine     | procedure   |
| rization, | individual to agree or      | Uses 7 & 8. | to          |
| or        | object as described in §    |             | implement.  |
| op        | 164.510, in the situations  | IHS SOR     |             |
| portunity | covered by this section,    | 09-17-0001, | (OPH,       |
| to agree  | subject to the applicable   | Routine     | medical,    |
| or object | requirements of this        | Uses 7 & 8. | business    |
| is not    | section. When the covered   |             | office,     |
| required] | entity is required by this  | 5 USC       | chs,        |
| (../HIPAA | section to inform the       | 552a(b)(1); | privacy     |
| %20Privac | individual of, or when the  | 45 CFR 5b.  | staff, OGC, |
| y%20Rule. | individual may agree to, a  |             | etc.)       |
| doc#_Hlk5 | use or disclosure permitted | 5 USC       |             |
| 16629684) | by this section, the        | 552a(b); 45 | Have        |
|           | covered entity's            | CFR 5b.9;   | workgroup   |
|           | information and the         | IHS SOR     | consisting  |
|           | individual's agreement may  | 09-17-0001  | of          |
|           | be given orally.            |             | appropriate |
|           |                             | 5 USC       | staff       |
|           | **(a)** [Standard: uses and | 552a(b); 45 | develop the |
|           | disclosures required by     | CFR 5b.9;   | policy and  |
|           | law.]{.underline}           | IHS SOR     | procedure   |
|           |                             | 09-17-0001  | to          |
|           | \(1\) A covered entity may  |             | implement.  |
|           | use or disclose protected   | 5 USC       |             |
|           | health information to the   | 552a(b); 45 | (OPH,       |
|           | extent that such use or     | CFR 5b.9;   | medical,    |
|           | disclosure is required by   | IHS SOR     | business    |
|           | law and the use or          | 09-17-0001  | office,     |
|           | disclosure complies with    |             | chs,        |
|           | and is limited to the       | 5 USC       | privacy     |
|           | relevant requirements of    | 552         | staff, OGC, |
|           | such law.                   | a(b)(j)(k); | etc.)       |
|           |                             | 45 CFR      |             |
|           | \(2\) A covered entity must | 5b.9; IHS   | Have        |
|           | meet the requirements       | SOR         | workgroup   |
|           | described in paragraph (c), | 09-17-0001  | consisting  |
|           | (e), or (f) of this section |             | of          |
|           | for uses or disclosures     | Same as     | appropriate |
|           | required by law.            | above.      | staff       |
|           |                             |             | develop the |
|           | **(b)** [Standard: uses and | 5 USC       | policy and  |
|           | disclosures for public      | 552         | procedure   |
|           | health                      | a(b)(j)(k); | to          |
|           | activities.]{.underline}    | 45 CFR      | implement.  |
|           |                             | 5b.9; IHS   |             |
|           | \(1\) [Permitted            | SOR         | (OPH,       |
|           | disclosures.]{.underline} A | 09-17-0001  | medical,    |
|           | covered entity may disclose |             | business    |
|           | protected health            | 5 USC       | office,     |
|           | information for the public  | 552         | chs,        |
|           | health activities and       | a(b)(j)(k); | privacy     |
|           | purposes described in this  | 45 CFR      | staff, OGC, |
|           | paragraph to:               | 5b.9; IHS   | etc.)       |
|           |                             | SOR         |             |
|           | \(i\) A public health       | 09-17-0001  | Have        |
|           | authority that is           |             | workgroup   |
|           | authorized by law to        | Not covered | consisting  |
|           | collect or receive such     | in PA, HHS, | of          |
|           | information for the purpose | or IHS.     | appropriate |
|           | of preventing or            |             | staff       |
|           | controlling disease,        | Not covered | develop the |
|           | injury, or disability,      | in PA, HHS, | policy and  |
|           | including, but not limited  | or IHS.     | procedure   |
|           | to, the reporting of        |             | to          |
|           | disease, injury, vital      | 5 USC       | implement.  |
|           | events such as birth or     | 552a(b); 45 |             |
|           | death, and the conduct of   | CFR 5b.9;   | (OPH,       |
|           | public health surveillance, | IHS SOR     | medical,    |
|           | public health               | 09-17-0001  | business    |
|           | investigations, and public  |             | office,     |
|           | health interventions; or,   | IHS SOR     | chs,        |
|           | at the direction of a       | 09-17-0001; | privacy     |
|           | public health authority, to | 45 CFR 5b;  | staff, OGC, |
|           | an official of a foreign    | 5 USC 552a  | etc.)       |
|           | government agency that is   |             |             |
|           | acting in collaboration     | 5 USC       | Have        |
|           | with a public health        | 552a(b)(8); | workgroup   |
|           | authority;                  | 45 CFR      | consisting  |
|           |                             | 5b(b8); IHS | of          |
|           | \(ii\) A public health      | SOR         | appropriate |
|           | authority or other          |             | staff       |
|           | appropriate government      | # 5         | develop the |
|           | authority authorized by law | USC 552a(b) | policy and  |
|           | to receive reports of child | (7); 45 CFR | procedure   |
|           | abuse or neglect;           |  5b(b7); IH | to          |
|           |                             | S SOR RU #7 | implement.  |
|           | \(iii\) A person subject to |             |             |
|           | the jurisdiction of the     | Not covered | (OPH,       |
|           | Food and Drug               | in PA, HHS, | medical,    |
|           | Administration:             | or IHS.     | business    |
|           |                             |             | office,     |
|           | \(A\) To report adverse     | Not covered | chs,        |
|           | events (or similar reports  | in PA, HHS, | privacy     |
|           | with respect to food or     | or IHS.     | staff, OGC, |
|           | dietary supplements),       |             | etc.)       |
|           | product defects or problems | Not cited   |             |
|           | (including problems with    | in PA, HHS  | Update SOR  |
|           | the use or labeling of a    | or IHS      | and/or      |
|           | product), or biological     |             | policy.     |
|           | product deviations if the   | Not cited   |             |
|           | disclosure is made to the   | in PA, HHS  | Update SOR  |
|           | person required or directed | or IHS      | and/or      |
|           | to report such information  |             | policy.     |
|           | to the Food and Drug        | Not cited   |             |
|           | Administration;             | in PA, HHS  | Update SOR  |
|           |                             | or IHS      | and/or      |
|           | \(B\) To track products if  |             | policy.     |
|           | the disclosure is made to a | Not cited   |             |
|           | person required or directed | in PA, HHS, | Update SOR  |
|           | by the Food and Drug        | or IHS      | and/or      |
|           | Administration to track the |             | policy.     |
|           | product;                    | 5 USC       |             |
|           |                             | 552a(f);    | Update SOR  |
|           | \(C\) To enable product     | Not cited   | and/or      |
|           | recalls, repairs, or        | in HHS or   | policy.     |
|           | replacement (including      | IHS.        |             |
|           | locating and notifying      |             | Same as     |
|           | individuals who have        | Not cited   | above.      |
|           | received products of        | in HHS or   |             |
|           | product recalls,            | IHS.        | Same as     |
|           | withdrawals, or other       |             | above.      |
|           | problems); or               | Not cited   |             |
|           |                             | in HHS or   | Refer to    |
|           | \(D\) To conduct post       | IHS         | Research    |
|           | marketing surveillance to   |             | for input   |
|           | comply with requirements or | Not cited   | re:         |
|           | at the direction of the     | in HHS or   | imp         |
|           | Food and Drug               | IHS         | lementation |
|           | Administration;             |             |             |
|           |                             | Not cited   | Refer to    |
|           | \(iv\) A person who may     | in HHS or   | Research    |
|           | have been exposed to a      | IHS         | for input   |
|           | communicable disease or may |             | re:         |
|           | otherwise be at risk of     | 5 USC       | impl        |
|           | contracting or spreading a  | 552a(b7);   | ementation. |
|           | disease or condition, if    | 45 CFR      |             |
|           | the covered entity or       | 5b.(b7);    | Refer to    |
|           | public health authority is  | IHS SOR     | Research    |
|           | authorized by law to notify | Routine Use | for input   |
|           | such person as necessary in | #7.         | re:         |
|           | the conduct of a public     |             | impl        |
|           | health intervention or      |             | ementation. |
|           | investigation; or           |             |             |
|           |                             |             | Refer to    |
|           | \(v\) An employer, about an |             | Research    |
|           | individual who is a member  |             | for input   |
|           | of the workforce of the     |             | re:         |
|           | employer, if:               |             | impl        |
|           |                             |             | ementation. |
|           | \(A\) The covered entity is |             |             |
|           | a covered health care       |             | Privacy Act |
|           | provider who is a member of |             | more        |
|           | the workforce of such       |             | stringent;  |
|           | employer or who provides a  |             | legal       |
|           | health care to the          |             | review of   |
|           | individual at the request   |             | "serious &  |
|           | of the employer:            |             | imminent    |
|           |                             |             | threat."    |
|           | (*1*) To conduct an         |             |             |
|           | evaluation relating to      |             | Privacy Act |
|           | medical surveillance of the |             | more        |
|           | workplace; or               |             | stringent   |
|           |                             |             |             |
|           | (*2*) To evaluate whether   |             | Privacy Act |
|           | the individual has a        |             | more        |
|           | work-related illness or     |             | stringent   |
|           | injury;                     |             |             |
|           |                             |             | Not         |
|           | \(B\) The protected health  |             | applicable  |
|           | information that is         |             | to IHS.     |
|           | disclosed consists of       |             |             |
|           | findings concerning a       |             | Not         |
|           | work-related illness or     |             | applicable  |
|           | injury or a                 |             | to IHS.     |
|           | workplace-related medical   |             |             |
|           | surveillance;               |             | Requires    |
|           |                             |             | legal       |
|           | \(C\) The employer needs    |             | review from |
|           | such findings in order to   |             | OGC.        |
|           | comply with its             |             |             |
|           | obligations, under 29 CFR   |             | May not be  |
|           | parts 1904 through 1928, 30 |             | applicable  |
|           | CFR parts 50 through 90, or |             | to IHS, OGC |
|           | under state law having a    |             | review.     |
|           | similar purpose, to record  |             |             |
|           | such illness or injury or   |             | Not         |
|           | to carry out                |             | applicable  |
|           | responsibilities for        |             | to IHS.     |
|           | workplace medical           |             |             |
|           | surveillance;               |             | Not         |
|           |                             |             | applicable  |
|           | \(D\) The covered health    |             | to IHS.     |
|           | care provider provides      |             |             |
|           | written notice to the       |             | Not         |
|           | individual that protected   |             | applicable  |
|           | health information relating |             | to IHS.     |
|           | to the medical surveillance |             |             |
|           | of the workplace and        |             | Not         |
|           | work-related illnesses and  |             | applicable  |
|           | injuries is disclosed to    |             | to IHS.     |
|           | the employer:               |             |             |
|           |                             |             | Update SOR  |
|           | (*1*) By giving a copy of   |             | and/or      |
|           | the notice to the           |             | policy.     |
|           | individual at the time the  |             |             |
|           | health care is provided; or |             | Not         |
|           |                             |             | applicable  |
|           | (*2*) If the health care is |             | to IHS.     |
|           | provided on the work site   |             |             |
|           | of the employer, by posting |             | Not         |
|           | the notice in a prominent   |             | applicable  |
|           | place at the location where |             | to IHS.     |
|           | the health care is          |             |             |
|           | provided.                   |             | Have        |
|           |                             |             | workgroup   |
|           | \(2\) [Permitted            |             | consisting  |
|           | uses.]{.underline} If the   |             | of          |
|           | covered entity also is a    |             | appropriate |
|           | public health authority,    |             | staff       |
|           | the covered entity is       |             | develop the |
|           | permitted to use protected  |             | policy and  |
|           | health information in all   |             | procedures  |
|           | cases in which it is        |             | to          |
|           | permitted to disclose such  |             | implement.  |
|           | information for public      |             |             |
|           | health activities under     |             | (OPH,       |
|           | paragraph (b)(1) of this    |             | medical,    |
|           | section.                    |             | business    |
|           |                             |             | office,     |
|           | **(c)** [Standard:          |             | chs,        |
|           | disclosures about victims   |             | privacy     |
|           | of abuse, neglect or        |             | staff, OGC, |
|           | domestic                    |             | etc.)       |
|           | violence.]{.underline}      |             |             |
|           |                             |             | Have        |
|           | \(1\) [Permitted            |             | workgroup   |
|           | disclosures.]{.underline}   |             | consisting  |
|           | Except for reports of child |             | of          |
|           | abuse or neglect permitted  |             | appropriate |
|           | by paragraph (b)(1)(ii) of  |             | staff       |
|           | this section, a covered     |             | develop the |
|           | entity may disclose         |             | policy and  |
|           | protected health            |             | procedures  |
|           | information about an        |             | to          |
|           | individual whom the covered |             | implement.  |
|           | entity reasonably believes  |             |             |
|           | to be a victim of abuse,    |             | (OPH,       |
|           | neglect, or domestic        |             | medical,    |
|           | violence to a government    |             | business    |
|           | authority, including a      |             | office,     |
|           | social service or           |             | chs,        |
|           | protective services agency, |             | privacy     |
|           | authorized by law to        |             | staff, OGC, |
|           | receive reports of such     |             | etc.)       |
|           | abuse, neglect, or domestic |             |             |
|           | violence:                   |             |             |
|           |                             |             |             |
|           | \(i\) To the extent the     |             |             |
|           | disclosure is required by   |             |             |
|           | law and the disclosure      |             |             |
|           | complies with and is        |             |             |
|           | limited to the relevant     |             |             |
|           | requirements of such law;   |             |             |
|           |                             |             |             |
|           | \(ii\) If the individual    |             |             |
|           | agrees to the disclosure;   |             |             |
|           | or                          |             |             |
|           |                             |             |             |
|           | \(iii\) To the extent the   |             |             |
|           | disclosure is expressly     |             |             |
|           | authorized by statute or    |             |             |
|           | regulation and:             |             |             |
|           |                             |             |             |
|           | \(A\) The covered entity,   |             |             |
|           | in the exercise of          |             |             |
|           | professional judgment,      |             |             |
|           | believes the disclosure is  |             |             |
|           | necessary to prevent        |             |             |
|           | serious harm to the         |             |             |
|           | individual or other         |             |             |
|           | potential victims; or       |             |             |
|           |                             |             |             |
|           | \(B\) If the individual is  |             |             |
|           | unable to agree because of  |             |             |
|           | incapacity, a law           |             |             |
|           | enforcement or other public |             |             |
|           | official authorized to      |             |             |
|           | receive the report          |             |             |
|           | represents that the         |             |             |
|           | protected health            |             |             |
|           | information for which       |             |             |
|           | disclosure is sought is not |             |             |
|           | intended to be used against |             |             |
|           | the individual and that an  |             |             |
|           | immediate enforcement       |             |             |
|           | activity that depends upon  |             |             |
|           | the disclosure would be     |             |             |
|           | materially and adversely    |             |             |
|           | affected by waiting until   |             |             |
|           | the individual is able to   |             |             |
|           | agree to the disclosure.    |             |             |
|           |                             |             |             |
|           | \(2\) [Informing the        |             |             |
|           | individual.]{.underline} A  |             |             |
|           | covered entity that makes a |             |             |
|           | disclosure permitted by     |             |             |
|           | paragraph (c)(1) of this    |             |             |
|           | section must promptly       |             |             |
|           | inform the individual that  |             |             |
|           | such a report has been or   |             |             |
|           | will be made, except if:    |             |             |
|           |                             |             |             |
|           | \(i\) The covered entity,   |             |             |
|           | in the exercise of          |             |             |
|           | professional judgment,      |             |             |
|           | believes informing the      |             |             |
|           | individual would place the  |             |             |
|           | individual at risk of       |             |             |
|           | serious harm; or            |             |             |
|           |                             |             |             |
|           | \(ii\) The covered entity   |             |             |
|           | would be informing a        |             |             |
|           | personal representative,    |             |             |
|           | and the covered entity      |             |             |
|           | reasonably believes the     |             |             |
|           | personal representative is  |             |             |
|           | responsible for the abuse,  |             |             |
|           | neglect, or other injury,   |             |             |
|           | and that informing such     |             |             |
|           | person would not be in the  |             |             |
|           | best interests of the       |             |             |
|           | individual as determined by |             |             |
|           | the covered entity, in the  |             |             |
|           | exercise of professional    |             |             |
|           | judgment.                   |             |             |
|           |                             |             |             |
|           | **(d)** [Standard: uses and |             |             |
|           | disclosures for health      |             |             |
|           | oversight                   |             |             |
|           | activities.]{.underline}    |             |             |
|           |                             |             |             |
|           | \(1\) [Permitted            |             |             |
|           | disclosures.]{.underline} A |             |             |
|           | covered entity may disclose |             |             |
|           | protected health            |             |             |
|           | information to a health     |             |             |
|           | oversight agency for        |             |             |
|           | oversight activities        |             |             |
|           | authorized by law,          |             |             |
|           | including audits; civil,    |             |             |
|           | administrative, or criminal |             |             |
|           | investigations;             |             |             |
|           | inspections; licensure or   |             |             |
|           | disciplinary actions;       |             |             |
|           | civil, administrative, or   |             |             |
|           | criminal proceedings or     |             |             |
|           | actions; or other           |             |             |
|           | activities necessary for    |             |             |
|           | appropriate oversight of:   |             |             |
|           |                             |             |             |
|           | \(i\) The health care       |             |             |
|           | system;                     |             |             |
|           |                             |             |             |
|           | \(ii\) Government benefit   |             |             |
|           | programs for which health   |             |             |
|           | information is relevant to  |             |             |
|           | beneficiary eligibility;    |             |             |
|           |                             |             |             |
|           | \(iii\) Entities subject to |             |             |
|           | government regulatory       |             |             |
|           | programs for which health   |             |             |
|           | information is necessary    |             |             |
|           | for determining compliance  |             |             |
|           | with program standards; or  |             |             |
|           |                             |             |             |
|           | \(iv\) Entities subject to  |             |             |
|           | civil rights laws for which |             |             |
|           | health information is       |             |             |
|           | necessary for determining   |             |             |
|           | compliance.                 |             |             |
|           |                             |             |             |
|           | \(2\) [Exception to health  |             |             |
|           | oversight                   |             |             |
|           | activities.]{.underline}    |             |             |
|           | For the purpose of the      |             |             |
|           | disclosures permitted by    |             |             |
|           | paragraph (d)(1) of this    |             |             |
|           | section, a health oversight |             |             |
|           | activity does not include   |             |             |
|           | an investigation or other   |             |             |
|           | activity in which the       |             |             |
|           | individual is the subject   |             |             |
|           | of the investigation or     |             |             |
|           | activity and such           |             |             |
|           | investigation or other      |             |             |
|           | activity does not arise out |             |             |
|           | of and is not directly      |             |             |
|           | related to:                 |             |             |
|           |                             |             |             |
|           | \(i\) The receipt of health |             |             |
|           | care;                       |             |             |
|           |                             |             |             |
|           | \(ii\) A claim for public   |             |             |
|           | benefits related to health; |             |             |
|           | or                          |             |             |
|           |                             |             |             |
|           | \(iii\) Qualification for,  |             |             |
|           | or receipt of, public       |             |             |
|           | benefits or services when a |             |             |
|           | patient's health is         |             |             |
|           | integral to the claim for   |             |             |
|           | public benefits or          |             |             |
|           | services.                   |             |             |
|           |                             |             |             |
|           | \(3\) [Joint activities or  |             |             |
|           | i                           |             |             |
|           | nvestigations.]{.underline} |             |             |
|           | Notwithstanding paragraph   |             |             |
|           | (d)(2) of this section, if  |             |             |
|           | a health oversight activity |             |             |
|           | or investigation is         |             |             |
|           | conducted in conjunction    |             |             |
|           | with an oversight activity  |             |             |
|           | or investigation relating   |             |             |
|           | to a claim for public       |             |             |
|           | benefits not related to     |             |             |
|           | health, the joint activity  |             |             |
|           | or investigation is         |             |             |
|           | considered a health         |             |             |
|           | oversight activity for      |             |             |
|           | purposes of paragraph (d)   |             |             |
|           | of this section.            |             |             |
|           |                             |             |             |
|           | \(4\) [Permitted            |             |             |
|           | uses.]{.underline} If a     |             |             |
|           | covered entity also is a    |             |             |
|           | health oversight agency,    |             |             |
|           | the covered entity may use  |             |             |
|           | protected health            |             |             |
|           | information for health      |             |             |
|           | oversight activities as     |             |             |
|           | permitted by paragraph (d)  |             |             |
|           | of this section.            |             |             |
|           |                             |             |             |
|           | **(e)** [Standard:          |             |             |
|           | disclosures for judicial    |             |             |
|           | and administrative          |             |             |
|           | proceedings.]{.underline}   |             |             |
|           |                             |             |             |
|           | \(1\) [Permitted            |             |             |
|           | disclosures]{.underline}. A |             |             |
|           | covered entity may disclose |             |             |
|           | protected health            |             |             |
|           | information in the course   |             |             |
|           | of any judicial or          |             |             |
|           | administrative proceeding:  |             |             |
|           |                             |             |             |
|           | \(i\) In response to an     |             |             |
|           | order of a court or         |             |             |
|           | administrative tribunal,    |             |             |
|           | provided that the covered   |             |             |
|           | entity discloses only the   |             |             |
|           | protected health            |             |             |
|           | information expressly       |             |             |
|           | authorized by such order;   |             |             |
|           | or                          |             |             |
|           |                             |             |             |
|           | \(ii\) In response to a     |             |             |
|           | subpoena, discovery         |             |             |
|           | request, or other lawful    |             |             |
|           | process, that is not        |             |             |
|           | accompanied by an order of  |             |             |
|           | a court or administrative   |             |             |
|           | tribunal, if:               |             |             |
|           |                             |             |             |
|           | \(A\) The covered entity    |             |             |
|           | receives satisfactory       |             |             |
|           | assurance, as described in  |             |             |
|           | paragraph (e)(1)(iii) of    |             |             |
|           | this section, from the      |             |             |
|           | party seeking the           |             |             |
|           | information that reasonable |             |             |
|           | efforts have been made by   |             |             |
|           | such party to ensure that   |             |             |
|           | the individual who is the   |             |             |
|           | subject of the protected    |             |             |
|           | health information that has |             |             |
|           | been requested has been     |             |             |
|           | given notice of the         |             |             |
|           | request; or                 |             |             |
|           |                             |             |             |
|           | \(B\) The covered entity    |             |             |
|           | receives satisfactory       |             |             |
|           | assurance, as described in  |             |             |
|           | paragraph (e)(1)(iv) of     |             |             |
|           | this section, from the      |             |             |
|           | party seeking the           |             |             |
|           | information that reasonable |             |             |
|           | efforts have been made by   |             |             |
|           | such party to secure a      |             |             |
|           | qualified protective order  |             |             |
|           | that meets the requirements |             |             |
|           | of paragraph (e)(1)(v) of   |             |             |
|           | this section.               |             |             |
|           |                             |             |             |
|           | \(iii\) For the purposes of |             |             |
|           | paragraph (e)(1)(ii)(A) of  |             |             |
|           | this section, a covered     |             |             |
|           | entity receives             |             |             |
|           | satisfactory assurances     |             |             |
|           | from a party seeking        |             |             |
|           | protecting health           |             |             |
|           | information if the covered  |             |             |
|           | entity receives from such   |             |             |
|           | party a written statement   |             |             |
|           | and accompanying            |             |             |
|           | documentation demonstrating |             |             |
|           | that:                       |             |             |
|           |                             |             |             |
|           | \(A\) The party requesting  |             |             |
|           | such information has made a |             |             |
|           | good faith attempt to       |             |             |
|           | provide written notice to   |             |             |
|           | the individual (or, if the  |             |             |
|           | individual's location is    |             |             |
|           | unknown, to mail a notice   |             |             |
|           | to the individual's last    |             |             |
|           | known address);             |             |             |
|           |                             |             |             |
|           | \(B\) The notice included   |             |             |
|           | sufficient information      |             |             |
|           | about the litigation or     |             |             |
|           | proceeding in which the     |             |             |
|           | protected health            |             |             |
|           | information is requested to |             |             |
|           | permit the individual to    |             |             |
|           | raise an objection to the   |             |             |
|           | court or administrative     |             |             |
|           | tribunal; and               |             |             |
|           |                             |             |             |
|           | \(C\) The time for the      |             |             |
|           | individual to raise         |             |             |
|           | objections to the court or  |             |             |
|           | administrative tribunal has |             |             |
|           | elapsed, and:               |             |             |
|           |                             |             |             |
|           | (*1*) No objections were    |             |             |
|           | filed; or                   |             |             |
|           |                             |             |             |
|           | (*2*) All objections filed  |             |             |
|           | by the individual have been |             |             |
|           | resolved by the court or    |             |             |
|           | the administrative tribunal |             |             |
|           | and the disclosures being   |             |             |
|           | sought are consistent with  |             |             |
|           | such resolution.            |             |             |
|           |                             |             |             |
|           | \(iv\) For the purposes of  |             |             |
|           | paragraph (e)(1)(ii)(B) of  |             |             |
|           | this section, a covered     |             |             |
|           | entity receives             |             |             |
|           | satisfactory assurances     |             |             |
|           | from a party seeking        |             |             |
|           | protected health            |             |             |
|           | information, if the covered |             |             |
|           | entity receives from such   |             |             |
|           | party a written statement   |             |             |
|           | and accompanying            |             |             |
|           | documentation demonstrating |             |             |
|           | that:                       |             |             |
|           |                             |             |             |
|           | \(A\) The parties to the    |             |             |
|           | dispute giving rise to the  |             |             |
|           | request for information     |             |             |
|           | have agreed to a qualified  |             |             |
|           | protective order and have   |             |             |
|           | presented it to the court   |             |             |
|           | or administrative tribunal  |             |             |
|           | with jurisdiction over the  |             |             |
|           | dispute; or                 |             |             |
|           |                             |             |             |
|           | \(B\) The party seeking the |             |             |
|           | protected health            |             |             |
|           | information has requested a |             |             |
|           | qualified protective order  |             |             |
|           | from such court or          |             |             |
|           | administrative tribunal.    |             |             |
|           |                             |             |             |
|           | \(v\) For purposes of       |             |             |
|           | paragraph (e)(1) of this    |             |             |
|           | section, a *qualified       |             |             |
|           | protective order* means,    |             |             |
|           | with respect to protected   |             |             |
|           | health information          |             |             |
|           | requested under paragraph   |             |             |
|           | (e)(1)(ii) of this section, |             |             |
|           | an order of a court or of   |             |             |
|           | an administrative tribunal  |             |             |
|           | or a stipulation by the     |             |             |
|           | parties to the litigation   |             |             |
|           | or administrative           |             |             |
|           | proceeding that:            |             |             |
|           |                             |             |             |
|           | \(A\) Prohibits the parties |             |             |
|           | from using or disclosing    |             |             |
|           | the protected health        |             |             |
|           | information for any purpose |             |             |
|           | other than the litigation   |             |             |
|           | or proceeding for which     |             |             |
|           | such information was        |             |             |
|           | requested; and              |             |             |
|           |                             |             |             |
|           | \(B\) Requires the return   |             |             |
|           | to the covered entity or    |             |             |
|           | destruction of the          |             |             |
|           | protected health            |             |             |
|           | information (including all  |             |             |
|           | copies made) at the end of  |             |             |
|           | the litigation or           |             |             |
|           | proceeding.                 |             |             |
|           |                             |             |             |
|           | \(vi\) Notwithstanding      |             |             |
|           | paragraph (e)(1)(ii) of     |             |             |
|           | this section, a covered     |             |             |
|           | entity may disclose         |             |             |
|           | protected health            |             |             |
|           | information in response to  |             |             |
|           | lawful process described in |             |             |
|           | paragraph (e)(1)(ii) of     |             |             |
|           | this section without        |             |             |
|           | receiving satisfactory      |             |             |
|           | assurance under paragraph   |             |             |
|           | (e)(1)(ii)(A) or (B) of     |             |             |
|           | this section, if the        |             |             |
|           | covered entity makes        |             |             |
|           | reasonable efforts to       |             |             |
|           | provide notice to the       |             |             |
|           | individual sufficient to    |             |             |
|           | meet the requirements of    |             |             |
|           | paragraph (e)(1)(iii) of    |             |             |
|           | this section or to seek a   |             |             |
|           | qualified protective order  |             |             |
|           | sufficient to meet the      |             |             |
|           | requirements of paragraph   |             |             |
|           | (e)(1)(iv) of this section. |             |             |
|           |                             |             |             |
|           | \(2\) [Other uses and       |             |             |
|           | disclosures under this      |             |             |
|           | section.]{.underline} The   |             |             |
|           | provisions of this          |             |             |
|           | paragraph do not supersede  |             |             |
|           | other provisions of this    |             |             |
|           | section that otherwise      |             |             |
|           | permit or restrict uses or  |             |             |
|           | disclosures of protected    |             |             |
|           | health information.         |             |             |
|           |                             |             |             |
|           | **(f)** [Standard:          |             |             |
|           | disclosures for law         |             |             |
|           | enforcement                 |             |             |
|           | purposes.]{.underline} A    |             |             |
|           | covered entity may disclose |             |             |
|           | protected health            |             |             |
|           | information for a law       |             |             |
|           | enforcement purpose to a    |             |             |
|           | law enforcement official if |             |             |
|           | the conditions in           |             |             |
|           | paragraphs (f)(1) through   |             |             |
|           | (f)(6) of this section are  |             |             |
|           | met, as applicable.         |             |             |
|           |                             |             |             |
|           | \(1\) [Permitted            |             |             |
|           | disclosures: pursuant to    |             |             |
|           | process and as otherwise    |             |             |
|           | required by                 |             |             |
|           | law]{.underline}. A covered |             |             |
|           | entity may disclose         |             |             |
|           | protected health            |             |             |
|           | information:                |             |             |
|           |                             |             |             |
|           | \(i\) As required by law    |             |             |
|           | including laws that require |             |             |
|           | the reporting of certain    |             |             |
|           | types of wounds or other    |             |             |
|           | physical injuries, except   |             |             |
|           | for laws subject to         |             |             |
|           | paragraph (b)(1)(ii) or     |             |             |
|           | (c)(1)(i) of this section;  |             |             |
|           | or                          |             |             |
|           |                             |             |             |
|           | \(ii\) In compliance with   |             |             |
|           | and as limited by the       |             |             |
|           | relevant requirements of:   |             |             |
|           |                             |             |             |
|           | \(A\) A court order or      |             |             |
|           | court-ordered warrant, or a |             |             |
|           | subpoena or summons issued  |             |             |
|           | by a judicial officer;      |             |             |
|           |                             |             |             |
|           | \(B\) A grand jury          |             |             |
|           | subpoena; or                |             |             |
|           |                             |             |             |
|           | \(C\) An administrative     |             |             |
|           | request, including an       |             |             |
|           | administrative subpoena or  |             |             |
|           | summons, a civil or an      |             |             |
|           | authorized investigative    |             |             |
|           | demand, or similar process  |             |             |
|           | authorized under law,       |             |             |
|           | provided that:              |             |             |
|           |                             |             |             |
|           | (*1*) The information       |             |             |
|           | sought is relevant and      |             |             |
|           | material to a legitimate    |             |             |
|           | law enforcement inquiry;    |             |             |
|           |                             |             |             |
|           | (*2*) The request is        |             |             |
|           | specific and limited in     |             |             |
|           | scope to the extent         |             |             |
|           | reasonably practicable in   |             |             |
|           | light of the purpose for    |             |             |
|           | which the information is    |             |             |
|           | sought; and                 |             |             |
|           |                             |             |             |
|           | (*3*) De-identified         |             |             |
|           | information could not       |             |             |
|           | reasonably be used.         |             |             |
|           |                             |             |             |
|           | **(2)** [Permitted          |             |             |
|           | disclosures: limited        |             |             |
|           | information for             |             |             |
|           | identification and location |             |             |
|           | purposes.]{.underline}      |             |             |
|           | Except for disclosures      |             |             |
|           | required by law as          |             |             |
|           | permitted by paragraph      |             |             |
|           | (f)(1) of this section, a   |             |             |
|           | covered entity may disclose |             |             |
|           | protected health            |             |             |
|           | information in response to  |             |             |
|           | a law enforcement           |             |             |
|           | official's request for such |             |             |
|           | information for the purpose |             |             |
|           | of identifying or locating  |             |             |
|           | a suspect, fugitive,        |             |             |
|           | material witness, or        |             |             |
|           | missing person, provided    |             |             |
|           | that:                       |             |             |
|           |                             |             |             |
|           | \(i\) The covered entity    |             |             |
|           | may disclose only the       |             |             |
|           | following information:      |             |             |
|           |                             |             |             |
|           | \(A\) Name and address;     |             |             |
|           |                             |             |             |
|           | \(B\) Date and place of     |             |             |
|           | birth;                      |             |             |
|           |                             |             |             |
|           | \(C\) Social security       |             |             |
|           | number;                     |             |             |
|           |                             |             |             |
|           | \(D\) ABO blood type and rh |             |             |
|           | factor;                     |             |             |
|           |                             |             |             |
|           | \(E\) Type of injury;       |             |             |
|           |                             |             |             |
|           | \(F\) Date and time of      |             |             |
|           | treatment;                  |             |             |
|           |                             |             |             |
|           | \(G\) Date and time of      |             |             |
|           | death, if applicable; and   |             |             |
|           |                             |             |             |
|           | \(H\) A description of      |             |             |
|           | distinguishing physical     |             |             |
|           | characteristics, including  |             |             |
|           | height, weight, gender,     |             |             |
|           | race, hair and eye color,   |             |             |
|           | presence or absence of      |             |             |
|           | facial hair (beard or       |             |             |
|           | moustache), scars, and      |             |             |
|           | tattoos.                    |             |             |
|           |                             |             |             |
|           | \(ii\) Except as permitted  |             |             |
|           | by paragraph (f)(2)(i) of   |             |             |
|           | this section, the covered   |             |             |
|           | entity may not disclose for |             |             |
|           | the purposes of             |             |             |
|           | identification or location  |             |             |
|           | under paragraph (f)(2) of   |             |             |
|           | this section any protected  |             |             |
|           | health information related  |             |             |
|           | to the individual's DNA or  |             |             |
|           | DNA analysis, dental        |             |             |
|           | records, or typing, samples |             |             |
|           | or analysis of body fluids  |             |             |
|           | or tissue.                  |             |             |
|           |                             |             |             |
|           | **(3)** [Permitted          |             |             |
|           | disclosure: victims of a    |             |             |
|           | crime.]{.underline} Except  |             |             |
|           | for disclosures required by |             |             |
|           | law as permitted by         |             |             |
|           | paragraph (f)(1) of this    |             |             |
|           | section, a covered entity   |             |             |
|           | may disclose protected      |             |             |
|           | health information in       |             |             |
|           | response to a law           |             |             |
|           | enforcement official's      |             |             |
|           | request for such            |             |             |
|           | information about an        |             |             |
|           | individual who is or is     |             |             |
|           | suspected to be a victim of |             |             |
|           | a crime, other than         |             |             |
|           | disclosures that are        |             |             |
|           | subject to paragraph (b) or |             |             |
|           | (c) of this section, if:    |             |             |
|           |                             |             |             |
|           | \(ii\) The individual       |             |             |
|           | agrees to the disclosure;   |             |             |
|           | or                          |             |             |
|           |                             |             |             |
|           | \(iii\) The covered entity  |             |             |
|           | is unable to obtain the     |             |             |
|           | individual's agreement      |             |             |
|           | because of incapacity or    |             |             |
|           | other emergency             |             |             |
|           | circumstance, provided      |             |             |
|           | that:                       |             |             |
|           |                             |             |             |
|           | \(A\) The law enforcement   |             |             |
|           | official represents that    |             |             |
|           | such information is needed  |             |             |
|           | to determine whether a      |             |             |
|           | violation of law by a       |             |             |
|           | person other than the       |             |             |
|           | victim has occurred, and    |             |             |
|           | such information is not     |             |             |
|           | intended to be used against |             |             |
|           | the victim;                 |             |             |
|           |                             |             |             |
|           | \(B\) The law enforcement   |             |             |
|           | official represents that    |             |             |
|           | immediate law enforcement   |             |             |
|           | activity that depends upon  |             |             |
|           | the disclosure would be     |             |             |
|           | materially and adversely    |             |             |
|           | affected by waiting until   |             |             |
|           | the individual is able to   |             |             |
|           | agree to the disclosure;    |             |             |
|           | and                         |             |             |
|           |                             |             |             |
|           | \(C\) The disclosure is in  |             |             |
|           | the best interests of the   |             |             |
|           | individual as determined by |             |             |
|           | the covered entity, in the  |             |             |
|           | exercise of professional    |             |             |
|           | judgment.                   |             |             |
|           |                             |             |             |
|           | **(4)** [Permitted          |             |             |
|           | disclosure:                 |             |             |
|           | decedents.]{.underline} A   |             |             |
|           | covered entity may disclose |             |             |
|           | protected health            |             |             |
|           | information about an        |             |             |
|           | individual who has died to  |             |             |
|           | a law enforcement official  |             |             |
|           | for the purpose of alerting |             |             |
|           | law enforcement of the      |             |             |
|           | death of the individual if  |             |             |
|           | the covered entity has a    |             |             |
|           | suspicion that such death   |             |             |
|           | may have resulted from      |             |             |
|           | criminal conduct.           |             |             |
|           |                             |             |             |
|           | **(5)** [Permitted          |             |             |
|           | disclosure: crime on        |             |             |
|           | premises.]{.underline} A    |             |             |
|           | covered entity may disclose |             |             |
|           | to a law enforcement        |             |             |
|           | official protected health   |             |             |
|           | information that the        |             |             |
|           | covered entity believes in  |             |             |
|           | good faith constitutes      |             |             |
|           | evidence of criminal        |             |             |
|           | conduct that occurred on    |             |             |
|           | the premises of the covered |             |             |
|           | entity.                     |             |             |
|           |                             |             |             |
|           | \(6\) [Permitted            |             |             |
|           | disclosure: reporting crime |             |             |
|           | in                          |             |             |
|           | emergencies.]{.underline}   |             |             |
|           |                             |             |             |
|           | \(i\) A covered health care |             |             |
|           | provider providing          |             |             |
|           | emergency health care in    |             |             |
|           | response to a medical       |             |             |
|           | emergency, other than such  |             |             |
|           | emergency on the premises   |             |             |
|           | of the covered health care  |             |             |
|           | provider, may disclose      |             |             |
|           | protected health            |             |             |
|           | information to a law        |             |             |
|           | enforcement official if     |             |             |
|           | such disclosure appears     |             |             |
|           | necessary to alert law      |             |             |
|           | enforcement to:             |             |             |
|           |                             |             |             |
|           | \(A\) The commission and    |             |             |
|           | nature of a crime;          |             |             |
|           |                             |             |             |
|           | \(B\) The location of such  |             |             |
|           | crime or of the victim(s)   |             |             |
|           | of such crime; and          |             |             |
|           |                             |             |             |
|           | \(C\) The identity,         |             |             |
|           | description, and location   |             |             |
|           | of the perpetrator of such  |             |             |
|           | crime.                      |             |             |
|           |                             |             |             |
|           | \(ii\) If a covered health  |             |             |
|           | care provider believes that |             |             |
|           | the medical emergency       |             |             |
|           | described in paragraph      |             |             |
|           | (f)(6)(i) of this section   |             |             |
|           | is the result of abuse,     |             |             |
|           | neglect, or domestic        |             |             |
|           | violence of the individual  |             |             |
|           | in need of emergency health |             |             |
|           | care, paragraph (f)(6)(i)   |             |             |
|           | of this section does not    |             |             |
|           | apply and any disclosure to |             |             |
|           | a law enforcement official  |             |             |
|           | for law enforcement         |             |             |
|           | purposes is subject to      |             |             |
|           | paragraph (c) of this       |             |             |
|           | section.                    |             |             |
|           |                             |             |             |
|           | \(g\) [Standard: uses and   |             |             |
|           | disclosures about           |             |             |
|           | decedents.]{.underline}     |             |             |
|           |                             |             |             |
|           | \(1\) [Coroners and medical |             |             |
|           | examiners.]{.underline} A   |             |             |
|           | covered entity may disclose |             |             |
|           | protected health            |             |             |
|           | information to a coroner or |             |             |
|           | medical examiner for the    |             |             |
|           | purpose of identifying a    |             |             |
|           | deceased person,            |             |             |
|           | determining a cause of      |             |             |
|           | death, or other duties as   |             |             |
|           | authorized by law. A        |             |             |
|           | covered entity that also    |             |             |
|           | performs the duties of a    |             |             |
|           | coroner or medical examiner |             |             |
|           | may use protected health    |             |             |
|           | information for the         |             |             |
|           | purposes described in this  |             |             |
|           | paragraph.                  |             |             |
|           |                             |             |             |
|           | \(2\) [Funeral              |             |             |
|           | directors.]{.underline} A   |             |             |
|           | covered entity may disclose |             |             |
|           | protected health            |             |             |
|           | information to funeral      |             |             |
|           | directors, consistent with  |             |             |
|           | applicable law, as          |             |             |
|           | necessary to carry out      |             |             |
|           | their duties with respect   |             |             |
|           | to the decedent. If         |             |             |
|           | necessary for funeral       |             |             |
|           | directors carry out their   |             |             |
|           | duties, the covered entity  |             |             |
|           | may disclose the protected  |             |             |
|           | health information prior    |             |             |
|           | to, and in reasonable       |             |             |
|           | anticipation of, the        |             |             |
|           | individual's death.         |             |             |
|           |                             |             |             |
|           | \(h\) [Standard: uses and   |             |             |
|           | disclosures for cadaveric   |             |             |
|           | organ, eye or tissue        |             |             |
|           | donation                    |             |             |
|           | purposes.]{.underline} A    |             |             |
|           | covered entity may use or   |             |             |
|           | disclose protected health   |             |             |
|           | information to organ        |             |             |
|           | procurement organizations   |             |             |
|           | or other entities engaged   |             |             |
|           | in the procurement,         |             |             |
|           | banking, or transplantation |             |             |
|           | of cadaveric organs, eyes,  |             |             |
|           | or tissue for the purpose   |             |             |
|           | of facilitating organ, eye  |             |             |
|           | or tissue donation and      |             |             |
|           | transplantation.            |             |             |
|           |                             |             |             |
|           | **(i)** [Standard: uses and |             |             |
|           | disclosures for research    |             |             |
|           | purposes.]{.underline}      |             |             |
|           |                             |             |             |
|           | **(1)** [Permitted uses and |             |             |
|           | disclosures.]{.underline} A |             |             |
|           | covered entity may use or   |             |             |
|           | disclose protected health   |             |             |
|           | information for research,   |             |             |
|           | regardless of the source of |             |             |
|           | funding of the research,    |             |             |
|           | provided that:              |             |             |
|           |                             |             |             |
|           | \(i\) [Board approval of a  |             |             |
|           | waiver of                   |             |             |
|           | authorization.]{.underline} |             |             |
|           | The covered entity obtains  |             |             |
|           | documentation that an       |             |             |
|           | alteration to or waiver, in |             |             |
|           | whole or in part, of the    |             |             |
|           | individual authorization    |             |             |
|           | required by §164.508 for    |             |             |
|           | use or disclosure of        |             |             |
|           | protected health            |             |             |
|           | information has been        |             |             |
|           | approved by either:         |             |             |
|           |                             |             |             |
|           | \(A\) An Institutional      |             |             |
|           | Review Board (IRB),         |             |             |
|           | established in accordance   |             |             |
|           | with 7 CFR 1c.107, 10 CFR   |             |             |
|           | 745.107, 14 CFR 1230.107,   |             |             |
|           | 15 CFR 27.107, 16 CFR       |             |             |
|           | 1028.107, 21 CFR 56.107, 22 |             |             |
|           | CFR 225.107, 24 CFR 60.107, |             |             |
|           | 28 CFR 46.107, 32 CFR       |             |             |
|           | 219.107, 34 CFR 97.107, 38  |             |             |
|           | CFR 16.107, 40 CFR 26.107,  |             |             |
|           | 45 CFR 46.107, 45 CFR       |             |             |
|           | 690.107, or 49 CFR 11.107;  |             |             |
|           | or                          |             |             |
|           |                             |             |             |
|           | \(B\) A privacy board that: |             |             |
|           |                             |             |             |
|           | (*1*) Has members with      |             |             |
|           | varying backgrounds and     |             |             |
|           | appropriate professional    |             |             |
|           | competency as necessary to  |             |             |
|           | review the effect of the    |             |             |
|           | research protocol on the    |             |             |
|           | individual's privacy rights |             |             |
|           | and related interests;      |             |             |
|           |                             |             |             |
|           | (*2*) Includes at least one |             |             |
|           | member who is not           |             |             |
|           | affiliated with the covered |             |             |
|           | entity, not affiliated with |             |             |
|           | any entity conducting or    |             |             |
|           | sponsoring the research,    |             |             |
|           | and not related to any      |             |             |
|           | person who is affiliated    |             |             |
|           | with any of such entities;  |             |             |
|           | and                         |             |             |
|           |                             |             |             |
|           | (*3*) Does not have any     |             |             |
|           | member participating in a   |             |             |
|           | review of any project in    |             |             |
|           | which the member has a      |             |             |
|           | conflict of interest.       |             |             |
|           |                             |             |             |
|           | **(ii)** [Reviews           |             |             |
|           | preparatory to              |             |             |
|           | research.]{.underline} The  |             |             |
|           | covered entity obtains from |             |             |
|           | the researcher              |             |             |
|           | representations that:       |             |             |
|           |                             |             |             |
|           | \(A\) Use or disclosure is  |             |             |
|           | sought solely to review     |             |             |
|           | protected health            |             |             |
|           | information as necessary to |             |             |
|           | prepare a research protocol |             |             |
|           | or for similar purposes     |             |             |
|           | preparatory to research;    |             |             |
|           |                             |             |             |
|           | \(B\) No protected health   |             |             |
|           | information is to be        |             |             |
|           | removed from the covered    |             |             |
|           | entity by the researcher in |             |             |
|           | the course of the review;   |             |             |
|           | and                         |             |             |
|           |                             |             |             |
|           | \(C\) The protected health  |             |             |
|           | information for which use   |             |             |
|           | or access is sought is      |             |             |
|           | necessary for the research  |             |             |
|           | purposes.                   |             |             |
|           |                             |             |             |
|           | **(iii)** [Research on      |             |             |
|           | decedent's                  |             |             |
|           | information.]{.underline}   |             |             |
|           | The covered entity obtains  |             |             |
|           | from the researcher:        |             |             |
|           |                             |             |             |
|           | \(A\) Representation that   |             |             |
|           | the use or disclosure is    |             |             |
|           | sought is solely for        |             |             |
|           | research on the protected   |             |             |
|           | health information of       |             |             |
|           | decedents;                  |             |             |
|           |                             |             |             |
|           | (B)Documentation, at the    |             |             |
|           | request of the covered      |             |             |
|           | entity, of the death of     |             |             |
|           | such individuals; and       |             |             |
|           |                             |             |             |
|           | \(C\) Representation that   |             |             |
|           | the protected health        |             |             |
|           | information for which use   |             |             |
|           | or disclosure is sought is  |             |             |
|           | necessary for the research  |             |             |
|           | purposes.                   |             |             |
|           |                             |             |             |
|           | **(2)** [Documentation of   |             |             |
|           | waiver                      |             |             |
|           | approval.]{.underline} For  |             |             |
|           | a use or disclosure to be   |             |             |
|           | permitted based on          |             |             |
|           | documentation of approval   |             |             |
|           | of an alteration or waiver, |             |             |
|           | under paragraph (i)(1)(i)   |             |             |
|           | of this section, the        |             |             |
|           | documentation must include  |             |             |
|           | all of the following:       |             |             |
|           |                             |             |             |
|           | \(i\) [Identification and   |             |             |
|           | date of                     |             |             |
|           | action.]{.underline} A      |             |             |
|           | statement identifying the   |             |             |
|           | IRB or privacy board and    |             |             |
|           | the date on which the       |             |             |
|           | alteration or waiver of     |             |             |
|           | authorization was approved; |             |             |
|           |                             |             |             |
|           | \(ii\) [Waiver              |             |             |
|           | criteria.]{.underline} A    |             |             |
|           | statement that the IRB or   |             |             |
|           | privacy board has           |             |             |
|           | determined that the         |             |             |
|           | alteration or waiver, in    |             |             |
|           | whole or in part, of        |             |             |
|           | authorization satisfies the |             |             |
|           | following criteria:         |             |             |
|           |                             |             |             |
|           | \(A\) The use or disclosure |             |             |
|           | of protected health         |             |             |
|           | information involves no     |             |             |
|           | more than minimal risk to   |             |             |
|           | the individuals;            |             |             |
|           |                             |             |             |
|           | \(B\) The alteration or     |             |             |
|           | waiver will not adversely   |             |             |
|           | affect the privacy rights   |             |             |
|           | and the welfare of the      |             |             |
|           | individuals;                |             |             |
|           |                             |             |             |
|           | \(C\) The research could    |             |             |
|           | not practicably be          |             |             |
|           | conducted without the       |             |             |
|           | alteration or waiver;       |             |             |
|           |                             |             |             |
|           | \(D\) The research could    |             |             |
|           | not practicably be          |             |             |
|           | conducted without access to |             |             |
|           | and use of the protected    |             |             |
|           | health information;         |             |             |
|           |                             |             |             |
|           | \(E\) The privacy risks to  |             |             |
|           | individuals whose protected |             |             |
|           | health information is to be |             |             |
|           | used or disclosed are       |             |             |
|           | reasonable in relation to   |             |             |
|           | the anticipated benefits if |             |             |
|           | any to the individuals, and |             |             |
|           | the importance of the       |             |             |
|           | knowledge that may          |             |             |
|           | reasonably be expected to   |             |             |
|           | result from the research;   |             |             |
|           |                             |             |             |
|           | \(F\) There is an adequate  |             |             |
|           | plan to protect the         |             |             |
|           | identifiers from improper   |             |             |
|           | use and disclosure;         |             |             |
|           |                             |             |             |
|           | \(G\) There is an adequate  |             |             |
|           | plan to destroy the         |             |             |
|           | identifiers at the earliest |             |             |
|           | opportunity consistent with |             |             |
|           | conduct of the research,    |             |             |
|           | unless there is a health or |             |             |
|           | research justification for  |             |             |
|           | retaining the identifiers,  |             |             |
|           | or such retention is        |             |             |
|           | otherwise required by law;  |             |             |
|           | and                         |             |             |
|           |                             |             |             |
|           | \(H\) There are adequate    |             |             |
|           | written assurances that the |             |             |
|           | protected health            |             |             |
|           | information will not be     |             |             |
|           | reused or disclosed to any  |             |             |
|           | other person or entity,     |             |             |
|           | except as required by law,  |             |             |
|           | for authorized oversight of |             |             |
|           | the research project, or    |             |             |
|           | for other research for      |             |             |
|           | which the use or disclosure |             |             |
|           | of protected health         |             |             |
|           | information would be        |             |             |
|           | permitted by this subpart.  |             |             |
|           |                             |             |             |
|           | **(iii)** [Protected health |             |             |
|           | information                 |             |             |
|           | needed.]{.underline} A      |             |             |
|           | brief description of the    |             |             |
|           | protected health            |             |             |
|           | information for which use   |             |             |
|           | or access has been          |             |             |
|           | determined to be necessary  |             |             |
|           | by the IRB or privacy board |             |             |
|           | has determined, pursuant to |             |             |
|           | paragraph (i)(2)(ii)(D) of  |             |             |
|           | this section;               |             |             |
|           |                             |             |             |
|           | **(iv)** [Review and        |             |             |
|           | approval                    |             |             |
|           | procedures.]{.underline} A  |             |             |
|           | statement that the          |             |             |
|           | alteration or waiver of     |             |             |
|           | authorization has been      |             |             |
|           | reviewed and approved under |             |             |
|           | either normal or expedited  |             |             |
|           | review procedures, as       |             |             |
|           | follows:                    |             |             |
|           |                             |             |             |
|           | \(A\) An IRB must follow    |             |             |
|           | the requirements of the     |             |             |
|           | Common Rule, including the  |             |             |
|           | normal review procedures (7 |             |             |
|           | CFR 1c.108(b), 10 CFR       |             |             |
|           | 745.108(b), 14 CFR          |             |             |
|           | 1230.108(b), 15 CFR         |             |             |
|           | 27.108(b), 16 CFR           |             |             |
|           | 1028.108(b), 21 CFR         |             |             |
|           | 56.108(b), 22 CFR           |             |             |
|           | 225.108(b), 24 CFR          |             |             |
|           | 60.108(b), 28 CFR           |             |             |
|           | 46.108(b), 32 CFR           |             |             |
|           | 219.108(b), 34 CFR          |             |             |
|           | 97.108(b), 38 CFR           |             |             |
|           | 16.108(b), 40 CFR           |             |             |
|           | 26.108(b), 45 CFR           |             |             |
|           | 46.108(b), 45 CFR           |             |             |
|           | 690.108(b), or 49 CFR       |             |             |
|           | 11.108(b)) or the expedited |             |             |
|           | review procedures (7 CFR    |             |             |
|           | 1c.110, 10 CFR 745.110, 14  |             |             |
|           | CFR 1230.110, 15 CFR        |             |             |
|           | 27.110, 16 CFR 1028.110, 21 |             |             |
|           | CFR 56.110, 22 CFR 225.110, |             |             |
|           | 24 CFR 60.110, 28 CFR       |             |             |
|           | 46.110, 32 CFR 219.110, 34  |             |             |
|           | CFR 97.110, 38 CFR 16.110,  |             |             |
|           | 40 CFR 26.110, 45 CFR       |             |             |
|           | 46.110, 45 CFR 690.110, or  |             |             |
|           | 49 CFR 11.110);             |             |             |
|           |                             |             |             |
|           | \(B\) A privacy board must  |             |             |
|           | review the proposed         |             |             |
|           | research at convened        |             |             |
|           | meetings at which a         |             |             |
|           | majority of the privacy     |             |             |
|           | board members are present,  |             |             |
|           | including at least one      |             |             |
|           | member who satisfies the    |             |             |
|           | criterion stated in         |             |             |
|           | paragraph (i)(1)(i)(B)(*2*) |             |             |
|           | of this section, and the    |             |             |
|           | alteration or waiver of     |             |             |
|           | authorization must be       |             |             |
|           | approved by the majority of |             |             |
|           | the privacy board members   |             |             |
|           | present at the meeting,     |             |             |
|           | unless the privacy board    |             |             |
|           | elects to use an expedited  |             |             |
|           | review procedure in         |             |             |
|           | accordance with paragraph   |             |             |
|           | (i)(2)(iv)(C) of this       |             |             |
|           | section;                    |             |             |
|           |                             |             |             |
|           | \(C\) A privacy board may   |             |             |
|           | use an expedited review     |             |             |
|           | procedure if the research   |             |             |
|           | involves no more than       |             |             |
|           | minimal risk to the privacy |             |             |
|           | of the individuals who are  |             |             |
|           | the subject of the          |             |             |
|           | protected health            |             |             |
|           | information for which use   |             |             |
|           | or disclosure is being      |             |             |
|           | sought. If the privacy      |             |             |
|           | board elects to use an      |             |             |
|           | expedited review procedure, |             |             |
|           | the review and approval of  |             |             |
|           | the alteration or waiver of |             |             |
|           | authorization may be        |             |             |
|           | carried out by the chair of |             |             |
|           | the privacy board, or by    |             |             |
|           | one or more members of the  |             |             |
|           | privacy board as designated |             |             |
|           | by the chair; and           |             |             |
|           |                             |             |             |
|           | \(v\) [Required             |             |             |
|           | signature.]{.underline} The |             |             |
|           | documentation of the        |             |             |
|           | alteration or waiver of     |             |             |
|           | authorization must be       |             |             |
|           | signed by the chair or      |             |             |
|           | other member, as designated |             |             |
|           | by the chair, of the IRB or |             |             |
|           | the privacy board, as       |             |             |
|           | applicable.                 |             |             |
|           |                             |             |             |
|           | **(j)** [Standard: uses and |             |             |
|           | disclosures to avert a      |             |             |
|           | serious threat to health or |             |             |
|           | safety.]{.underline}        |             |             |
|           |                             |             |             |
|           | **(1)** [Permitted          |             |             |
|           | disclosures.]{.underline} A |             |             |
|           | covered entity may,         |             |             |
|           | consistent with applicable  |             |             |
|           | law and standards of        |             |             |
|           | ethical conduct, use or     |             |             |
|           | disclose protected health   |             |             |
|           | information, if the covered |             |             |
|           | entity, in good faith,      |             |             |
|           | believes the use or         |             |             |
|           | disclosure:                 |             |             |
|           |                             |             |             |
|           | (i)(A) Is necessary to      |             |             |
|           | prevent or lessen a serious |             |             |
|           | and imminent threat to the  |             |             |
|           | health or safety of a       |             |             |
|           | person or the public; and   |             |             |
|           | (B) Is to a person or       |             |             |
|           | persons reasonably able to  |             |             |
|           | prevent or lessen the       |             |             |
|           | threat, including the       |             |             |
|           | target of the threat; or    |             |             |
|           |                             |             |             |
|           | \(ii\) Is necessary for law |             |             |
|           | enforcement authorities to  |             |             |
|           | identify or apprehend an    |             |             |
|           | individual:                 |             |             |
|           |                             |             |             |
|           | \(A\) Because of a          |             |             |
|           | statement by an individual  |             |             |
|           | admitting participation in  |             |             |
|           | a violent crime that the    |             |             |
|           | covered entity reasonably   |             |             |
|           | believes may have caused    |             |             |
|           | serious physical harm to    |             |             |
|           | the victim; or              |             |             |
|           |                             |             |             |
|           | \(B\) Where it appears from |             |             |
|           | all the circumstances that  |             |             |
|           | the individual has escaped  |             |             |
|           | from a correctional         |             |             |
|           | institution or from lawful  |             |             |
|           | custody, as those terms are |             |             |
|           | defined in § 164.501.       |             |             |
|           |                             |             |             |
|           | **(2)** [Use or disclosure  |             |             |
|           | not                         |             |             |
|           | permitted..]{.underline} A  |             |             |
|           | use or disclosure pursuant  |             |             |
|           | to paragraph (j)(1)(ii)(A)  |             |             |
|           | of this section may not be  |             |             |
|           | made if the information     |             |             |
|           | described in paragraph      |             |             |
|           | (j)(1)(ii)(A) of this       |             |             |
|           | section is learned by the   |             |             |
|           | covered entity:             |             |             |
|           |                             |             |             |
|           | \(i\) In the course of      |             |             |
|           | treatment to affect the     |             |             |
|           | propensity to commit the    |             |             |
|           | criminal conduct that is    |             |             |
|           | the basis for the           |             |             |
|           | disclosure under paragraph  |             |             |
|           | (j)(1)(ii)(A) of this       |             |             |
|           | section, or counseling or   |             |             |
|           | therapy; or                 |             |             |
|           |                             |             |             |
|           | \(ii\) Through a request by |             |             |
|           | the individual to initiate  |             |             |
|           | or to be referred for the   |             |             |
|           | treatment, counseling, or   |             |             |
|           | therapy described in        |             |             |
|           | paragraph (j)(2)(i) of this |             |             |
|           | section.                    |             |             |
|           |                             |             |             |
|           | **(3)** [Limit on           |             |             |
|           | information that may be     |             |             |
|           | disclosed.]{.underline} A   |             |             |
|           | disclosure made pursuant to |             |             |
|           | paragraph (j)(1)(ii)(A) of  |             |             |
|           | this section shall contain  |             |             |
|           | only the statement          |             |             |
|           | described in paragraph      |             |             |
|           | (j)(1)(ii)(A) of this       |             |             |
|           | section and the protected   |             |             |
|           | health information          |             |             |
|           | described in paragraph      |             |             |
|           | (f)(2)(i) of this section.  |             |             |
|           |                             |             |             |
|           | **(4)** [Presumption of     |             |             |
|           | good faith                  |             |             |
|           | belief.]{.underline} A      |             |             |
|           | covered entity that uses or |             |             |
|           | discloses protected health  |             |             |
|           | information pursuant to     |             |             |
|           | paragraph (j)(1) of this    |             |             |
|           | section is presumed to have |             |             |
|           | acted in good faith with    |             |             |
|           | regard to a belief          |             |             |
|           | described in paragraph      |             |             |
|           | (j)(1)(i) or (ii) of this   |             |             |
|           | section, if the belief is   |             |             |
|           | based upon the covered      |             |             |
|           | entity's actual knowledge   |             |             |
|           | or in reliance on a         |             |             |
|           | credible representation by  |             |             |
|           | a person with apparent      |             |             |
|           | knowledge or authority.     |             |             |
|           |                             |             |             |
|           | **(k)** [Standard: uses and |             |             |
|           | disclosures for specialized |             |             |
|           | government                  |             |             |
|           | functions.]{.underline}     |             |             |
|           |                             |             |             |
|           | \(1\) [Military and         |             |             |
|           | veterans                    |             |             |
|           | activities.]{.underline}    |             |             |
|           |                             |             |             |
|           | \(i\) [Armed Forces         |             |             |
|           | personnel.]{.underline} A   |             |             |
|           | covered entity may use and  |             |             |
|           | disclose the protected      |             |             |
|           | health information of       |             |             |
|           | individuals who are Armed   |             |             |
|           | Forces personnel for        |             |             |
|           | activities deemed necessary |             |             |
|           | by appropriate military     |             |             |
|           | command authorities to      |             |             |
|           | assure the proper execution |             |             |
|           | of the military mission, if |             |             |
|           | the appropriate military    |             |             |
|           | authority has published by  |             |             |
|           | notice in the **Federal     |             |             |
|           | Register** the following    |             |             |
|           | information:                |             |             |
|           |                             |             |             |
|           | \(A\) Appropriate military  |             |             |
|           | command authorities; and    |             |             |
|           |                             |             |             |
|           | \(B\) The purposes for      |             |             |
|           | which the protected health  |             |             |
|           | information may be used or  |             |             |
|           | disclosed.                  |             |             |
|           |                             |             |             |
|           | \(ii\) [Separation or       |             |             |
|           | discharge from military     |             |             |
|           | service.]{.underline} A     |             |             |
|           | covered entity that is a    |             |             |
|           | component of the            |             |             |
|           | Departments of Defense or   |             |             |
|           | Transportation may disclose |             |             |
|           | to the Department of        |             |             |
|           | Veterans Affairs (DVA) the  |             |             |
|           | protected health            |             |             |
|           | information of an           |             |             |
|           | individual who is a member  |             |             |
|           | of the Armed Forces upon    |             |             |
|           | the separation or discharge |             |             |
|           | of the individual from      |             |             |
|           | military service for the    |             |             |
|           | purpose of a determination  |             |             |
|           | by DVA of the individual's  |             |             |
|           | eligibility for or          |             |             |
|           | entitlement to benefits     |             |             |
|           | under laws administered by  |             |             |
|           | the Secretary of Veterans   |             |             |
|           | Affairs.                    |             |             |
|           |                             |             |             |
|           | \(iii\)                     |             |             |
|           | [Veterans.]{.underline} A   |             |             |
|           | covered entity that is a    |             |             |
|           | component of the Department |             |             |
|           | of Veterans Affairs may use |             |             |
|           | and disclose protected      |             |             |
|           | health information to       |             |             |
|           | components of the           |             |             |
|           | Department that determine   |             |             |
|           | eligibility for or          |             |             |
|           | entitlement to, or that     |             |             |
|           | provide, benefits under the |             |             |
|           | laws administered by the    |             |             |
|           | Secretary of Veterans       |             |             |
|           | Affairs.                    |             |             |
|           |                             |             |             |
|           | \(iv\) [Foreign military    |             |             |
|           | personnel.]{.underline} A   |             |             |
|           | covered entity may use and  |             |             |
|           | disclose the protected      |             |             |
|           | health information of       |             |             |
|           | individuals who are foreign |             |             |
|           | military personnel to their |             |             |
|           | appropriate foreign         |             |             |
|           | military authority for the  |             |             |
|           | same purposes for which     |             |             |
|           | uses and disclosures are    |             |             |
|           | permitted for Armed Forces  |             |             |
|           | personnel under the notice  |             |             |
|           | published in the **Federal  |             |             |
|           | Register** pursuant to      |             |             |
|           | paragraph (k)(1)(i) of this |             |             |
|           | section.                    |             |             |
|           |                             |             |             |
|           | \(2\) [National security    |             |             |
|           | and intelligence            |             |             |
|           | activities.]{.underline} A  |             |             |
|           | covered entity may disclose |             |             |
|           | protected health            |             |             |
|           | information to authorized   |             |             |
|           | federal officials for the   |             |             |
|           | conduct of lawful           |             |             |
|           | intelligence,               |             |             |
|           | counter-intelligence, and   |             |             |
|           | other national security     |             |             |
|           | activities authorized by    |             |             |
|           | the National Security Act   |             |             |
|           | (50 U.S.C. 401, *et seq.*)  |             |             |
|           | and implementing authority  |             |             |
|           | (e.g., Executive Order      |             |             |
|           | 12333).                     |             |             |
|           |                             |             |             |
|           | \(3\) [Protective services  |             |             |
|           | for the President and       |             |             |
|           | others.]{.underline} A      |             |             |
|           | covered entity may disclose |             |             |
|           | protected health            |             |             |
|           | information to authorized   |             |             |
|           | federal officials for the   |             |             |
|           | provision of protective     |             |             |
|           | services to the President   |             |             |
|           | or other persons authorized |             |             |
|           | by 18 U.S.C. 3056, or to    |             |             |
|           | foreign heads of state or   |             |             |
|           | other persons authorized by |             |             |
|           | 22 U.S.C. 2709(a)(3), or to |             |             |
|           | for the conduct of          |             |             |
|           | investigations authorized   |             |             |
|           | by 18 U.S.C. 871 and 879.   |             |             |
|           |                             |             |             |
|           | \(4\) [Medical suitability  |             |             |
|           | d                           |             |             |
|           | eterminations.]{.underline} |             |             |
|           | A covered entity that is a  |             |             |
|           | component of the Department |             |             |
|           | of State may use protected  |             |             |
|           | health information to make  |             |             |
|           | medical suitability         |             |             |
|           | determinations and may      |             |             |
|           | disclose whether or not the |             |             |
|           | individual was determined   |             |             |
|           | to be medically suitable to |             |             |
|           | the officials in the        |             |             |
|           | Department of State who     |             |             |
|           | need access to such         |             |             |
|           | information for the         |             |             |
|           | following purposes:         |             |             |
|           |                             |             |             |
|           | \(i\) For the purpose of a  |             |             |
|           | required security clearance |             |             |
|           | conducted pursuant to       |             |             |
|           | Executive Orders 10450 and  |             |             |
|           | 12698;                      |             |             |
|           |                             |             |             |
|           | \(ii\) As necessary to      |             |             |
|           | determine worldwide         |             |             |
|           | availability or             |             |             |
|           | availability for mandatory  |             |             |
|           | service abroad under        |             |             |
|           | sections 101(a)(4) and 504  |             |             |
|           | of the Foreign Service Act; |             |             |
|           | or                          |             |             |
|           |                             |             |             |
|           | \(iii\) For a family to     |             |             |
|           | accompany a Foreign Service |             |             |
|           | member abroad, consistent   |             |             |
|           | with section 101(b)(5) and  |             |             |
|           | 904 of the Foreign Service  |             |             |
|           | Act.                        |             |             |
|           |                             |             |             |
|           | **(5)** [Correctional       |             |             |
|           | institutions and other law  |             |             |
|           | enforcement custodial       |             |             |
|           | situations.]{.underline}    |             |             |
|           |                             |             |             |
|           | **(i)** [Permitted          |             |             |
|           | disclosures.]{.underline} A |             |             |
|           | covered entity may disclose |             |             |
|           | to a correctional           |             |             |
|           | institution or a law        |             |             |
|           | enforcement official having |             |             |
|           | lawful custody of an inmate |             |             |
|           | or other individual         |             |             |
|           | protected health            |             |             |
|           | information about such      |             |             |
|           | inmate or individual, if    |             |             |
|           | the correctional            |             |             |
|           | institution or such law     |             |             |
|           | enforcement official        |             |             |
|           | represents that such        |             |             |
|           | protected health            |             |             |
|           | information is necessary    |             |             |
|           | for:                        |             |             |
|           |                             |             |             |
|           | \(A\) The provision of      |             |             |
|           | health care to such         |             |             |
|           | individuals;                |             |             |
|           |                             |             |             |
|           | \(B\) The health and safety |             |             |
|           | of such individual or other |             |             |
|           | inmates;                    |             |             |
|           |                             |             |             |
|           | \(C\) The health and safety |             |             |
|           | of the officers or          |             |             |
|           | employees of or others at   |             |             |
|           | the correctional            |             |             |
|           | institution;                |             |             |
|           |                             |             |             |
|           | \(D\) The health and safety |             |             |
|           | of such individuals and     |             |             |
|           | officers or other persons   |             |             |
|           | responsible for the         |             |             |
|           | transporting of inmates or  |             |             |
|           | their transfer from one     |             |             |
|           | institution, facility, or   |             |             |
|           | setting to another;         |             |             |
|           |                             |             |             |
|           | \(E\) Law enforcement on    |             |             |
|           | the premises of the         |             |             |
|           | correctional institution;   |             |             |
|           | and                         |             |             |
|           |                             |             |             |
|           | \(F\) The administration    |             |             |
|           | and maintenance of the      |             |             |
|           | safety, security, and good  |             |             |
|           | order of the correctional   |             |             |
|           | institution.                |             |             |
|           |                             |             |             |
|           | **(ii)** [Permitted         |             |             |
|           | uses.]{.underline} A        |             |             |
|           | covered entity that is a    |             |             |
|           | correctional institution    |             |             |
|           | may use protected health    |             |             |
|           | information of individuals  |             |             |
|           | who are inmates for any     |             |             |
|           | purpose for which such      |             |             |
|           | protected health            |             |             |
|           | information may be          |             |             |
|           | disclosed.                  |             |             |
|           |                             |             |             |
|           | **(iii)** [No application   |             |             |
|           | after release.]{.underline} |             |             |
|           | For the purposes of this    |             |             |
|           | provision, an individual is |             |             |
|           | no longer an inmate when    |             |             |
|           | released on parole,         |             |             |
|           | probation, supervised       |             |             |
|           | release, or otherwise is no |             |             |
|           | longer in lawful custody.   |             |             |
|           |                             |             |             |
|           | **(6)** [Covered entities   |             |             |
|           | that are government         |             |             |
|           | programs providing public   |             |             |
|           | benefits.]{.underline}      |             |             |
|           |                             |             |             |
|           | \(i\) A health plan that is |             |             |
|           | a government program        |             |             |
|           | providing public benefits   |             |             |
|           | may disclose protected      |             |             |
|           | health information relating |             |             |
|           | to eligibility for or       |             |             |
|           | enrollment in the health    |             |             |
|           | plan to another agency      |             |             |
|           | administering a government  |             |             |
|           | program providing public    |             |             |
|           | benefits if the sharing of  |             |             |
|           | eligibility or enrollment   |             |             |
|           | information among such      |             |             |
|           | government agencies or the  |             |             |
|           | maintenance of such         |             |             |
|           | information in a single or  |             |             |
|           | combined data system        |             |             |
|           | accessible to all such      |             |             |
|           | government agencies is      |             |             |
|           | required or expressly       |             |             |
|           | authorized by statute or    |             |             |
|           | regulation.                 |             |             |
|           |                             |             |             |
|           | \(ii\) A covered entity     |             |             |
|           | that is a government agency |             |             |
|           | administering a government  |             |             |
|           | program providing public    |             |             |
|           | benefits may disclose       |             |             |
|           | protected health            |             |             |
|           | information relating to the |             |             |
|           | program to another covered  |             |             |
|           | entity that is a government |             |             |
|           | agency administering a      |             |             |
|           | government program          |             |             |
|           | providing public benefits   |             |             |
|           | if the programs serve the   |             |             |
|           | same or similar populations |             |             |
|           | and the disclosure of       |             |             |
|           | protected health            |             |             |
|           | information is necessary to |             |             |
|           | coordinate the covered      |             |             |
|           | functions of such programs  |             |             |
|           | or to improve               |             |             |
|           | administration and          |             |             |
|           | management relating to the  |             |             |
|           | covered functions of such   |             |             |
|           | programs.                   |             |             |
|           |                             |             |             |
|           | **(l)** [Standard:          |             |             |
|           | disclosures for workers'    |             |             |
|           | compensation.]{.underline}  |             |             |
|           | A covered entity may        |             |             |
|           | disclose protected health   |             |             |
|           | information as authorized   |             |             |
|           | by and to the extent        |             |             |
|           | necessary to comply with    |             |             |
|           | laws relating to workers'   |             |             |
|           | compensation or other       |             |             |
|           | similar programs,           |             |             |
|           | established by law, that    |             |             |
|           | provide benefits for        |             |             |
|           | work-related injuries or    |             |             |
|           | illness without regard to   |             |             |
|           | fault.                      |             |             |
+-----------+-----------------------------+-------------+-------------+
| [§        | \(a\) [Standard:            | 5 USC       | Update SOR  |
| 164.514   | de-identification of        | 552a(b)(5); | and/or      |
| Other     | protected health            | 45 CFR      | policy.     |
| req       | information.]{.underline}   | 5b.5; IHS   |             |
| uirements | Health information that     | SOR         | Same as     |
| relating  | does not identify an        | Purposes    | above       |
| to uses   | individual and with respect | #7.         |             |
| and       | to which there is no        |             | Same as     |
| di        | reasonable basis to believe | Same as     | above.      |
| sclosures | that the information can be | above.      |             |
| of        | used to identify an         |             | Same as     |
| protected | individual is not           | Same as     | above.      |
| health    | individually identifiable   | above.      |             |
| inf       | health information.         |             | Same as     |
| ormation] |                             | 5 USC       | above.      |
| (../HIPAA | \(b\) [Implementation       | 552a(b)(5); |             |
| %20Privac | specifications:             | 45 CFR      | Same as     |
| y%20Rule. | requirements for            | 5b.9(b)(5); | above.      |
| doc#_Hlk5 | de-identification of        | IHS SOR     |             |
| 16629782) | protected health            | Purposes #7 | Same as     |
|           | information.]{.underline} A |             | above.      |
|           | covered entity may          | Not in PA,  |             |
|           | determine that health       | HHS, or     | Same as     |
|           | information is not          | IHS.        | above.      |
|           | individually identifiable   |             |             |
|           | health information only if: | 5 USC       | Same as     |
|           |                             | 552a(b)(5); | above.      |
|           | \(1\) A person with         | 45 CFR      |             |
|           | appropriate knowledge of    | 5b.9(b)(5); | Same as     |
|           | and experience with         | IHS SOR     | above.      |
|           | generally accepted          | Purposes #7 |             |
|           | statistical and scientific  |             | Same as     |
|           | principles and methods for  | Same as     | above.      |
|           | rendering information not   | above.      |             |
|           | individually identifiable:  |             | Update SOR  |
|           |                             | Same as     | and/or      |
|           | \(i\) Applying such         | above.      | policy.     |
|           | principles and methods,     |             |             |
|           | determines that the risk is | Same as     | Update SOR  |
|           | very small that the         | above.      | and/or      |
|           | information could be used,  |             | policy.     |
|           | alone or in combination     | Same as     |             |
|           | with other reasonably       | above.      | Same as     |
|           | available information, by   |             | above.      |
|           | an anticipated recipient to | Same as     |             |
|           | identify an individual who  | above.      | Same as     |
|           | is a subject of the         |             | above.      |
|           | information; and            | Not in PA,  |             |
|           |                             | HHS, or IHS | Update SOR  |
|           | \(ii\) Documents the        |             | and/or      |
|           | methods and results of the  | Not in PA,  | policy.     |
|           | analysis that justify such  | HHS, or     |             |
|           | determination; or           | IHS.        | Adequate    |
|           |                             |             | policies    |
|           | (2)(i) The following        | Same as     | and         |
|           | identifiers of the          | above.      | procedures. |
|           | individual or of relatives, |             |             |
|           | employers, or household     | Same as     | Same as     |
|           | members of the individual,  | above.      | above.      |
|           | are removed:                |             |             |
|           |                             | Not in PA,  | Adequate    |
|           | \(A\) Names;                | HHS, or     | policies    |
|           |                             | IHS.        | and         |
|           | \(B\) All geographic        |             | procedures. |
|           | subdivisions smaller than a | 5 USC       |             |
|           | State, including street     | 552a(b)(1); | Update SOR  |
|           | address, city, county,      | 45 CFR      | and/or      |
|           | precinct, zip code, and     | 5b.9(b)(1); | policy.     |
|           | their equivalent geocodes,  | IHS SOR     |             |
|           | except for the initial      | Safeguards  | Same as     |
|           | three digits of a zip code  | #1.         | above.      |
|           | if, according to the        |             |             |
|           | current publicly available  | Same as     | Same as     |
|           | data from the Bureau of the | above.      | above.      |
|           | Census:                     |             |             |
|           |                             | 5 USC       | Same as     |
|           | (*1*) The geographic unit   | 552a(b); 45 | above.      |
|           | formed by combining all zip | CFR 5b.9;   |             |
|           | codes with the same three   | IHS SOR     | Same as     |
|           | initial digits contains     | Routine     | above.      |
|           | more than 20,000 people;    | Uses.       |             |
|           | and                         |             | Same as     |
|           |                             | 5 USC       | above.      |
|           | (*2*) The initial three     | 552a(b); 45 |             |
|           | digits of a zip code for    | CFR 5b.9;   | Update SOR  |
|           | all such geographic units   | IHS SOR     | and/or      |
|           | containing 20,000 or fewer  | Routine     | policy.     |
|           | people is changed to 000.   | Uses.       |             |
|           |                             |             | Update SOR  |
|           | \(C\) All elements of dates | Same as     | and/or      |
|           | (except year) for dates     | above.      | policy.     |
|           | directly related to an      |             |             |
|           | individual, including birth | Same as     | Same as     |
|           | date, admission date,       | above.      | above.      |
|           | discharge date, date of     |             |             |
|           | death; and all ages over 89 | Same as     | Same as     |
|           | and all elements of dates   | above.      | above.      |
|           | (including year) indicative |             |             |
|           | of such age, except that    | Same as     | Not         |
|           | such ages and elements may  | above.      | applicable  |
|           | be aggregated into a single |             | to IHS but  |
|           | category of age 90 or       | Same as     | may apply   |
|           | older;                      | above.      | to tribes   |
|           |                             |             | and urbans. |
|           | \(D\) Telephone numbers;    | 5 USC       |             |
|           |                             | 552a(b); 45 | Not         |
|           | \(E\) Fax numbers;          | CFR 5b.9;   | applicable  |
|           |                             | IHS SOR     | to IHS but  |
|           | \(F\) Electronic mail       | Routine     | may apply   |
|           | addresses;                  | Uses.       | to tribes   |
|           |                             |             | and urbans. |
|           | \(G\) Social security       | 5 USC       |             |
|           | numbers;                    | 552a(b); 45 | Not         |
|           |                             | CFR 5b.9;   | applicable  |
|           | \(H\) Medical record        | IHS SOR     | to IHS but  |
|           | numbers;                    | Routine     | may apply   |
|           |                             | Uses.       | to tribes   |
|           | \(I\) Health plan           |             | and urbans. |
|           | beneficiary numbers;        | Same as     |             |
|           |                             | above.      | Not         |
|           | \(J\) Account numbers;      |             | applicable  |
|           |                             | Same as     | to IHS but  |
|           | \(K\) Certificate/license   | above.      | may be      |
|           | numbers;                    |             | applicable  |
|           |                             |             | to tribal   |
|           | \(L\) Vehicle identifiers   |             | facilities  |
|           | and serial numbers,         |             | and urban   |
|           | including license plate     |             | programs.   |
|           | numbers;                    |             |             |
|           |                             |             | Not         |
|           | \(M\) Device identifiers    |             | applicable  |
|           | and serial numbers;         |             | to IHS but  |
|           |                             |             | may be      |
|           | \(N\) Web Universal         |             | applicable  |
|           | Resource Locators (URLs);   |             | to tribal   |
|           |                             |             | facilities  |
|           | \(O\) Internet Protocol     |             | and urban   |
|           | (IP) address numbers;       |             | programs    |
|           |                             |             |             |
|           | \(P\) Biometric             |             | Not         |
|           | identifiers, including      |             | applicable  |
|           | finger and voice prints;    |             | to IHS but  |
|           |                             |             | may be      |
|           | \(Q\) Full face             |             | applicable  |
|           | photographic images and any |             | to tribal   |
|           | comparable images; and      |             | facilities  |
|           |                             |             | and urban   |
|           | \(R\) Any other unique      |             | programs    |
|           | identifying number,         |             |             |
|           | characteristic, or code;    |             |             |
|           | and                         |             |             |
|           |                             |             |             |
|           | **(ii)** The covered entity |             |             |
|           | does not have actual        |             |             |
|           | knowledge that the          |             |             |
|           | information could be used   |             |             |
|           | alone or in combination     |             |             |
|           | with other information to   |             |             |
|           | identify an individual who  |             |             |
|           | is a subject of the         |             |             |
|           | information.                |             |             |
|           |                             |             |             |
|           | **(c)** [Implementation     |             |             |
|           | specifications:             |             |             |
|           | re-i                        |             |             |
|           | dentification.]{.underline} |             |             |
|           | A covered entity may assign |             |             |
|           | a code or other means of    |             |             |
|           | record identification to    |             |             |
|           | allow information           |             |             |
|           | de-identified under this    |             |             |
|           | section to be re-identified |             |             |
|           | by the covered entity,      |             |             |
|           | provided that:              |             |             |
|           |                             |             |             |
|           | \(1\)                       |             |             |
|           | [Derivation.]{.underline}   |             |             |
|           | The code or other means of  |             |             |
|           | record identification is    |             |             |
|           | not derived from or related |             |             |
|           | to information about the    |             |             |
|           | individual and is not       |             |             |
|           | otherwise capable of being  |             |             |
|           | translated so as to         |             |             |
|           | identify the individual;    |             |             |
|           | and                         |             |             |
|           |                             |             |             |
|           | \(2\)                       |             |             |
|           | [Security.]{.underline} The |             |             |
|           | covered entity does not use |             |             |
|           | or disclose the code or     |             |             |
|           | other means of record       |             |             |
|           | identification for any      |             |             |
|           | other purpose, and does not |             |             |
|           | disclose the mechanism for  |             |             |
|           | re-identification.          |             |             |
|           |                             |             |             |
|           | (d)(1) [Standard: minimum   |             |             |
|           | necessary                   |             |             |
|           | requirements.]{.underline}  |             |             |
|           | A covered entity must       |             |             |
|           | reasonably ensure that the  |             |             |
|           | standards, requirements,    |             |             |
|           | and implementation          |             |             |
|           | specifications of §         |             |             |
|           | 164.502(b) and this section |             |             |
|           | relating to a request for   |             |             |
|           | or the use and disclosure   |             |             |
|           | of the minimum necessary    |             |             |
|           | protected health            |             |             |
|           | information are met.        |             |             |
|           |                             |             |             |
|           | \(2\) [Implementation       |             |             |
|           | specifications: minimum     |             |             |
|           | necessary uses of protected |             |             |
|           | health                      |             |             |
|           | information.]{.underline}   |             |             |
|           |                             |             |             |
|           | \(i\) A covered entity must |             |             |
|           | identify:                   |             |             |
|           |                             |             |             |
|           | \(A\) Those persons or      |             |             |
|           | classes of persons, as      |             |             |
|           | appropriate, in its         |             |             |
|           | workforce who need access   |             |             |
|           | to protected health         |             |             |
|           | information to carry out    |             |             |
|           | their duties; and           |             |             |
|           |                             |             |             |
|           | \(B\) For each such person  |             |             |
|           | or class of persons, the    |             |             |
|           | category or categories of   |             |             |
|           | protected health            |             |             |
|           | information to which access |             |             |
|           | is needed and any           |             |             |
|           | conditions appropriate to   |             |             |
|           | such access.                |             |             |
|           |                             |             |             |
|           | \(ii\) A covered entity     |             |             |
|           | must make reasonable        |             |             |
|           | efforts to limit the access |             |             |
|           | of such persons or classes  |             |             |
|           | identified in paragraph     |             |             |
|           | (d)(2)(i)(A) of this        |             |             |
|           | section to protected health |             |             |
|           | information consistent with |             |             |
|           | paragraph (d)(2)(i)(B) of   |             |             |
|           | this section.               |             |             |
|           |                             |             |             |
|           | **(3)** [Implementation     |             |             |
|           | specification: minimum      |             |             |
|           | necessary disclosures of    |             |             |
|           | protected health            |             |             |
|           | information.]{.underline}   |             |             |
|           |                             |             |             |
|           | **(i)** For any type of     |             |             |
|           | disclosure that it makes on |             |             |
|           | a routine and recurring     |             |             |
|           | basis, a covered entity     |             |             |
|           | must implement policies and |             |             |
|           | procedures (which may be    |             |             |
|           | standard protocols) that    |             |             |
|           | limit the protected health  |             |             |
|           | information disclosed to    |             |             |
|           | the amount reasonably       |             |             |
|           | necessary to achieve the    |             |             |
|           | purpose of the disclosure.  |             |             |
|           |                             |             |             |
|           | \(ii\) For all other        |             |             |
|           | disclosures, a covered      |             |             |
|           | entity must:                |             |             |
|           |                             |             |             |
|           | \(A\) Develop criteria      |             |             |
|           | designed to limit the       |             |             |
|           | protected health            |             |             |
|           | information disclosed to    |             |             |
|           | the information reasonably  |             |             |
|           | necessary to accomplish the |             |             |
|           | purpose for which           |             |             |
|           | disclosure is sought; and   |             |             |
|           |                             |             |             |
|           | \(B\) Review requests for   |             |             |
|           | disclosure on an individual |             |             |
|           | basis in accordance with    |             |             |
|           | such criteria.              |             |             |
|           |                             |             |             |
|           | \(iii\) A covered entity    |             |             |
|           | may rely, if such reliance  |             |             |
|           | is reasonable under the     |             |             |
|           | circumstances, on a         |             |             |
|           | requested disclosure as the |             |             |
|           | minimum necessary for the   |             |             |
|           | stated purpose when:        |             |             |
|           |                             |             |             |
|           | \(A\) Making disclosures to |             |             |
|           | public officials that are   |             |             |
|           | permitted under § 164.512,  |             |             |
|           | if the public official      |             |             |
|           | represents that the         |             |             |
|           | information requested is    |             |             |
|           | the minimum necessary for   |             |             |
|           | the stated purpose(s);      |             |             |
|           |                             |             |             |
|           | \(B\) The information is    |             |             |
|           | requested by another        |             |             |
|           | covered entity;             |             |             |
|           |                             |             |             |
|           | \(C\) The information is    |             |             |
|           | requested by a professional |             |             |
|           | who is a member of its      |             |             |
|           | workforce or is a business  |             |             |
|           | associate of the covered    |             |             |
|           | entity for the purpose of   |             |             |
|           | providing professional      |             |             |
|           | services to the covered     |             |             |
|           | entity, if the professional |             |             |
|           | represents that the         |             |             |
|           | information requested is    |             |             |
|           | the minimum necessary for   |             |             |
|           | the stated purpose(s); or   |             |             |
|           |                             |             |             |
|           | \(D\) Documentation or      |             |             |
|           | representations that comply |             |             |
|           | with the applicable         |             |             |
|           | requirements of §           |             |             |
|           | 164.512(i) have been        |             |             |
|           | provided by a person        |             |             |
|           | requesting the information  |             |             |
|           | for research purposes.      |             |             |
|           |                             |             |             |
|           | **(4)** [Implementation     |             |             |
|           | specifications: minimum     |             |             |
|           | necessary requests for      |             |             |
|           | protected health            |             |             |
|           | information.]{.underline}   |             |             |
|           |                             |             |             |
|           | \(i\) A covered entity must |             |             |
|           | limit any request for       |             |             |
|           | protected health            |             |             |
|           | information to that which   |             |             |
|           | is reasonably necessary to  |             |             |
|           | accomplish the purpose for  |             |             |
|           | which the request is made,  |             |             |
|           | when requesting such        |             |             |
|           | information from other      |             |             |
|           | covered entities.           |             |             |
|           |                             |             |             |
|           | \(ii\) For a request that   |             |             |
|           | is made on a routine and    |             |             |
|           | recurring basis, a covered  |             |             |
|           | entity must implement       |             |             |
|           | policies and procedures     |             |             |
|           | (which may be standard      |             |             |
|           | protocols) that limit the   |             |             |
|           | protected health            |             |             |
|           | information requested to    |             |             |
|           | the amount reasonably       |             |             |
|           | necessary to accomplish the |             |             |
|           | purpose for which the       |             |             |
|           | request is made.            |             |             |
|           |                             |             |             |
|           | \(iii\) For all other       |             |             |
|           | requests, a covered entity  |             |             |
|           | must review the request on  |             |             |
|           | an individual basis to      |             |             |
|           | determine that the          |             |             |
|           | protected health            |             |             |
|           | information sought is       |             |             |
|           | limited to the information  |             |             |
|           | reasonably necessary to     |             |             |
|           | accomplish the purpose for  |             |             |
|           | which the request is made.  |             |             |
|           |                             |             |             |
|           | **(5)** [Implementation     |             |             |
|           | specification: other        |             |             |
|           | content                     |             |             |
|           | requirement.]{.underline}   |             |             |
|           | For all uses, disclosures,  |             |             |
|           | or requests to which the    |             |             |
|           | requirements in paragraph   |             |             |
|           | (d) of this section apply,  |             |             |
|           | a covered entity may not    |             |             |
|           | use, discloses or request   |             |             |
|           | an entire medical record,   |             |             |
|           | except when the entire      |             |             |
|           | medical record is           |             |             |
|           | specifically justified as   |             |             |
|           | the amount that is          |             |             |
|           | reasonably necessary to     |             |             |
|           | accomplish the purpose of   |             |             |
|           | the use, disclosure, or     |             |             |
|           | request.                    |             |             |
|           |                             |             |             |
|           | **(e)(1)** [Standard: uses  |             |             |
|           | and disclosures of          |             |             |
|           | protected health            |             |             |
|           | information for             |             |             |
|           | marketing.]{.underline} A   |             |             |
|           | covered entity may not use  |             |             |
|           | or disclose protected       |             |             |
|           | health information for      |             |             |
|           | marketing without an        |             |             |
|           | authorization that meets    |             |             |
|           | the applicable requirements |             |             |
|           | of § 164.508, except as     |             |             |
|           | provided for by paragraph   |             |             |
|           | (e)(2) of this section.     |             |             |
|           |                             |             |             |
|           | **(2)** [Implementation     |             |             |
|           | specifications:             |             |             |
|           | requirements relating to    |             |             |
|           | marketing.]{.underline} (i) |             |             |
|           | A covered entity is not     |             |             |
|           | required to obtain an       |             |             |
|           | authorization under §       |             |             |
|           | 164.508 when it uses or     |             |             |
|           | discloses protected health  |             |             |
|           | information to make a       |             |             |
|           | marketing communication to  |             |             |
|           | an individual that:         |             |             |
|           |                             |             |             |
|           | \(A\) Occurs in a           |             |             |
|           | face-to-face encounter with |             |             |
|           | the individual;             |             |             |
|           |                             |             |             |
|           | \(B\) Concerns products or  |             |             |
|           | services of nominal value;  |             |             |
|           | or                          |             |             |
|           |                             |             |             |
|           | \(C\) Concerns the          |             |             |
|           | health-related products and |             |             |
|           | services of the covered     |             |             |
|           | entity or of a third party  |             |             |
|           | and the communication meets |             |             |
|           | the applicable conditions   |             |             |
|           | in paragraph (e)(3) of this |             |             |
|           | section.                    |             |             |
|           |                             |             |             |
|           | \(ii\) A covered entity may |             |             |
|           | disclose protected health   |             |             |
|           | information for purposes of |             |             |
|           | such communications only to |             |             |
|           | a business associate that   |             |             |
|           | assists the covered entity  |             |             |
|           | with such communications.   |             |             |
|           |                             |             |             |
|           | **(3)** [Implementation     |             |             |
|           | specifications:             |             |             |
|           | requirements for certain    |             |             |
|           | marketing                   |             |             |
|           | c                           |             |             |
|           | ommunications.]{.underline} |             |             |
|           | For a marketing             |             |             |
|           | communication to qualify    |             |             |
|           | under paragraph (e)(2)(i)   |             |             |
|           | of this section, the        |             |             |
|           | following conditions must   |             |             |
|           | be met:                     |             |             |
|           |                             |             |             |
|           | \(i\) The communication     |             |             |
|           | must:                       |             |             |
|           |                             |             |             |
|           | \(A\) Identify the covered  |             |             |
|           | entity as the party making  |             |             |
|           | the communication;          |             |             |
|           |                             |             |             |
|           | \(B\) If the covered entity |             |             |
|           | has received or will        |             |             |
|           | receive direct or indirect  |             |             |
|           | remuneration for making the |             |             |
|           | communication, prominently  |             |             |
|           | state that fact; and        |             |             |
|           |                             |             |             |
|           | \(C\) Except when the       |             |             |
|           | communication is contained  |             |             |
|           | in a newsletter or similar  |             |             |
|           | type of general             |             |             |
|           | communication device that   |             |             |
|           | the covered entity          |             |             |
|           | distributes to a broad      |             |             |
|           | cross-section of patients,  |             |             |
|           | enrollees, or other broad   |             |             |
|           | groups of individuals,      |             |             |
|           | contain instructions        |             |             |
|           | describing how the          |             |             |
|           | individual may opt out of   |             |             |
|           | receiving future such       |             |             |
|           | communications.             |             |             |
|           |                             |             |             |
|           | \(ii\) If the covered       |             |             |
|           | entity uses or discloses    |             |             |
|           | protected health            |             |             |
|           | information to target the   |             |             |
|           | communication to            |             |             |
|           | individuals based on their  |             |             |
|           | health status or condition: |             |             |
|           |                             |             |             |
|           | \(A\) The covered entity    |             |             |
|           | must make a determination   |             |             |
|           | prior to making the         |             |             |
|           | communication that the      |             |             |
|           | product or service being    |             |             |
|           | marketed may be beneficial  |             |             |
|           | to the health of the type   |             |             |
|           | or class of individual      |             |             |
|           | targeted; and               |             |             |
|           |                             |             |             |
|           | \(B\) The communication     |             |             |
|           | must explain why the        |             |             |
|           | individual has been         |             |             |
|           | targeted and how the        |             |             |
|           | product or service relates  |             |             |
|           | to the health of the        |             |             |
|           | individual.                 |             |             |
|           |                             |             |             |
|           | \(iii\) The covered entity  |             |             |
|           | must make reasonable        |             |             |
|           | efforts to ensure that      |             |             |
|           | individuals who decide to   |             |             |
|           | opt out of receiving future |             |             |
|           | marketing communications,   |             |             |
|           | under paragraph             |             |             |
|           | (e)(3)(i)(C) of this        |             |             |
|           | section, are not sent such  |             |             |
|           | communications.             |             |             |
|           |                             |             |             |
|           | **(f)(1)** [Standard: uses  |             |             |
|           | and disclosures for         |             |             |
|           | fundraising.]{.underline} A |             |             |
|           | covered entity may use, or  |             |             |
|           | disclose to a business      |             |             |
|           | associate or to an          |             |             |
|           | institutionally related     |             |             |
|           | foundation, the following   |             |             |
|           | protected health            |             |             |
|           | information for the purpose |             |             |
|           | of raising funds for its    |             |             |
|           | own benefit, without an     |             |             |
|           | authorization meeting the   |             |             |
|           | requirements of § 164.508:  |             |             |
|           |                             |             |             |
|           | \(i\) Demographic           |             |             |
|           | information relating to an  |             |             |
|           | individual; and             |             |             |
|           |                             |             |             |
|           | \(ii\) Dates of health care |             |             |
|           | provided to an individual.  |             |             |
|           |                             |             |             |
|           | **(2)** [Implementation     |             |             |
|           | specifications: fundraising |             |             |
|           | requirements.]{.underline}  |             |             |
|           |                             |             |             |
|           | \(i\) The covered entity    |             |             |
|           | may not use or disclose     |             |             |
|           | protected health            |             |             |
|           | information for fundraising |             |             |
|           | purposes as otherwise       |             |             |
|           | permitted by paragraph      |             |             |
|           | (f)(1) of this section      |             |             |
|           | unless a statement required |             |             |
|           | by § 164.520(b)(1)(iii)(B)  |             |             |
|           | is included in the covered  |             |             |
|           | entity's notice;            |             |             |
|           |                             |             |             |
|           | \(ii\) The covered entity   |             |             |
|           | must include in any         |             |             |
|           | fundraising materials it    |             |             |
|           | sends to an individual      |             |             |
|           | under this paragraph a      |             |             |
|           | description of how the      |             |             |
|           | individual may opt out of   |             |             |
|           | receiving any further       |             |             |
|           | fundraising communications. |             |             |
|           |                             |             |             |
|           | \(iii\) The covered entity  |             |             |
|           | must make reasonable        |             |             |
|           | efforts to ensure that      |             |             |
|           | individuals who decide to   |             |             |
|           | opt out of receiving future |             |             |
|           | fundraising communications  |             |             |
|           | are not sent such           |             |             |
|           | communications.             |             |             |
|           |                             |             |             |
|           | **(g)** [Standard: uses and |             |             |
|           | disclosures for             |             |             |
|           | underwriting and related    |             |             |
|           | purposes.]{.underline} If a |             |             |
|           | health plan receives        |             |             |
|           | protected heath information |             |             |
|           | for the purpose of          |             |             |
|           | underwriting, premium       |             |             |
|           | rating, or other activities |             |             |
|           | relating to the creation,   |             |             |
|           | renewal, or replacement of  |             |             |
|           | a contract of health        |             |             |
|           | insurance or health         |             |             |
|           | benefits, and if such       |             |             |
|           | health insurance or health  |             |             |
|           | benefits are not placed     |             |             |
|           | with the health plan, such  |             |             |
|           | health plan may not use or  |             |             |
|           | disclose such protected     |             |             |
|           |                             |             |             |
|           | health information for any  |             |             |
|           | other purpose, except as    |             |             |
|           | may be required by law.     |             |             |
|           |                             |             |             |
|           | (h)(1) [Standard:           |             |             |
|           | verification                |             |             |
|           | requirements]{.underline}.  |             |             |
|           | Prior to any disclosure     |             |             |
|           | permitted by this subpart,  |             |             |
|           | a covered entity must:      |             |             |
|           |                             |             |             |
|           | \(i\) Except with respect   |             |             |
|           | to disclosures under §      |             |             |
|           | 164.510, verify the         |             |             |
|           | identity of a person        |             |             |
|           | requesting protected health |             |             |
|           | information and the         |             |             |
|           | authority of any such       |             |             |
|           | person to have access to    |             |             |
|           | protected health            |             |             |
|           | information under this      |             |             |
|           | subpart, if the identity or |             |             |
|           | any such authority of such  |             |             |
|           | person is not known to the  |             |             |
|           | covered entity; and         |             |             |
|           |                             |             |             |
|           | \(ii\) Obtain any           |             |             |
|           | documentation, statements,  |             |             |
|           | or representations, whether |             |             |
|           | oral or written, from the   |             |             |
|           | person requesting the       |             |             |
|           | protected health            |             |             |
|           | information when such       |             |             |
|           | documentation, statement,   |             |             |
|           | or representation is a      |             |             |
|           | condition of the disclosure |             |             |
|           | under this subpart.         |             |             |
|           |                             |             |             |
|           | \(2\) [Implementation       |             |             |
|           | specifications:             |             |             |
|           | verification]{.underline}.  |             |             |
|           |                             |             |             |
|           | \(i\) [Conditions on        |             |             |
|           | disclosures]{.underline}.   |             |             |
|           | If a disclosure is          |             |             |
|           | conditioned by this subpart |             |             |
|           | on particular               |             |             |
|           | documentation, statements,  |             |             |
|           | or representations from the |             |             |
|           | person requesting the       |             |             |
|           | protected health            |             |             |
|           | information, a covered      |             |             |
|           | entity may rely, if such    |             |             |
|           | reliance is reasonable      |             |             |
|           | under the circumstances, on |             |             |
|           | documentation, statements,  |             |             |
|           | or representations that, on |             |             |
|           | their face, meet the        |             |             |
|           | applicable requirements.    |             |             |
|           |                             |             |             |
|           | \(A\) The conditions in §   |             |             |
|           | 164.512(f)(1)(ii)(C) may be |             |             |
|           | satisfied by the            |             |             |
|           | administrative subpoena or  |             |             |
|           | similar process or by a     |             |             |
|           | separate written statement  |             |             |
|           | that, on its face,          |             |             |
|           | demonstrates that the       |             |             |
|           | applicable requirements     |             |             |
|           | have been met.              |             |             |
|           |                             |             |             |
|           | \(B\) The documentation     |             |             |
|           | required by § 164.512(i)(2) |             |             |
|           | may be satisfied by one or  |             |             |
|           | more written statements,    |             |             |
|           | provided that each is       |             |             |
|           | appropriately dated and     |             |             |
|           | signed in accordance with § |             |             |
|           | 164.512(i)(2)(i) and (v).   |             |             |
|           |                             |             |             |
|           | \(ii\) [Identity of public  |             |             |
|           | officials]{.underline}. A   |             |             |
|           | covered entity may rely, if |             |             |
|           | such reliance is reasonable |             |             |
|           | under the circumstances, on |             |             |
|           | any of the following to     |             |             |
|           | verify identity when the    |             |             |
|           | disclosure of protected     |             |             |
|           | health information is to a  |             |             |
|           | public official or a person |             |             |
|           | acting on behalf of the     |             |             |
|           | public official:            |             |             |
|           |                             |             |             |
|           | \(A\) If the request is     |             |             |
|           | made in person,             |             |             |
|           | presentation of an agency   |             |             |
|           | identification badge, other |             |             |
|           | official credentials, or    |             |             |
|           | other proof of government   |             |             |
|           | status;                     |             |             |
|           |                             |             |             |
|           | \(B\) If the request is in  |             |             |
|           | writing, the request is on  |             |             |
|           | the appropriate government  |             |             |
|           | letterhead; or              |             |             |
|           |                             |             |             |
|           | \(C\) If the disclosure is  |             |             |
|           | to a person acting on       |             |             |
|           | behalf of a public          |             |             |
|           | official, a written         |             |             |
|           | statement on appropriate    |             |             |
|           | government letterhead that  |             |             |
|           | the person is acting under  |             |             |
|           | the government\'s authority |             |             |
|           | or other evidence or        |             |             |
|           | documentation of agency,    |             |             |
|           | such as a contract for      |             |             |
|           | services, memorandum of     |             |             |
|           | understanding, or purchase  |             |             |
|           | order, that establishes     |             |             |
|           | that the person is acting   |             |             |
|           | on behalf of the public     |             |             |
|           | official.                   |             |             |
|           |                             |             |             |
|           | \(iii\) [Authority of       |             |             |
|           | public                      |             |             |
|           | officials]{.underline}. A   |             |             |
|           | covered entity may rely, if |             |             |
|           | such reliance is reasonable |             |             |
|           | under the circumstances, on |             |             |
|           | any of the following to     |             |             |
|           | verify authority when the   |             |             |
|           | disclosure of protected     |             |             |
|           | health information is to a  |             |             |
|           | public official or a person |             |             |
|           | acting on behalf of the     |             |             |
|           | public official:            |             |             |
|           |                             |             |             |
|           | \(A\) A written statement   |             |             |
|           | of the legal authority      |             |             |
|           | under which the information |             |             |
|           | is requested, or, if a      |             |             |
|           | written statement would be  |             |             |
|           | impracticable, an oral      |             |             |
|           | statement of such legal     |             |             |
|           | authority;                  |             |             |
|           |                             |             |             |
|           | \(B\) If a request is made  |             |             |
|           | pursuant to legal process,  |             |             |
|           | warrant, subpoena, order,   |             |             |
|           | or other legal process      |             |             |
|           | issued by a grand jury or a |             |             |
|           | judicial or administrative  |             |             |
|           | tribunal is presumed to     |             |             |
|           | constitute legal authority. |             |             |
|           |                             |             |             |
|           | \(iv\) [Exercise of         |             |             |
|           | professional                |             |             |
|           | judgment.]{.underline} The  |             |             |
|           | verification requirements   |             |             |
|           | of this paragraph are met   |             |             |
|           | if the covered entity       |             |             |
|           | relies on the exercise of   |             |             |
|           | professional judgment in    |             |             |
|           | making a use or disclosure  |             |             |
|           | in accordance with §        |             |             |
|           | 164.510 or acts on a good   |             |             |
|           | faith belief in making a    |             |             |
|           | disclosure in accordance    |             |             |
|           | with §164.512(j).           |             |             |
+-----------+-----------------------------+-------------+-------------+
| #### [**§ | \(a\) [Standard: notice of  | 5 USC       | Update SOR  |
|  164.520  | privacy                     | 552a(c); 45 | and/or      |
| Notice of | practices.]{.underline}     | CFR 5b.5;   | policy.     |
|  privacy  |                             | IHS SOR     |             |
| practices | \(1\) [Right to             | 09-17-0001; | Same as     |
|  for prot | notice.]{.underline} Except | IHS Medical | above.      |
| ected hea | as provided by paragraph    | Records     |             |
| lth infor | (a)(2) or (3) of this       | Manual      | Update SOR  |
| mation**] | section, an individual has  |             | and/or      |
| (../HIPAA | a right to adequate notice  | Same as     | policy.     |
| %20Privac | of the uses and disclosures | above.      |             |
| y%20Rule. | of protected health         |             | Same as     |
| doc#_Hlk5 | information that may be     | 5 USC       | above       |
| 16629850) | made by the covered entity, | 552a(c); 45 |             |
|           | and of the individual's     | CFR 5b.5;   | Same as     |
|           | rights and the covered      | IHS SOR     | above.      |
|           | entity's legal duties with  | 09-17-0001; |             |
|           | respect to protected health | IHS Medical | Same as     |
|           | information.                | Records     | above.      |
|           |                             | Manual      |             |
|           | \(2\) [Exception for group  |             | Same as     |
|           | health plans.]{.underline}  | Same as     | above.      |
|           |                             | above.      |             |
|           | \(i\) An individual         |             | Same as     |
|           | enrolled in a group health  | Same as     | above.      |
|           | plan has a right to notice: | above.      |             |
|           |                             |             | Update SOR  |
|           | \(A\) From the group health | Same as     | and/or      |
|           | plan, if, and to the extent | above.      | policy.     |
|           | that, such an individual    |             |             |
|           | does not receive health     | Same as     | Same as     |
|           | benefits under the group    | above.      | above.      |
|           | health plan through an      |             |             |
|           | insurance contract with a   | Same as     | Same as     |
|           | health insurance issuer or  | above.      | above.      |
|           | HMO; or                     |             |             |
|           |                             | 5 USC       | Update SOR  |
|           | \(B\) From the health       | 552a(c); 45 | and/or      |
|           | insurance issuer or HMO     | CFR 5b.5;   | policy.     |
|           | with respect to the group   | IHS SOR     |             |
|           | health plan though which    | 09-17-0001; | Same as     |
|           | such individuals receive    | IHS Medical | above.      |
|           | their health benefits under | Records     |             |
|           | the group health plan.      | Manual      | Same as     |
|           |                             |             | above.      |
|           | \(ii\) A group health plan  | Same as     |             |
|           | that provides health        | above.      | Same as     |
|           | benefits solely through an  |             | above.      |
|           | insurance contract with a   | Same as     |             |
|           | health insurance issuer or  | above.      | Update SOR  |
|           | HMO, and that creates or    |             | and/or      |
|           | receives protected health   | Not in PA,  | policy.     |
|           | information in addition to  | HHS, or IHS |             |
|           | summary health information  |             | Same as     |
|           | as defined in § 164.504(a)  | 5 USC       | above.      |
|           | or information on whether   | 552a(c); 45 |             |
|           | the individual is           | CFR 5b.9;   | Update SOR  |
|           | participating in the group  | IHS SOR     | and/or      |
|           | health plan, or is enrolled | 09-17-0001  | policy.     |
|           | in or has disenrolled from  |             |             |
|           | a health insurance issuer   | Same as     | Update SOR  |
|           | or HMO offered by the plan, | above.      | and/or      |
|           | must:                       |             | policy.     |
|           |                             | Same as     |             |
|           | \(A\) Maintain a notice     | above.      | Legal       |
|           | under this section; and     |             | review.     |
|           |                             | 5 USC       |             |
|           | \(B\) Provide such notice   | 552a(c); 45 | Same as     |
|           | upon request to any person. | CFR 5b.9;   | above.      |
|           | The provisions of paragraph | IHS SOR     |             |
|           | (c)(1) of this section do   | 09-17-0001  | Same as     |
|           | not apply to such group     |             | above.      |
|           | health plan.                | Same as     |             |
|           |                             | above.      | Update SOR  |
|           | \(iii\) A group health plan |             | and/or      |
|           | that provides health        | Not covered | policy.     |
|           | benefits solely through an  | in PA, HHS, |             |
|           | insurance contract with a   | or IHS.     | Update SOR  |
|           | health insurance issuer or  |             | and/or      |
|           | HMO, and does not create or | Same as     | policy.     |
|           | receive protected health    | above.      |             |
|           | information other than      |             | Same as     |
|           | summary health information  | Same as     | above.      |
|           | as defined in § 164.504(a)  | above.      |             |
|           | or information on whether   |             | Same as     |
|           | an individual is            | Same as     | above.      |
|           | participating in the group  | above.      |             |
|           | health plan, or is enrolled |             | Same as     |
|           | in or has disenrolled from  | Not covered | above.      |
|           | a health insurance issuer   | in PA, HHS, |             |
|           | or HMO offered by the plan, | or IHS      | Same as     |
|           | is not required to maintain |             | above.      |
|           | or provide a notice under   | 5 USC       |             |
|           | this section.               | 552a(d); 45 | Same as     |
|           |                             | CFR 5b.5;   | above.      |
|           | \(3\) [Exception for        | IHS SOR     |             |
|           | inmates.]{.underline} An    | 09-17-0001  | Same as     |
|           | inmate does not have a      |             | above.      |
|           | right to notice under this  | Same as     |             |
|           | section, and the            | above.      | Update SOR  |
|           | requirements of this        |             | and/or      |
|           | section do not apply to a   | Same as     | policy.     |
|           | correctional institution    | above.      |             |
|           | that is a covered entity.   |             | Same as     |
|           |                             | Not covered | above.      |
|           | \(b\) [Implementation       | in PA, HHS, |             |
|           | specifications: content of  | or IHS.     | Same as     |
|           | notice.]{.underline}        |             | above.      |
|           |                             | 5 USC       |             |
|           | \(1\) [Required             | 552a(c); 45 | Update SOR  |
|           | elements.]{.underline} The  | CFR 5b.2;   | and/or      |
|           | covered entity must provide | IHS SOR     | policy.     |
|           | a notice that is written in | 09-17-0001  |             |
|           | plain language and that     |             | Same as     |
|           | contains the elements       | Same as     | above.      |
|           | required by this paragraph. | above.      |             |
|           |                             |             | Update SOR  |
|           | \(i\) [Header.]{.underline} | Same as     | and/or      |
|           | The notice must contain the | above.      | policy.     |
|           | following statement as a    |             |             |
|           | header or otherwise         | 5 USC       | Same as     |
|           | prominently displayed:      | 552a(c); 45 | above.      |
|           | "THIS NOTICE DESCRIBES HOW  | CFR 5b.5;   |             |
|           | MEDICAL INFORMATION ABOUT   | IHS SOR     | Same as     |
|           | YOU MAY BE USED AND         | 09-17-0001  | above.      |
|           | DISCLOSED AND HOW YOU CAN   |             |             |
|           | GET ACCESS TO THIS          | Same as     | Same as     |
|           | INFORMATION. PLEASE REVIEW  | above.      | above.      |
|           | IT CAREFULLY."              |             |             |
|           |                             | Same as     | Same as     |
|           | \(ii\) [Uses and            | above.      | above.      |
|           | disclosures.]{.underline}   |             |             |
|           | The notice must contain:    | Not in PA,  | Same as     |
|           |                             | HHS, or IHS | above.      |
|           | \(A\) A description,        |             |             |
|           | including at least one      | Same as     | Same as     |
|           | example, of the types of    | above.      | above.      |
|           | uses and disclosures that   |             |             |
|           | the covered entity is       | Not in PA,  | Same as     |
|           | permitted by this subpart   | HHS, or IHS | above.      |
|           | to make for each of the     |             |             |
|           | following purposes:         | Same as     | Update SOR  |
|           | treatment, payment, and     | above.      | and/or      |
|           | health care operations.     |             | policy.     |
|           |                             | Same as     |             |
|           | \(B\) A description of each | above.      | Same as     |
|           | of the other purposes for   |             | above.      |
|           | which the covered entity is | Same as     |             |
|           | permitted or required by    | above.      | Same as     |
|           | this subpart to use or      |             | above.      |
|           | disclose protected health   | Same as     |             |
|           | information without the     | above.      | Same as     |
|           | individual's written        |             | above.      |
|           | consent or authorization.   | Same as     |             |
|           |                             | above.      | Same as     |
|           | \(C\) If a use or           |             | above.      |
|           | disclosure for any purpose  | Same as     |             |
|           | described in paragraphs     | above.      | Same as     |
|           | (b)(1)(ii)(A) or (B) of     |             | above.      |
|           | this section is prohibited  | Same as     |             |
|           | or materially limited by    | above.      | Same as     |
|           | other applicable law, the   |             | above.      |
|           | description of such use or  | Not covered |             |
|           | disclosure must reflect the | in PA, HHS, | Update SOR  |
|           | more stringent law as       | or IHS.     | and/or      |
|           | defined in § 160.202.       |             | policy.     |
|           |                             | Same as     |             |
|           | \(D\) For each purpose      | above.      | Same as     |
|           | described in paragraph      |             | above.      |
|           | (b)(1)(ii)(A) or (B) of     | Same as     |             |
|           | this section, the           | above.      | Same as     |
|           | description must include    |             | above.      |
|           | sufficient detail to place  | Same as     |             |
|           | the individual on notice of | above.      | Same as     |
|           | the uses and disclosures    |             | above.      |
|           | that are permitted or       | Same as     |             |
|           | required by this subpart    | above.      | Same as     |
|           | and other applicable law.   |             | above.      |
|           |                             | Same as     |             |
|           | \(E\) A statement that      | above.      | Update SOR  |
|           | other uses and disclosures  |             | and/or      |
|           | will be made only with the  | Same as     | policy.     |
|           | individual\'s written       | above.      |             |
|           | authorization and that the  |             | Same as     |
|           | individual may revoke such  | Not covered | above.      |
|           | authorization as provided   | in PA, HHS, |             |
|           | by § 164.508(b)(5).         | or IHS.     | Same as     |
|           |                             |             | above.      |
|           | \(iii\) [Separate           | Same as     |             |
|           | statements for certain uses | above.      | Same as     |
|           | or                          |             | above.      |
|           | disclosures.]{.underline}   | Same as     |             |
|           | If the covered entity       | above.      | Same as     |
|           | intends to engage in any of |             | above.      |
|           | the following activities,   | Same as     |             |
|           | the description required by | above.      |             |
|           | paragraph (b)(1)(ii)(A) of  |             |             |
|           | this section must include a | Same as     |             |
|           | separate statement, as      | above.      |             |
|           | applicable, that:           |             |             |
|           |                             | Not covered |             |
|           | \(A\) The covered entity    | in PA, HHS, |             |
|           | may contact the individual  | or IHS.     |             |
|           | to provide appointment      |             |             |
|           | reminders or information    | Same as     |             |
|           | about treatment             | above.      |             |
|           | alternatives or other       |             |             |
|           | heath-related benefits and  | Same as     |             |
|           | services that may be of     | above.      |             |
|           | interest to the individual; |             |             |
|           |                             | Same as     |             |
|           | \(B\) The covered entity    | above.      |             |
|           | may contact the individual  |             |             |
|           | to raise funds for the      | Same as     |             |
|           | covered entity; or          | above.      |             |
|           |                             |             |             |
|           | \(C\) A group health plan,  |             |             |
|           | or a health insurance       |             |             |
|           | issuer or HMO with respect  |             |             |
|           | to a group health plan, may |             |             |
|           | disclose protected health   |             |             |
|           | information to the sponsor  |             |             |
|           | of the plan.                |             |             |
|           |                             |             |             |
|           | \(iv\) [Individual          |             |             |
|           | rights.]{.underline} The    |             |             |
|           | notice must contain a       |             |             |
|           | statement of the            |             |             |
|           | individual's rights with    |             |             |
|           | respect to protected health |             |             |
|           | information and a brief     |             |             |
|           | description of how the      |             |             |
|           | individual may exercise     |             |             |
|           | these rights, as follows:   |             |             |
|           |                             |             |             |
|           | \(A\) The right to request  |             |             |
|           | restrictions on certain     |             |             |
|           | uses and disclosures of     |             |             |
|           | protected health            |             |             |
|           | information as provided by  |             |             |
|           | § 164.522(a), including a   |             |             |
|           | statement that the covered  |             |             |
|           | entity is not required to   |             |             |
|           | agree to a requested        |             |             |
|           | restriction;                |             |             |
|           |                             |             |             |
|           | \(B\) The right to receive  |             |             |
|           | confidential communications |             |             |
|           | of protected health         |             |             |
|           | information as provided by  |             |             |
|           | § 164.522(b), as            |             |             |
|           | applicable;                 |             |             |
|           |                             |             |             |
|           | \(C\) The right to inspect  |             |             |
|           | and copy protected health   |             |             |
|           | information as provided by  |             |             |
|           | § 164.524;                  |             |             |
|           |                             |             |             |
|           | \(D\) The right to amend    |             |             |
|           | protected health            |             |             |
|           | information as provided by  |             |             |
|           | § 164.526;                  |             |             |
|           |                             |             |             |
|           | \(E\) The right to receive  |             |             |
|           | an accounting of            |             |             |
|           | disclosures of protected    |             |             |
|           | health information as       |             |             |
|           | provided by § 164.528; and  |             |             |
|           |                             |             |             |
|           | \(F\) The right of an       |             |             |
|           | individual, including an    |             |             |
|           | individual who has agreed   |             |             |
|           | to receive the notice       |             |             |
|           | electronically in           |             |             |
|           | accordance with paragraph   |             |             |
|           | (c)(3) of this section, to  |             |             |
|           | obtain a paper copy of the  |             |             |
|           | notice from the covered     |             |             |
|           | entity upon request.        |             |             |
|           |                             |             |             |
|           | \(v\) [Covered entity's     |             |             |
|           | duties.]{.underline} The    |             |             |
|           | notice must contain:        |             |             |
|           |                             |             |             |
|           | \(A\) A statement that the  |             |             |
|           | covered entity is required  |             |             |
|           | by law to maintain the      |             |             |
|           | privacy of protected health |             |             |
|           | information and to provide  |             |             |
|           | individuals with notice of  |             |             |
|           | its legal duties and        |             |             |
|           | privacy practices with      |             |             |
|           | respect to protected health |             |             |
|           | information;                |             |             |
|           |                             |             |             |
|           | \(B\) A statement that the  |             |             |
|           | covered entity is required  |             |             |
|           | to abide by the terms of    |             |             |
|           | the notice currently in     |             |             |
|           | effect; and                 |             |             |
|           |                             |             |             |
|           | \(C\) For the covered       |             |             |
|           | entity to apply a change in |             |             |
|           | a privacy practice that is  |             |             |
|           | described in the notice to  |             |             |
|           | protected health            |             |             |
|           | information that the        |             |             |
|           | covered entity created or   |             |             |
|           | received prior to issuing a |             |             |
|           | revised notice, in          |             |             |
|           | accordance with §           |             |             |
|           | 164.530(i)(2)(ii), a        |             |             |
|           | statement that it reserves  |             |             |
|           | the right to change the     |             |             |
|           | terms of its notice and to  |             |             |
|           | make the new notice         |             |             |
|           | provisions effective for    |             |             |
|           | all protected health        |             |             |
|           | information that it         |             |             |
|           | maintains. The statement    |             |             |
|           | must also describe how it   |             |             |
|           | will provide individuals    |             |             |
|           | with a revised notice.      |             |             |
|           |                             |             |             |
|           | \(vi\)                      |             |             |
|           | [Complaints.]{.underline}   |             |             |
|           | The notice must contain a   |             |             |
|           | statement that individuals  |             |             |
|           | may complain to the covered |             |             |
|           | entity and to the Secretary |             |             |
|           | if they believe their       |             |             |
|           | privacy rights have been    |             |             |
|           | violated, a brief           |             |             |
|           | description of how the      |             |             |
|           | individual may file a       |             |             |
|           | complaint with the covered  |             |             |
|           | entity, and a statement     |             |             |
|           | that the individual will    |             |             |
|           | not be retaliated against   |             |             |
|           | for filing a complaint.     |             |             |
|           |                             |             |             |
|           | \(vii\)                     |             |             |
|           | [Contact.]{.underline} The  |             |             |
|           | notice must contain the     |             |             |
|           | name, or title, and         |             |             |
|           | telephone number of a       |             |             |
|           | person or office to contact |             |             |
|           | for further information as  |             |             |
|           | required by §               |             |             |
|           | 164.530(a)(1)(ii).          |             |             |
|           |                             |             |             |
|           | \(viii\) [Effective         |             |             |
|           | date.]{.underline} The      |             |             |
|           | notice must contain the     |             |             |
|           | date on which the notice is |             |             |
|           | first in effect, which may  |             |             |
|           | not be earlier than the     |             |             |
|           | date on which the notice is |             |             |
|           | printed or otherwise        |             |             |
|           | published.                  |             |             |
|           |                             |             |             |
|           | \(2\) [Optional             |             |             |
|           | elements.]{.underline}      |             |             |
|           |                             |             |             |
|           | \(i\) In addition to the    |             |             |
|           | information required by     |             |             |
|           | paragraph (b)(1) of this    |             |             |
|           | section, if a covered       |             |             |
|           | entity elects to limit the  |             |             |
|           | uses or disclosures that it |             |             |
|           | is permitted to make under  |             |             |
|           | this subpart, the covered   |             |             |
|           | entity may describe its     |             |             |
|           | more limited uses or        |             |             |
|           | disclosures in its notice,  |             |             |
|           | provided that the covered   |             |             |
|           | entity may not include in   |             |             |
|           | its notice a limitation     |             |             |
|           | affecting its right to make |             |             |
|           | a use or disclosure that is |             |             |
|           | required by law or          |             |             |
|           | permitted by §              |             |             |
|           | 164.512(j)(1)(i).           |             |             |
|           |                             |             |             |
|           | \(ii\) For the covered      |             |             |
|           | entity to apply a change in |             |             |
|           | its more limited uses and   |             |             |
|           | disclosures to protected    |             |             |
|           | health information created  |             |             |
|           | or received prior to        |             |             |
|           | issuing a revised notice,   |             |             |
|           | in accordance with §        |             |             |
|           | 164.530(i)(2)(ii), the      |             |             |
|           | notice must include the     |             |             |
|           | statements required by      |             |             |
|           | paragraph (b)(1)(v)(C) of   |             |             |
|           | this section.               |             |             |
|           |                             |             |             |
|           | \(3\) [Revisions to the     |             |             |
|           | notice.]{.underline} The    |             |             |
|           | covered entity must         |             |             |
|           | promptly revise and         |             |             |
|           | distribute its notice       |             |             |
|           | whenever there is a         |             |             |
|           | material change to the uses |             |             |
|           | or disclosures, the         |             |             |
|           | individual's rights, the    |             |             |
|           | covered entity's legal      |             |             |
|           | duties, or other privacy    |             |             |
|           | practices stated in the     |             |             |
|           | notice. Except when         |             |             |
|           | required by law, a material |             |             |
|           | change to any term of the   |             |             |
|           | notice may not be           |             |             |
|           | implemented prior to the    |             |             |
|           | effective date of the       |             |             |
|           | notice in which such        |             |             |
|           | material change is          |             |             |
|           | reflected.                  |             |             |
|           |                             |             |             |
|           | \(c\) [Implementation       |             |             |
|           | specifications: provision   |             |             |
|           | of notice.]{.underline} A   |             |             |
|           | covered entity must make    |             |             |
|           | the notice required by this |             |             |
|           | section available on        |             |             |
|           | request to any person and   |             |             |
|           | to individuals as specified |             |             |
|           | in paragraphs (c)(1)        |             |             |
|           | through (c)(4) of this      |             |             |
|           | section, as applicable.     |             |             |
|           |                             |             |             |
|           | \(1\) [Specific             |             |             |
|           | requirements for health     |             |             |
|           | plans]{.underline}.         |             |             |
|           |                             |             |             |
|           | \(i\) A health plan must    |             |             |
|           | provide notice:             |             |             |
|           |                             |             |             |
|           | \(A\) No later than the     |             |             |
|           | compliance date for the     |             |             |
|           | health plan, to individuals |             |             |
|           | then covered by the plan;   |             |             |
|           |                             |             |             |
|           | \(B\) Thereafter, at the    |             |             |
|           | time of enrollment, to      |             |             |
|           | individuals who are new     |             |             |
|           | enrollees; and              |             |             |
|           |                             |             |             |
|           | \(C\) Within 60 days of a   |             |             |
|           | material revision to the    |             |             |
|           | notice, to individuals then |             |             |
|           | covered by the plan.        |             |             |
|           |                             |             |             |
|           | \(ii\) No less frequently   |             |             |
|           | than once every three       |             |             |
|           | years, the health plan must |             |             |
|           | notify individuals then     |             |             |
|           | covered by the plan of the  |             |             |
|           | availability of the notice  |             |             |
|           | and how to obtain the       |             |             |
|           | notice.                     |             |             |
|           |                             |             |             |
|           | \(iii\) The health plan     |             |             |
|           | satisfies the requirements  |             |             |
|           | of paragraph (c)(1) of this |             |             |
|           | section if notice is        |             |             |
|           | provided to the named       |             |             |
|           | insured of a policy under   |             |             |
|           | which coverage is provided  |             |             |
|           | to the named insured and    |             |             |
|           | one or more dependents.     |             |             |
|           |                             |             |             |
|           | \(iv\) If a health plan has |             |             |
|           | more than one notice, it    |             |             |
|           | satisfies the requirements  |             |             |
|           | of paragraph (c)(1) of this |             |             |
|           | section by providing the    |             |             |
|           | notice that is relevant to  |             |             |
|           | the individual or other     |             |             |
|           | person requesting the       |             |             |
|           | notice.                     |             |             |
|           |                             |             |             |
|           | \(2\) [Specific             |             |             |
|           | requirements for certain    |             |             |
|           | covered health care         |             |             |
|           | providers.]{.underline} A   |             |             |
|           | covered health care         |             |             |
|           | provider that has a direct  |             |             |
|           | treatment relationship with |             |             |
|           | an individual must:         |             |             |
|           |                             |             |             |
|           | \(i\) Provide the notice no |             |             |
|           | later than the date of the  |             |             |
|           | first service delivery,     |             |             |
|           | including service delivered |             |             |
|           | electronically, to such     |             |             |
|           | individual after the        |             |             |
|           | compliance date for the     |             |             |
|           | covered health care         |             |             |
|           | provider;                   |             |             |
|           |                             |             |             |
|           | \(ii\) If the covered       |             |             |
|           | health care provider        |             |             |
|           | maintains a physical        |             |             |
|           | service delivery site:      |             |             |
|           |                             |             |             |
|           | \(A\) Have the notice       |             |             |
|           | available at the service    |             |             |
|           | delivery site for           |             |             |
|           | individuals to request to   |             |             |
|           | take with them; and         |             |             |
|           |                             |             |             |
|           | \(B\) Post the notice in a  |             |             |
|           | clear and prominent         |             |             |
|           | location where it is        |             |             |
|           | reasonable to expect        |             |             |
|           | individuals seeking service |             |             |
|           | from the covered health     |             |             |
|           | care provider to be able to |             |             |
|           | read the notice; and        |             |             |
|           |                             |             |             |
|           | \(iii\) Whenever the notice |             |             |
|           | is revised, make the notice |             |             |
|           | available upon request on   |             |             |
|           | or after the effective date |             |             |
|           | of the revision and         |             |             |
|           | promptly comply with the    |             |             |
|           | requirements of paragraph   |             |             |
|           | (c)(2)(ii) of this section, |             |             |
|           | if applicable.              |             |             |
|           |                             |             |             |
|           | \(3\) [Specific             |             |             |
|           | requirements for electronic |             |             |
|           | notice.]{.underline}        |             |             |
|           |                             |             |             |
|           | \(i\) A covered entity that |             |             |
|           | maintains a web site that   |             |             |
|           | provides information about  |             |             |
|           | the covered entity's        |             |             |
|           | customer services or        |             |             |
|           | benefits must prominently   |             |             |
|           | post its notice on the web  |             |             |
|           | site and make the notice    |             |             |
|           | available electronically    |             |             |
|           | through the web site.       |             |             |
|           |                             |             |             |
|           | \(ii\) A covered entity may |             |             |
|           | provide the notice required |             |             |
|           | by this section to an       |             |             |
|           | individual by e-mail, if    |             |             |
|           | the individual agrees to    |             |             |
|           | electronic notice and such  |             |             |
|           | agreement has not been      |             |             |
|           | withdrawn. If the covered   |             |             |
|           | entity knows that the       |             |             |
|           | e-mail transmission has     |             |             |
|           | failed, a paper copy of the |             |             |
|           | notice must be provided to  |             |             |
|           | the individual.             |             |             |
|           |                             |             |             |
|           | Provision of electronic     |             |             |
|           | notice by the covered       |             |             |
|           | entity will satisfy the     |             |             |
|           | provision requirements of   |             |             |
|           | paragraph (c) of this       |             |             |
|           | section when timely made in |             |             |
|           | accordance with paragraph   |             |             |
|           | (c)(1) or (2) of this       |             |             |
|           | section.                    |             |             |
|           |                             |             |             |
|           | \(iii\) For purposes of     |             |             |
|           | paragraph (c)(2)(i) of this |             |             |
|           | section, if the first       |             |             |
|           | service delivery to an      |             |             |
|           | individual is delivered     |             |             |
|           | electronically, the covered |             |             |
|           | health care provider must   |             |             |
|           | provide electronic notice   |             |             |
|           | automatically and           |             |             |
|           | contemporaneously in        |             |             |
|           | response to the             |             |             |
|           | individual's first request  |             |             |
|           | for service.                |             |             |
|           |                             |             |             |
|           | \(iv\) The individual who   |             |             |
|           | is the recipient of         |             |             |
|           | electronic notice retains   |             |             |
|           | the right to obtain a paper |             |             |
|           | copy of the notice from a   |             |             |
|           | covered entity upon         |             |             |
|           | request.                    |             |             |
|           |                             |             |             |
|           | \(d\) [Implementation       |             |             |
|           | specifications: joint       |             |             |
|           | notice by separate covered  |             |             |
|           | entities.]{.underline}      |             |             |
|           | Covered entities that       |             |             |
|           | participate in organized    |             |             |
|           | health care arrangements    |             |             |
|           | may comply with this        |             |             |
|           | section by a joint notice,  |             |             |
|           | provided that:              |             |             |
|           |                             |             |             |
|           | \(1\) The covered entities  |             |             |
|           | participating in the        |             |             |
|           | organized health care       |             |             |
|           | arrangement agree to abide  |             |             |
|           | by the terms of the notice  |             |             |
|           | with respect to protected   |             |             |
|           | health information created  |             |             |
|           | or received by the covered  |             |             |
|           | entity as part of its       |             |             |
|           | participation in the        |             |             |
|           | organized health care       |             |             |
|           | arrangement;                |             |             |
|           |                             |             |             |
|           | \(2\) The joint notice      |             |             |
|           | meets the implementation    |             |             |
|           | specifications in paragraph |             |             |
|           | (b) of this section, except |             |             |
|           | that the statements         |             |             |
|           | required by this section    |             |             |
|           | may be altered to reflect   |             |             |
|           | the fact that the notice    |             |             |
|           | covers more than one        |             |             |
|           | covered entity; and         |             |             |
|           |                             |             |             |
|           | \(i\) Describes with        |             |             |
|           | reasonable specificity the  |             |             |
|           | covered entities, or class  |             |             |
|           | of entities, to which the   |             |             |
|           | joint notice applies;       |             |             |
|           |                             |             |             |
|           | \(ii\) Describes with       |             |             |
|           | reasonable specificity the  |             |             |
|           | service delivery sites, or  |             |             |
|           | classes of service delivery |             |             |
|           | sites, to which the joint   |             |             |
|           | notice applies; and         |             |             |
|           |                             |             |             |
|           | \(iii\) If applicable,      |             |             |
|           | states that the covered     |             |             |
|           | entities participating in   |             |             |
|           | the organized health care   |             |             |
|           | arrangement will share      |             |             |
|           | protected health            |             |             |
|           | information with each       |             |             |
|           | other, as necessary to      |             |             |
|           | carry out treatment,        |             |             |
|           | payment, or health care     |             |             |
|           | operations relating to the  |             |             |
|           | organized health care       |             |             |
|           | arrangement.                |             |             |
|           |                             |             |             |
|           | \(3\) The covered entities  |             |             |
|           | included in the joint       |             |             |
|           | notice must provide the     |             |             |
|           | notice to individuals in    |             |             |
|           | accordance with the         |             |             |
|           | applicable implementation   |             |             |
|           | specifications of paragraph |             |             |
|           | (c) of this section.        |             |             |
|           | Provision of the joint      |             |             |
|           | notice to an individual by  |             |             |
|           | any one of the covered      |             |             |
|           | entities included in the    |             |             |
|           | joint notice will satisfy   |             |             |
|           | the provision requirement   |             |             |
|           | of paragraph (c) of this    |             |             |
|           | section with respect to all |             |             |
|           | others covered by the joint |             |             |
|           | notice.                     |             |             |
|           |                             |             |             |
|           | \(e\) [Implementation       |             |             |
|           | specifications:             |             |             |
|           | documentation.]{.underline} |             |             |
|           | A covered entity must       |             |             |
|           | document compliance with    |             |             |
|           | the notice requirements by  |             |             |
|           | retaining copies of the     |             |             |
|           | notices issued by the       |             |             |
|           | covered entity as required  |             |             |
|           | by § 164.530(j).            |             |             |
+-----------+-----------------------------+-------------+-------------+
| #### [**§ | (a)(1) [Standard: right of  | Not covered | Update SOR  |
|  164.522  | an individual to request    | in PA, HHS, | and/or      |
| Rights to | restriction of uses and     | of IHS      | policy.     |
|  request  | disclosures.]{.underline}   |             |             |
| privacy p |                             | Not covered | Update SOR  |
| rotection | \(i\) A covered entity must | in PA, HHS, | and/or      |
|  for prot | permit an individual to     | of IHS      | policy.     |
| ected hea | request that the covered    |             |             |
| lth infor | entity restrict:            | Same as     | Same as     |
| mation**] |                             | above.      | above.      |
| (../HIPAA | \(A\) Uses or disclosures   |             |             |
| %20Privac | of protected health         | Same as     | Same as     |
| y%20Rule. | information about the       | above.      | above.      |
| doc#_Hlk5 | individual to carry out     |             |             |
| 16629935) | treatment, payment, or      | Same as     | Same as     |
|           | health care operations; and | above.      | above.      |
|           |                             |             |             |
|           | \(B\) Disclosures permitted | Same as     | Same as     |
|           | under § 164.510(b).         | above.      | above.      |
|           |                             |             |             |
|           | \(ii\) A covered entity is  | Not covered | Update SOR  |
|           | not required to agree to a  | in PA, HHS, | and/or      |
|           | restriction.                | or IHS      | policy.     |
|           |                             |             |             |
|           | \(iii\) A covered entity    | Same as     | Same as     |
|           | that agrees to a            | above.      | above.      |
|           | restriction under paragraph |             |             |
|           | (a)(1)(i) of this section   | Not covered | Update SOR  |
|           | may not use or disclose     | in PA, HHS, | and/or      |
|           | protected health            | or IHS      | policy.     |
|           | information in violation of |             |             |
|           | such restriction, except    | Same as     | Same as     |
|           | that, if the individual who | above.      | above.      |
|           | requested the restriction   |             |             |
|           | is in need of emergency     | Not covered | Update SOR  |
|           | treatment and the           | in PA, HHS, | and/or      |
|           | restricted protected health | or IHS.     | policy.     |
|           | information is needed to    |             |             |
|           | provide the emergency       | Not covered | Update SOR  |
|           | treatment, the covered      | in PA, HHS, | and/or      |
|           | entity may use the          | or IHS.     | policy.     |
|           | restricted protected health |             |             |
|           | information, or may         | Not covered | Update SOR  |
|           | disclose such information   | in PA, HHS, | and/or      |
|           | to a health care provider,  | or IHS.     | policy.     |
|           | to provide such treatment   |             |             |
|           | to the individual.          | Same as     | Same as     |
|           |                             | above.      | above.      |
|           | \(iv\) If restricted        |             |             |
|           | protected health            | Same as     | Same as     |
|           | information is disclosed to | above.      | above.      |
|           | a health care provider for  |             |             |
|           | emergency treatment under   | Same as     | Same as     |
|           | paragraph (a)(1)(iii) of    | above.      | above.      |
|           | this section, the covered   |             |             |
|           | entity must request that    | Same as     | Same as     |
|           | such health care provider   | above.      | above.      |
|           | not further use or disclose |             |             |
|           | the information.            | Same as     | Same as     |
|           |                             | above.      | above.      |
|           | \(v\) A restriction agreed  |             |             |
|           | to by a covered entity      |             |             |
|           | under paragraph (a) of this |             |             |
|           | section, is not effective   |             |             |
|           | under this subpart to       |             |             |
|           | prevent uses or disclosures |             |             |
|           | permitted or required under |             |             |
|           | §§164.502(a) (2) (i),       |             |             |
|           | 164.510(a) or 164.512.      |             |             |
|           |                             |             |             |
|           | \(2\) [Implementation       |             |             |
|           | specifications: terminating |             |             |
|           | a restriction.]{.underline} |             |             |
|           | A covered entity may        |             |             |
|           | terminate its agreement to  |             |             |
|           | a restriction, if :         |             |             |
|           |                             |             |             |
|           | \(i\) The individual agrees |             |             |
|           | to or requests the          |             |             |
|           | termination in writing;     |             |             |
|           |                             |             |             |
|           | \(ii\) The individual       |             |             |
|           | orally agrees to the        |             |             |
|           | termination and the oral    |             |             |
|           | agreement is documented; or |             |             |
|           |                             |             |             |
|           | \(iii\) The covered entity  |             |             |
|           | informs the individual that |             |             |
|           | it is terminating its       |             |             |
|           | agreement to a restriction, |             |             |
|           | except that such            |             |             |
|           | termination is only         |             |             |
|           | effective with respect to   |             |             |
|           | protected health            |             |             |
|           | information created or      |             |             |
|           | received after it has so    |             |             |
|           | informed the individual.    |             |             |
|           |                             |             |             |
|           | \(3\) [Implementation       |             |             |
|           | specification:              |             |             |
|           | documentation.]{.underline} |             |             |
|           | A covered entity that       |             |             |
|           | agrees to a restriction     |             |             |
|           | must document the           |             |             |
|           | restriction in accordance   |             |             |
|           | with § 164.530(j).          |             |             |
|           |                             |             |             |
|           | (b)(1) [Standard:           |             |             |
|           | confidential communications |             |             |
|           | requirements.]{.underline}  |             |             |
|           |                             |             |             |
|           | \(i\) A covered health care |             |             |
|           | provider must permit        |             |             |
|           | individuals to request and  |             |             |
|           | must accommodate reasonable |             |             |
|           | requests by individuals to  |             |             |
|           | receive communications of   |             |             |
|           | protected health            |             |             |
|           | information from the        |             |             |
|           | covered health care         |             |             |
|           | provider by alternative     |             |             |
|           | means or at alternative     |             |             |
|           | locations.                  |             |             |
|           |                             |             |             |
|           | \(ii\) A health plan must   |             |             |
|           | permit individuals to       |             |             |
|           | request and must            |             |             |
|           | accommodate reasonable      |             |             |
|           | requests by individuals to  |             |             |
|           | receive communications of   |             |             |
|           | protected health            |             |             |
|           | information from the health |             |             |
|           | plan by alternative means   |             |             |
|           | or at alternative           |             |             |
|           | locations, if the           |             |             |
|           | individual clearly states   |             |             |
|           | that the disclosure of all  |             |             |
|           | or part of that information |             |             |
|           | could endanger the          |             |             |
|           | individual,                 |             |             |
|           |                             |             |             |
|           | **(2)** [Implementation     |             |             |
|           | specifications: conditions  |             |             |
|           | on providing confidential   |             |             |
|           | c                           |             |             |
|           | ommunications.]{.underline} |             |             |
|           |                             |             |             |
|           | \(i\) A covered entity may  |             |             |
|           | require the individual to   |             |             |
|           | make a request for a        |             |             |
|           | confidential communication  |             |             |
|           | described in paragraph      |             |             |
|           | (b)(1) of this section in   |             |             |
|           | writing.                    |             |             |
|           |                             |             |             |
|           | \(ii\) A covered entity may |             |             |
|           | condition the provision of  |             |             |
|           | a reasonable accommodation  |             |             |
|           | on:                         |             |             |
|           |                             |             |             |
|           | \(A\) When appropriate,     |             |             |
|           | information as to how       |             |             |
|           | payment, if any, will be    |             |             |
|           | handled; and                |             |             |
|           |                             |             |             |
|           | \(B\) Specification of an   |             |             |
|           | alternative address or      |             |             |
|           | other method of contact.    |             |             |
|           |                             |             |             |
|           | \(iii\) A covered health    |             |             |
|           | care provider may not       |             |             |
|           | require an explanation from |             |             |
|           | the individual as to the    |             |             |
|           | basis for the request as a  |             |             |
|           | condition of providing      |             |             |
|           | communications on a         |             |             |
|           | confidential basis.         |             |             |
|           |                             |             |             |
|           | \(iv\) A health plan may    |             |             |
|           | require that a request      |             |             |
|           | contain a statement that    |             |             |
|           | disclosure of all or part   |             |             |
|           | of the information to which |             |             |
|           | the request pertains could  |             |             |
|           | endanger the individual.    |             |             |
+-----------+-----------------------------+-------------+-------------+
| [**§      | **(a)** [Standard: access   | 5 USC       | Update SOR  |
| 164.524   | to protected health         | 552a(d); 45 | and/or      |
| Access of | information.]{.underline}   | CFR 5b.5;   | policy.     |
| in        |                             | IHS SOR     |             |
| dividuals | **(1)** [Right of           | 09-17-0001  | Update SOR  |
| to        | access.]{.underline} Except |             | and/or      |
| protected | as otherwise provided in    | Not covered | policy.     |
| health    | paragraph (a)(2) or (a)(3)  | in PA, HHS, |             |
| infor     | of this section, an         | or IHS      | Not         |
| mation**] | individual has a right of   |             | applicable  |
| (../HIPAA | access to inspect and       | Not         | to IHS.     |
| %20Privac | obtain a copy of protected  | applicable  |             |
| y%20Rule. | health information about    | to IHS.     | Not         |
| doc#_Hlk5 | the individual in a         |             | applicable  |
| 16629987) | designated record set, for  | .           | to IHS      |
|           | as long as the protected    |             |             |
|           | health information is       | Not         | Refer to    |
|           | maintained in the           | applicable  | Research    |
|           | designated record set,      | to IHS      | for further |
|           | except for:                 |             | review and  |
|           |                             | 5 USC       | input:      |
|           | **(i)** Psychotherapy       | 552a(d)(5); | impl        |
|           | notes;                      | 45 CFR      | ementation. |
|           |                             | 5b.5; IHS   |             |
|           | \(ii\) Information compiled | SOR         | Update SOR  |
|           | in reasonable anticipation  | 09-17-0001  | and/or      |
|           | of, or for use in, a civil, |             | policy.     |
|           | criminal, or administrative | Not covered |             |
|           | action or proceeding; and   | under PA,   | Update SOR  |
|           |                             | HHS, or IHS | and/or      |
|           | \(iii\) Protected health    |             | policy.     |
|           | information maintained by a | Not covered |             |
|           | covered entity that is:     | in PA, HHS, | Have        |
|           |                             | or IHS.     | workgroup   |
|           | \(A\) Subject to the        |             | consisting  |
|           | Clinical Laboratory         | 5 USC       | of          |
|           | Improvements Amendments of  | 552a(d); 45 | appropriate |
|           | 1988, 42 U.S.C. 263a, to    | CFR 5b.5;   | staff       |
|           | the extent the provision of | IHS SOR     | develop     |
|           | access to the individual    | 09-17-0001  | written     |
|           | would be prohibited by law; |             | policy and  |
|           | or                          | 5 USC       | procedure   |
|           |                             | 552a(d); 45 | to          |
|           | \(B\) Exempt from the       | CFR 5b.5;   | implement.  |
|           | Clinical Laboratory         | IHS SOR     |             |
|           | Improvements Amendments of  | 09-17-0001  | (OPH,       |
|           | 1988, pursuant to 42 CFR    |             | medical,    |
|           | 493.3(a)(2).                | 5 USC       | business    |
|           |                             | 552a(d); 45 | office,     |
|           | \(2\) [Unreviewable grounds | CFR 5b.5;   | privacy     |
|           | for denial.]{.underline} A  | IHS SOR     | staff, OGC, |
|           | covered entity may deny an  | 09-17-0001  | etc.)       |
|           | individual access without   |             |             |
|           | providing the individual an | 5 USC       | Have        |
|           | opportunity for review, in  | 552a(d); 45 | workgroup   |
|           | the following               | CFR 5b.5;   | consisting  |
|           | circumstances.              | IHS SOR     | of          |
|           |                             | 09-17-0001  | appropriate |
|           | \(i\) The protected health  |             | staff       |
|           | information is excepted     | 5 USC       | develop     |
|           | from the right of access by | 552a(d); 45 | policy and  |
|           | paragraph (a)(1) of this    | CFR 5b.5;   | procedures  |
|           | section.                    | IHS SOR     | to          |
|           |                             | 09-17-0001  | implement.  |
|           | \(ii\) A covered entity     |             |             |
|           | that is a correctional      | 5 USC       | Update SOR  |
|           | institution or a covered    | 552a(f); 45 | and/or      |
|           | health care provider acting | CFR 5b. 13; | policy.     |
|           | under the direction of the  | IHS SOR     |             |
|           | correctional institution    | 09-17-0001  | Update SOR  |
|           | may deny, in whole or in    |             | and/or      |
|           | part, an inmate's request   | Covered in  | policy.     |
|           | to obtain a copy of         | PA, HHS,    |             |
|           | protected health            | and IHS.    | Have        |
|           | information, if obtaining   |             | workgroup   |
|           | such copy would jeopardize  | []          | consisting  |
|           | the health, safety,         | {dir="rtl"} | of          |
|           | security, custody, or       |             | appropriate |
|           | rehabilitation of the       | 5           | staff to    |
|           | individual or of other      | []{di       | develop     |
|           | inmates, or the safety of   | r="rtl"}USC | policy and  |
|           | any officer, employee, or   | 552a(d); 45 | procedure   |
|           | other person at the         | CFR 5b.5;   | to          |
|           | correctional institution or | IHS SOR     | implement.  |
|           | responsible for the         | 09-17-0001  |             |
|           | transporting of the inmate. | []          | Update SOR  |
|           |                             | {dir="rtl"} | and/or      |
|           | **(iii)** An individual's   |             | policy.     |
|           | access to protected health  | 5 USC       |             |
|           | information created or      | 552a(d); 45 | Update SOR  |
|           | obtained by a covered       | CFR 5b.5;   | and/or      |
|           | health care provider in the | IHS SOR     | policy.     |
|           | course of research that     | 09-17-0001  |             |
|           | includes treatment may be   |             | Have        |
|           | temporarily suspended for   | 5 USC       | workgroup   |
|           | as long as the research is  | 552a(e); 45 | consisting  |
|           | in progress, provided that  | CFR 5b.7;   | of          |
|           | the individual has agreed   | IHS SOR     | appropriate |
|           | to the denial of access     | 09-17-0001  | staff       |
|           | when consenting to          |             | develop     |
|           | participate in the research | 5 USC       | policy and  |
|           | that includes treatment,    | 552a(e); 45 | procedure   |
|           | and the covered health care | CFR 5b.7;   | to          |
|           | provider has informed the   | IHS SOR     | implement.  |
|           | individual that the right   | 09-17-0001  |             |
|           | of access will be           |             | Update SOR  |
|           | reinstated upon completion  | 5 USC       | and/or      |
|           | of the research.            | 552a(c); 45 | policy.     |
|           |                             | CFR 5b.9;   |             |
|           | **(iv)** An individual's    | IHS SOR     | Update SOR  |
|           | access to protected health  | 09-17-0001  | and/or      |
|           | information that is         |             | policy.     |
|           | contained in records that   |             |             |
|           | are subject to the Privacy  |             | Update SOR  |
|           | Act, 5 U.S.C. § 552a, may   |             | and/or      |
|           | be denied, if the denial of |             | policy.     |
|           | access under the Privacy    |             |             |
|           | Act would meet the          |             | Update SOR  |
|           | requirements of that law.   |             | and/or      |
|           |                             |             | policy.     |
|           | **(v)** An individual's     |             |             |
|           | access may be denied if the |             | Update SOR  |
|           | protected health            |             | and/or      |
|           | information was obtained    |             | policy.     |
|           | from someone other than a   |             |             |
|           | health care provider under  |             | Same as     |
|           | a promise of                |             | above.      |
|           | confidentiality and the     |             |             |
|           | access requested would be   |             | Update SOR  |
|           | reasonably likely to reveal |             | and/or      |
|           | the source of the           |             | policy.     |
|           | information.                |             |             |
|           |                             |             |             |
|           | **(3)** [Reviewable grounds |             |             |
|           | for denial.]{.underline} A  |             |             |
|           | covered entity may deny an  |             |             |
|           | individual access, provided |             |             |
|           | that the individual is      |             |             |
|           | given a right to have such  |             |             |
|           | denials reviewed, as        |             |             |
|           | required by paragraph       |             |             |
|           | (a)(4) of this section, in  |             |             |
|           | the following               |             |             |
|           | circumstances:              |             |             |
|           |                             |             |             |
|           | **(i)** A licensed health   |             |             |
|           | care professional has       |             |             |
|           | determined, in the exercise |             |             |
|           | of professional judgment,   |             |             |
|           | that the access requested   |             |             |
|           | is reasonably likely to     |             |             |
|           | endanger the life or        |             |             |
|           | physical safety of the      |             |             |
|           | individual or another       |             |             |
|           | person;                     |             |             |
|           |                             |             |             |
|           | **(ii)** The protected      |             |             |
|           | health information makes    |             |             |
|           | reference to another person |             |             |
|           | (unless such other person   |             |             |
|           | is a health care provider)  |             |             |
|           | and a licensed health care  |             |             |
|           | professional has            |             |             |
|           | determined, in the exercise |             |             |
|           | of professional judgment,   |             |             |
|           | that the access requested   |             |             |
|           | is reasonably likely to     |             |             |
|           | cause substantial harm to   |             |             |
|           | such other person; or       |             |             |
|           |                             |             |             |
|           | **(iii)** The request for   |             |             |
|           | access is made by the       |             |             |
|           | individual's personal       |             |             |
|           | representative and a        |             |             |
|           | licensed health care        |             |             |
|           | professional has            |             |             |
|           | determined, in the exercise |             |             |
|           | of professional judgment,   |             |             |
|           | that the provision of       |             |             |
|           | access to such personal     |             |             |
|           | representative is           |             |             |
|           | reasonably likely to cause  |             |             |
|           | substantial harm to the     |             |             |
|           | individual or another       |             |             |
|           | person.                     |             |             |
|           |                             |             |             |
|           | **(4)** [Review of a denial |             |             |
|           | of access.]{.underline} If  |             |             |
|           | access is denied on a       |             |             |
|           | ground permitted under      |             |             |
|           | paragraph (a)(3) of this    |             |             |
|           | section, the individual has |             |             |
|           | the right to have the       |             |             |
|           | denial reviewed by a        |             |             |
|           | licensed health care        |             |             |
|           | professional who is         |             |             |
|           | designated by the covered   |             |             |
|           | entity to act as a          |             |             |
|           | reviewing official and who  |             |             |
|           | did not participate in the  |             |             |
|           | original decision to deny.  |             |             |
|           | The covered entity must     |             |             |
|           | provide or deny access in   |             |             |
|           | accordance with the         |             |             |
|           | determination of the        |             |             |
|           | reviewing official under    |             |             |
|           | paragraph (d)(4) of this    |             |             |
|           | section.                    |             |             |
|           |                             |             |             |
|           | **(b)** [Implementation     |             |             |
|           | specifications: requests    |             |             |
|           | for access and timely       |             |             |
|           | action.]{.underline}        |             |             |
|           |                             |             |             |
|           | **(1)** [Individual's       |             |             |
|           | request for                 |             |             |
|           | access.]{.underline} The    |             |             |
|           | covered entity must permit  |             |             |
|           | an individual to request    |             |             |
|           | access to inspect or to     |             |             |
|           | obtain a copy of the        |             |             |
|           | protected health            |             |             |
|           | information about the       |             |             |
|           | individual that is          |             |             |
|           | maintained in a designated  |             |             |
|           | record set. The covered     |             |             |
|           | entity may require          |             |             |
|           | individuals to make         |             |             |
|           | requests for access in      |             |             |
|           | writing, provided that it   |             |             |
|           | informs individuals of such |             |             |
|           | a requirement.              |             |             |
|           |                             |             |             |
|           | **(2)** [Timely action by   |             |             |
|           | the covered                 |             |             |
|           | entity.]{.underline}        |             |             |
|           |                             |             |             |
|           | **(i)** Except as provided  |             |             |
|           | in paragraph (b)(2)(ii) of  |             |             |
|           | this section, the covered   |             |             |
|           | entity must act on a        |             |             |
|           | request for access no later |             |             |
|           | than 30 days after receipt  |             |             |
|           | of the request as follows.  |             |             |
|           |                             |             |             |
|           | **(A)** If the covered      |             |             |
|           | entity grants the request,  |             |             |
|           | in whole or in part, it     |             |             |
|           | must inform the individual  |             |             |
|           | of the acceptance of the    |             |             |
|           | request and provide the     |             |             |
|           | access requested, in        |             |             |
|           | accordance with paragraph   |             |             |
|           | (c) of this section.        |             |             |
|           |                             |             |             |
|           | **(B)** If the covered      |             |             |
|           | entity denies the request,  |             |             |
|           | in whole or in part, it     |             |             |
|           | must provide the individual |             |             |
|           | with a written denial, in   |             |             |
|           | accordance with paragraph   |             |             |
|           | (d) of this section.        |             |             |
|           |                             |             |             |
|           | **(ii)** If the request for |             |             |
|           | access is for protected     |             |             |
|           | health information that is  |             |             |
|           | not maintained or           |             |             |
|           | accessible to the covered   |             |             |
|           | entity on-site, the covered |             |             |
|           | entity must take an action  |             |             |
|           | required by paragraph       |             |             |
|           | (b)(2)(i) of this section   |             |             |
|           | by no later than 60 days    |             |             |
|           | from the receipt of such a  |             |             |
|           | request.                    |             |             |
|           |                             |             |             |
|           | **(iii)** If the covered    |             |             |
|           | entity is unable to take an |             |             |
|           | action required by          |             |             |
|           | paragraph (b)(2)(i)(A) or   |             |             |
|           | (B) of this section within  |             |             |
|           | the time required by        |             |             |
|           | paragraph (b)(2)(i) or (ii) |             |             |
|           | of this section, as         |             |             |
|           | applicable, the covered     |             |             |
|           | entity may extend the time  |             |             |
|           | for such actions by no more |             |             |
|           | than 30 days, provided      |             |             |
|           | that:                       |             |             |
|           |                             |             |             |
|           | **(A)** The covered entity, |             |             |
|           | within the time limit set   |             |             |
|           | by paragraph (b)(2)(i) or   |             |             |
|           | (ii) of this section, as    |             |             |
|           | applicable, provides the    |             |             |
|           | individual with a written   |             |             |
|           | statement of the reasons    |             |             |
|           | for the delay and the date  |             |             |
|           | by which the covered entity |             |             |
|           | will complete its action on |             |             |
|           | the request; and            |             |             |
|           |                             |             |             |
|           | **(B)** The covered entity  |             |             |
|           | may have only one such      |             |             |
|           | extension of time for       |             |             |
|           | action on a request for     |             |             |
|           | access.                     |             |             |
|           |                             |             |             |
|           | **(c)** [Implementation     |             |             |
|           | specifications: provision   |             |             |
|           | of access.]{.underline} If  |             |             |
|           | the covered entity provides |             |             |
|           | an individual with access,  |             |             |
|           | in whole or in part, to     |             |             |
|           | protected health            |             |             |
|           | information, the covered    |             |             |
|           | entity must comply with the |             |             |
|           | following requirements.     |             |             |
|           |                             |             |             |
|           | **(1)** [Providing the      |             |             |
|           | access                      |             |             |
|           | requested.]{.underline} The |             |             |
|           | covered entity must provide |             |             |
|           | the access requested by     |             |             |
|           | individuals, including      |             |             |
|           | inspection or obtaining a   |             |             |
|           | copy, or both, of the       |             |             |
|           | protected health            |             |             |
|           | information about them in   |             |             |
|           | designated record sets. If  |             |             |
|           | the same protected health   |             |             |
|           | information that is the     |             |             |
|           | subject of a request for    |             |             |
|           | access is maintained in     |             |             |
|           | more than one designated    |             |             |
|           | record set or at more than  |             |             |
|           | one location, the covered   |             |             |
|           | entity need only produce    |             |             |
|           | the protected health        |             |             |
|           | information once in         |             |             |
|           | response to a request for   |             |             |
|           | access.                     |             |             |
|           |                             |             |             |
|           | **(2)** [Form of access     |             |             |
|           | requested.]{.underline}     |             |             |
|           |                             |             |             |
|           | **(i)** The covered entity  |             |             |
|           | must provide the individual |             |             |
|           | with access to the          |             |             |
|           | protected health            |             |             |
|           | information in the form or  |             |             |
|           | format requested by the     |             |             |
|           | individual, if it is        |             |             |
|           | readily producible in such  |             |             |
|           | form or format; or, if not, |             |             |
|           | in a readable hard copy     |             |             |
|           | form or such other form or  |             |             |
|           | format as agreed to by the  |             |             |
|           | covered entity and the      |             |             |
|           | individual.                 |             |             |
|           |                             |             |             |
|           | **(ii)** The covered entity |             |             |
|           | may provide the individual  |             |             |
|           | with a summary of the       |             |             |
|           | protected health            |             |             |
|           | information requested, in   |             |             |
|           | lieu of providing access to |             |             |
|           | the protected health        |             |             |
|           | information or may provide  |             |             |
|           | an explanation of the       |             |             |
|           | protected health            |             |             |
|           | information to which access |             |             |
|           | has been provided, if:      |             |             |
|           |                             |             |             |
|           | **(A)** The individual      |             |             |
|           | agrees in advance to such a |             |             |
|           | summary or explanation; and |             |             |
|           |                             |             |             |
|           | **(B)** The individual      |             |             |
|           | agrees in advance to the    |             |             |
|           | fees imposed, if any, by    |             |             |
|           | the covered entity for such |             |             |
|           | summary or explanation.     |             |             |
|           |                             |             |             |
|           | **(3)** [Time and manner of |             |             |
|           | access.]{.underline} The    |             |             |
|           | covered entity must provide |             |             |
|           | the access as requested by  |             |             |
|           | the individual in a timely  |             |             |
|           | manner as required by       |             |             |
|           | paragraph (b)(2) of this    |             |             |
|           | section, including          |             |             |
|           | arranging with the          |             |             |
|           | individual for a convenient |             |             |
|           | time and place to inspect   |             |             |
|           | or obtain a copy of the     |             |             |
|           | protected health            |             |             |
|           | information, or mailing the |             |             |
|           | copy of the protected       |             |             |
|           | health information at the   |             |             |
|           | individual's request. The   |             |             |
|           | covered entity may discuss  |             |             |
|           | the scope, format, and      |             |             |
|           | other aspects of the        |             |             |
|           | request for access with the |             |             |
|           | individual as necessary to  |             |             |
|           | facilitate the timely       |             |             |
|           | provision of access.        |             |             |
|           |                             |             |             |
|           | **(4)** [Fees.]{.underline} |             |             |
|           | If the individual requests  |             |             |
|           | a copy of the protected     |             |             |
|           | health information or       |             |             |
|           | agrees to a summary or      |             |             |
|           | explanation of such         |             |             |
|           | information, the covered    |             |             |
|           | entity may impose a         |             |             |
|           | reasonable, cost-based fee, |             |             |
|           | provided that the fee       |             |             |
|           | includes only the cost of:  |             |             |
|           |                             |             |             |
|           | **(i)** Copying, including  |             |             |
|           | the cost of supplies for    |             |             |
|           | and labor of copying, the   |             |             |
|           | protected health            |             |             |
|           | information requested by    |             |             |
|           | the individual;             |             |             |
|           |                             |             |             |
|           | **(ii)** Postage, when the  |             |             |
|           | individual has requested    |             |             |
|           | the copy, or the summary or |             |             |
|           | explanation, be mailed; and |             |             |
|           |                             |             |             |
|           | **(iii)** Preparing an      |             |             |
|           | explanation or summary of   |             |             |
|           | the protected health        |             |             |
|           | information, if agreed to   |             |             |
|           | by the individual as        |             |             |
|           | required by paragraph       |             |             |
|           | (c)(2)(ii) of this section. |             |             |
|           |                             |             |             |
|           | **(d)** [Implementation     |             |             |
|           | specifications: denial of   |             |             |
|           | access.]{.underline} If the |             |             |
|           | covered entity denies       |             |             |
|           | access, in whole or in      |             |             |
|           | part, to protected health   |             |             |
|           | information, the covered    |             |             |
|           | entity must comply with the |             |             |
|           | following requirements.     |             |             |
|           |                             |             |             |
|           | **(1)** [Making other       |             |             |
|           | information                 |             |             |
|           | accessible.]{.underline}    |             |             |
|           | The covered entity must, to |             |             |
|           | the extent possible, give   |             |             |
|           | the individual access to    |             |             |
|           | any other protected health  |             |             |
|           | information requested,      |             |             |
|           | after excluding the         |             |             |
|           | protected health            |             |             |
|           | information as to which the |             |             |
|           | covered entity has a ground |             |             |
|           | to deny access.             |             |             |
|           |                             |             |             |
|           | **(2)**                     |             |             |
|           | [Denial.]{.underline} The   |             |             |
|           | covered entity must provide |             |             |
|           | a timely, written denial to |             |             |
|           | the individual, in          |             |             |
|           | accordance with paragraph   |             |             |
|           | (b)(2) of this section. The |             |             |
|           | denial must be in plain     |             |             |
|           | language and contain:       |             |             |
|           |                             |             |             |
|           | **(i)** The basis for the   |             |             |
|           | denial;                     |             |             |
|           |                             |             |             |
|           | **(ii)** If applicable, a   |             |             |
|           | statement of the            |             |             |
|           | individual's review rights  |             |             |
|           | under paragraph (a)(4) of   |             |             |
|           | this section, including a   |             |             |
|           | description of how the      |             |             |
|           | individual may exercise     |             |             |
|           | such review rights; and     |             |             |
|           |                             |             |             |
|           | **(iii)** A description of  |             |             |
|           | how the individual may      |             |             |
|           | complain to the covered     |             |             |
|           | entity pursuant to the      |             |             |
|           | complaint procedures in §   |             |             |
|           | 164.530(d) or to the        |             |             |
|           | Secretary pursuant to the   |             |             |
|           | procedures in § 160.306.    |             |             |
|           | The description must        |             |             |
|           | include the name, or title, |             |             |
|           | and telephone number of the |             |             |
|           | contact person or office    |             |             |
|           | designated in §             |             |             |
|           | 164.530(a)(1)(ii).          |             |             |
|           |                             |             |             |
|           | **(3)** [Other              |             |             |
|           | r                           |             |             |
|           | esponsibility.]{.underline} |             |             |
|           | If the covered entity does  |             |             |
|           | not maintain the protected  |             |             |
|           | health information that is  |             |             |
|           | the subject of the          |             |             |
|           | individual's request for    |             |             |
|           | access, and the covered     |             |             |
|           | entity knows where the      |             |             |
|           | requested information is    |             |             |
|           | maintained, the covered     |             |             |
|           | entity must inform the      |             |             |
|           | individual where to direct  |             |             |
|           | the request for access.     |             |             |
|           |                             |             |             |
|           | **(4)** [Review of denial   |             |             |
|           | requested.]{.underline} If  |             |             |
|           | the individual has          |             |             |
|           | requested a review of a     |             |             |
|           | denial under paragraph      |             |             |
|           | (a)(4) of this section, the |             |             |
|           | covered entity must         |             |             |
|           | designate a licensed health |             |             |
|           | care professional, who was  |             |             |
|           | not directly involved in    |             |             |
|           | the denial to review the    |             |             |
|           | decision to deny access.    |             |             |
|           | The covered entity must     |             |             |
|           | promptly refer a request    |             |             |
|           | for review to such          |             |             |
|           | designated reviewing        |             |             |
|           | official. The designated    |             |             |
|           | reviewing official must     |             |             |
|           | determine, within a         |             |             |
|           | reasonable period of time,  |             |             |
|           | whether or not to deny the  |             |             |
|           | access requested based on   |             |             |
|           | the standards in paragraph  |             |             |
|           | (a)(3) of this section. The |             |             |
|           | covered entity must         |             |             |
|           | promptly provide written    |             |             |
|           | notice to the individual of |             |             |
|           | the determination of the    |             |             |
|           | designated reviewing        |             |             |
|           | official and take other     |             |             |
|           | action as required by this  |             |             |
|           | section to carry out the    |             |             |
|           | designated reviewing        |             |             |
|           | official's determination.   |             |             |
|           |                             |             |             |
|           | **(e)** [Implementation     |             |             |
|           | specification:              |             |             |
|           | documentation.]{.underline} |             |             |
|           | A covered entity must       |             |             |
|           | document the following and  |             |             |
|           | retain the documentation as |             |             |
|           | required by § 164.530(j):   |             |             |
|           |                             |             |             |
|           | **(1)** The designated      |             |             |
|           | record sets that are        |             |             |
|           | subject to access by        |             |             |
|           | individuals; and            |             |             |
|           |                             |             |             |
|           | **(2)** The titles of the   |             |             |
|           | persons or offices          |             |             |
|           | responsible for receiving   |             |             |
|           | and processing requests for |             |             |
|           | access by individuals.      |             |             |
+-----------+-----------------------------+-------------+-------------+
| #### [**  | **(a)** [Standard: right to | 5 USC       | Update SOR  |
| § 164.526 | amend.]{.underline}         | 552a(c); 45 | and/or      |
|  Amendmen |                             | CFR 5b.9;   | policy.     |
| t of prot | **(1)** [Right to           | IHS SOR     |             |
| ected hea | amend.]{.underline} An      | 09-17-0001  | Same as     |
| lth infor | individual has the right to |             | above.      |
| mation**] | have a covered entity amend | 5 USC       |             |
| (../HIPAA | protected health            | 552a(c); 45 | Update SOR  |
| %20Privac | information or a record     | CFR 5b.9;   | and/or      |
| y%20Rule. | about the individual in a   | IHS SOR     | policy.     |
| doc#_Hlk5 | designated record set for   | 09-17-0001  |             |
| 16630053) | as long as the protected    |             | Have        |
|           | health information is       | 5 USC       | workgroup   |
|           | maintained in the           | 552a(c); 45 | consisting  |
|           | designated record set.      | CFR 5b.9;   | of          |
|           |                             | IHS SOR     | appropriate |
|           | **(2)** [Denial of          | 09-17-0001  | staff       |
|           | amendment.]{.underline} A   |             | develop     |
|           | covered entity may deny an  | 5 USC       | policy and  |
|           | individual's request for    | 552a(c); 45 | procedure.  |
|           | amendment, if it determines | CFR 5b.9;   |             |
|           | that the protected health   | IHS SOR     | Same as     |
|           | information or record that  | 09-17-0001  | above.      |
|           | is the subject of the       |             |             |
|           | request:                    | 5 USC       | Update SOR  |
|           |                             | 552a(c); 45 | and/or      |
|           | \(i\) Was not created by    | CFR 5b.9;   | policy.     |
|           | the covered entity, unless  | IHS SOR     |             |
|           | the individual provides a   | 09-17-0001  | Update SOR  |
|           | reasonable basis to believe |             | and/or      |
|           | that the originator of      | 5 USC       | policy.     |
|           | protected health            | 552a(c); 45 | Have        |
|           | information is no longer    | CFR 5b.9;   | workgroup   |
|           | available to act on the     | IHS SOR     | consisting  |
|           | requested amendment;        | 09-17-0001  | of          |
|           |                             |             | appropriate |
|           | \(ii\) Is not part of the   | 5 USC       | staff       |
|           | designated record set;      | 552a(c); 45 | develop     |
|           |                             | CFR 5b.9;   | policy and  |
|           | \(iii\) Would not be        | IHS SOR     | procedure.  |
|           | available for inspection    | 09-17-0001  |             |
|           | under § 164.524; or         |             | Update SOR  |
|           |                             | 5 USC       | and/or      |
|           | \(iv\) Is accurate and      | 552a(c); 45 | policy.     |
|           | complete.                   | CFR 5b.9;   | Have        |
|           |                             | IHS SOR     | workgroup   |
|           | **(b)** [Implementation     | 09-17-0001  | consisting  |
|           | specifications: requests    |             | of          |
|           | for amendment and timely    |             | appropriate |
|           | action.]{.underline}        |             | staff       |
|           |                             |             | develop     |
|           | **(1)** [Individual's       |             | policy and  |
|           | request for                 |             | procedure.  |
|           | amendment.]{.underline} The |             |             |
|           | covered entity must permit  |             | Update SOR  |
|           | an individual to request    |             | and/or      |
|           | that the covered entity     |             | policy.     |
|           | amend the protected health  |             | Have        |
|           | information maintained in   |             | workgroup   |
|           | the designated record set.  |             | consisting  |
|           | The covered entity may      |             | of          |
|           | require individuals to make |             | appropriate |
|           | requests for amendment in   |             | staff       |
|           | writing and to provide a    |             | develop     |
|           | reason to support a         |             | policy and  |
|           | requested amendment,        |             | procedure.  |
|           | provided that it informs    |             |             |
|           | individuals in advance of   |             | Update SOR  |
|           | such requirements.          |             | and/or      |
|           |                             |             | policy.     |
|           | **(2)** [Timely action by   |             | Have        |
|           | the covered                 |             | workgroup   |
|           | entity.]{.underline}        |             | consisting  |
|           |                             |             | of          |
|           | **(i)** The covered entity  |             | appropriate |
|           | must act on the             |             | staff       |
|           | individual's request for an |             | develop     |
|           | amendment no later than 60  |             | policy and  |
|           | days after receipt of such  |             | procedure.  |
|           | a request, as follows.      |             |             |
|           |                             |             | Update SOR  |
|           | **(A)** If the covered      |             | and/or      |
|           | entity grants the requested |             | policy.     |
|           | amendment, in whole or in   |             | Have        |
|           | part, it must take the      |             | workgroup   |
|           | actions required by         |             | consisting  |
|           | paragraphs (c)(1) and (2)   |             | of          |
|           | of this section.            |             | appropriate |
|           |                             |             | staff       |
|           | **(B)** If the covered      |             | develop     |
|           | entity denies the requested |             | policy and  |
|           | amendment, in whole or in   |             | procedure.  |
|           | part, it must provide the   |             |             |
|           | individual with a written   |             | Update SOR  |
|           | denial, in accordance with  |             | and/or      |
|           | paragraph (d)(1) of this    |             | policy.     |
|           | section.                    |             | Have        |
|           |                             |             | workgroup   |
|           | **(ii**) If the covered     |             | consisting  |
|           | entity is unable to act on  |             | of          |
|           | the amendment within the    |             | appropriate |
|           | time required by paragraph  |             | staff       |
|           | (b)(2)(i) of this section,  |             | develop     |
|           | the covered entity may      |             | policy and  |
|           | extend the time for such    |             | procedure.  |
|           | action by no more than 30   |             |             |
|           | days, provided that:        |             | Update SOR  |
|           |                             |             | and/or      |
|           | **(A)** The covered entity, |             | policy.     |
|           | within the time limit set   |             | Have        |
|           | by paragraph (b)(2)(i) of   |             | workgroup   |
|           | this section, provides the  |             | consisting  |
|           | individual with a written   |             | of          |
|           | statement of the reasons    |             | appropriate |
|           | for the delay and the date  |             | staff       |
|           | by which the covered entity |             | develop     |
|           | will complete its action on |             | policy and  |
|           | the request; and            |             | procedure.  |
|           |                             |             |             |
|           | **(B)** The covered entity  |             |             |
|           | may have only one such      |             |             |
|           | extension of time for       |             |             |
|           | action on a request for an  |             |             |
|           | amendment.                  |             |             |
|           |                             |             |             |
|           | **(c)** [Implementation     |             |             |
|           | specifications: accepting   |             |             |
|           | the amendment.]{.underline} |             |             |
|           | If the covered entity       |             |             |
|           | accepts the requested       |             |             |
|           | amendment, in whole or in   |             |             |
|           | part, the covered entity    |             |             |
|           | must comply with the        |             |             |
|           | following requirements.     |             |             |
|           |                             |             |             |
|           | **(1)** [Making the         |             |             |
|           | amendment.]{.underline} The |             |             |
|           | covered entity must make    |             |             |
|           | the appropriate amendment   |             |             |
|           | to the protected health     |             |             |
|           | information or record that  |             |             |
|           | is the subject of the       |             |             |
|           | request for amendment by,   |             |             |
|           | at a minimum, identifying   |             |             |
|           | the records in the          |             |             |
|           | designated record set that  |             |             |
|           | are affected by the         |             |             |
|           | amendment and appending or  |             |             |
|           | otherwise providing a link  |             |             |
|           | to the location of the      |             |             |
|           | amendment.                  |             |             |
|           |                             |             |             |
|           | **(2)** [Informing the      |             |             |
|           | individual.]{.underline} In |             |             |
|           | accordance with paragraph   |             |             |
|           | (b) of this section, the    |             |             |
|           | covered entity must timely  |             |             |
|           | inform the individual that  |             |             |
|           | the amendment is accepted   |             |             |
|           | and obtain the individual's |             |             |
|           | identification of and       |             |             |
|           | agreement to have the       |             |             |
|           | covered entity notify the   |             |             |
|           | relevant persons with which |             |             |
|           | the amendment needs to be   |             |             |
|           | shared in accordance with   |             |             |
|           | paragraph (c)(3) of this    |             |             |
|           | section.                    |             |             |
|           |                             |             |             |
|           | **(3)** [Informing          |             |             |
|           | others.]{.underline} The    |             |             |
|           | covered entity must make    |             |             |
|           | reasonable efforts to       |             |             |
|           | inform and provide the      |             |             |
|           | amendment within a          |             |             |
|           | reasonable time to:         |             |             |
|           |                             |             |             |
|           | **(i)** Persons identified  |             |             |
|           | by the individual as having |             |             |
|           | received protected health   |             |             |
|           | information about the       |             |             |
|           | individual and needing the  |             |             |
|           | amendment; and              |             |             |
|           |                             |             |             |
|           | **(ii)** Persons, including |             |             |
|           | business associates, that   |             |             |
|           | the covered entity knows    |             |             |
|           | have the protected health   |             |             |
|           | information that is the     |             |             |
|           | subject of the amendment    |             |             |
|           | and that may have relied,   |             |             |
|           | or could foreseeably rely,  |             |             |
|           | on such information to the  |             |             |
|           | detriment of the            |             |             |
|           | individual.                 |             |             |
|           |                             |             |             |
|           | **(d)** [Implementation     |             |             |
|           | specifications: denying the |             |             |
|           | amendment.]{.underline} If  |             |             |
|           | the covered entity denies   |             |             |
|           | the requested amendment, in |             |             |
|           | whole or in part, the       |             |             |
|           | covered entity must comply  |             |             |
|           | with the following          |             |             |
|           | requirements.               |             |             |
|           |                             |             |             |
|           | **(1)**                     |             |             |
|           | [Denial.]{.underline} The   |             |             |
|           | covered entity must provide |             |             |
|           | the individual with a       |             |             |
|           | timely, written denial, in  |             |             |
|           | accordance with paragraph   |             |             |
|           | (b)(2) of this section. The |             |             |
|           | denial must use plain       |             |             |
|           | language and contain:       |             |             |
|           |                             |             |             |
|           | **(i)** The basis for the   |             |             |
|           | denial, in accordance with  |             |             |
|           | paragraph (a)(2) of this    |             |             |
|           | section;                    |             |             |
|           |                             |             |             |
|           | **(ii)** The individual's   |             |             |
|           | right to submit a written   |             |             |
|           | statement disagreeing with  |             |             |
|           | the denial and how the      |             |             |
|           | individual may file such a  |             |             |
|           | statement;                  |             |             |
|           |                             |             |             |
|           | **(iii)** A statement that, |             |             |
|           | if the individual does not  |             |             |
|           | submit a statement of       |             |             |
|           | disagreement, the           |             |             |
|           | individual may request that |             |             |
|           | the covered entity provide  |             |             |
|           | the individual's request    |             |             |
|           | for amendment and the       |             |             |
|           | denial with any future      |             |             |
|           | disclosures of the          |             |             |
|           | protected health            |             |             |
|           | information that is the     |             |             |
|           | subject of the amendment;   |             |             |
|           | and                         |             |             |
|           |                             |             |             |
|           | **(iv)** A description of   |             |             |
|           | how the individual may      |             |             |
|           | complain to the covered     |             |             |
|           | entity pursuant to the      |             |             |
|           | complaint procedures        |             |             |
|           | established in § 164.530(d) |             |             |
|           | or to the Secretary         |             |             |
|           | pursuant to the procedures  |             |             |
|           | established in § 160.306.   |             |             |
|           | The description must        |             |             |
|           | include the name, or title, |             |             |
|           | and telephone number of the |             |             |
|           | contact person or office    |             |             |
|           | designated in               |             |             |
|           | §164.530(a)(1)(ii).         |             |             |
|           |                             |             |             |
|           | **(2)** [Statement of       |             |             |
|           | disagreement.]{.underline}  |             |             |
|           | The covered entity must     |             |             |
|           | permit the individual to    |             |             |
|           | submit to the covered       |             |             |
|           | entity a written statement  |             |             |
|           | disagreeing with the denial |             |             |
|           | of all or part of a         |             |             |
|           | requested amendment and the |             |             |
|           | basis of such disagreement. |             |             |
|           | The covered entity may      |             |             |
|           | reasonably limit the length |             |             |
|           | of a statement of           |             |             |
|           | disagreement.               |             |             |
|           |                             |             |             |
|           | **(3)** [Rebuttal           |             |             |
|           | statement.]{.underline} The |             |             |
|           | covered entity may prepare  |             |             |
|           | a written rebuttal to the   |             |             |
|           | individual's statement of   |             |             |
|           | disagreement. Whenever such |             |             |
|           | a rebuttal is prepared, the |             |             |
|           | covered entity must provide |             |             |
|           | a copy to the individual    |             |             |
|           | who submitted the statement |             |             |
|           | of disagreement.            |             |             |
|           |                             |             |             |
|           | **(4)**                     |             |             |
|           | [                           |             |             |
|           | Recordkeeping.]{.underline} |             |             |
|           | The covered entity must, as |             |             |
|           | appropriate, identify the   |             |             |
|           | record or protected health  |             |             |
|           | information in the          |             |             |
|           | designated record set that  |             |             |
|           | is the subject of the       |             |             |
|           | disputed amendment and      |             |             |
|           | append or otherwise link    |             |             |
|           | the individual's request    |             |             |
|           | for an amendment, the       |             |             |
|           | covered entity's denial of  |             |             |
|           | the request, the            |             |             |
|           | individual's statement of   |             |             |
|           | disagreement, if any, and   |             |             |
|           | the covered entity's        |             |             |
|           | rebuttal, if any, to the    |             |             |
|           | designated record set.      |             |             |
|           |                             |             |             |
|           | **(5)** [Future             |             |             |
|           | disclosures.]{.underline}   |             |             |
|           |                             |             |             |
|           | **(i)** If a statement of   |             |             |
|           | disagreement has been       |             |             |
|           | submitted by the            |             |             |
|           | individual, the covered     |             |             |
|           | entity must include the     |             |             |
|           | material appended in        |             |             |
|           | accordance with paragraph   |             |             |
|           | (d)(4) of this section, or, |             |             |
|           | at the election of the      |             |             |
|           | covered entity, an accurate |             |             |
|           | summary of any such         |             |             |
|           | information, with any       |             |             |
|           | subsequent disclosure of    |             |             |
|           | the protected health        |             |             |
|           | information to which the    |             |             |
|           | disagreement relates.       |             |             |
|           |                             |             |             |
|           | **(ii)** If the individual  |             |             |
|           | has not submitted a written |             |             |
|           | statement of disagreement,  |             |             |
|           | the covered entity must     |             |             |
|           | include the individual's    |             |             |
|           | request for amendment and   |             |             |
|           | its denial, or an accurate  |             |             |
|           | summary of such             |             |             |
|           | information, with any       |             |             |
|           | subsequent disclosure of    |             |             |
|           | the protected health        |             |             |
|           | information only if the     |             |             |
|           | individual has requested    |             |             |
|           | such action in accordance   |             |             |
|           | with paragraph (d)(1)(iii)  |             |             |
|           | of this section.            |             |             |
|           |                             |             |             |
|           | **(iii)** When a subsequent |             |             |
|           | disclosure described in     |             |             |
|           | paragraph (d)(5)(i) or (ii) |             |             |
|           | of this section is made     |             |             |
|           | using a standard            |             |             |
|           | transaction under part 162  |             |             |
|           | of this subchapter that     |             |             |
|           | does not permit the         |             |             |
|           | additional material to be   |             |             |
|           | included with the           |             |             |
|           | disclosure, the covered     |             |             |
|           | entity may separately       |             |             |
|           | transmit the material       |             |             |
|           | required by paragraph       |             |             |
|           | (d)(5)(i) or (ii) of this   |             |             |
|           | section, as applicable, to  |             |             |
|           | the recipient of the        |             |             |
|           | standard transaction.       |             |             |
|           |                             |             |             |
|           | **(e)** [Implementation     |             |             |
|           | specification: actions on   |             |             |
|           | notices of                  |             |             |
|           | amendment.]{.underline} A   |             |             |
|           | covered entity that is      |             |             |
|           | informed by another covered |             |             |
|           | entity of an amendment to   |             |             |
|           | an individual's protected   |             |             |
|           | health information, in      |             |             |
|           | accordance with paragraph   |             |             |
|           | (c)(3) of this section,     |             |             |
|           | must amend the protected    |             |             |
|           | health information in       |             |             |
|           | designated record sets as   |             |             |
|           | provided by paragraph       |             |             |
|           | (c)(1) of this section.     |             |             |
|           |                             |             |             |
|           | **(f)** [Implementation     |             |             |
|           | specification:              |             |             |
|           | documentation.]{.underline} |             |             |
|           | A covered entity must       |             |             |
|           | document the titles of the  |             |             |
|           | persons or offices          |             |             |
|           | responsible for receiving   |             |             |
|           | and processing requests for |             |             |
|           | amendments by individuals   |             |             |
|           | and retain the              |             |             |
|           | documentation as required   |             |             |
|           | by § 164.530(j).            |             |             |
+-----------+-----------------------------+-------------+-------------+
| #### [    | **(a)** [Standard: right to | 5 USC       | Update SOR  |
| **§ 164.5 | an accounting of            | 552a(c); 45 | and/or      |
| 28 Accoun | disclosures of protected    | CFR 5b.9;   | policy.     |
| ting of d | health                      | IHS SOR     |             |
| isclosure | information.]{.underline}   | 09-17-0001  | Update SOR  |
| s of prot |                             |             | and/or      |
| ected hea | **(1)** An individual has a | 5 USC       | policy.     |
| lth infor | right to receive an         | 552a(c); 45 |             |
| mation**] | accounting of disclosures   | CFR 5b.9;   | Have        |
| (../HIPAA | of protected health         | IHS SOR     | workgroup   |
| %20Privac | information made by a       | 09-17-0001  | consisted   |
| y%20Rule. | covered entity in the six   |             | of          |
| doc#_Hlk5 | years prior to the date on  | 5 USC       | appropriate |
| 16630111) | which the accounting is     | 552a(c); 45 | staff       |
|           | requested, except for       | CFR 5b.9;   | develop     |
|           | disclosures:                | IHS SOR     | policy and  |
|           |                             | 09-17-0001  | procedure   |
|           | **(i)** To carry out        |             | to          |
|           | treatment, payment and      | []          | implement.  |
|           | health care operations as   | {dir="rtl"} |             |
|           | provided in § 164.502;      |             | Have        |
|           |                             |             | workgroup   |
|           | **(ii)** To individuals of  |             | consisted   |
|           | protected health            |             | of          |
|           | information about them as   |             | appropriate |
|           | provided in § 164.502;      |             | staff       |
|           |                             |             | develop     |
|           | **(iii)** For the           |             | policy and  |
|           | facility's directory or to  |             | procedure   |
|           | persons involved in the     |             | to          |
|           | individual's care or other  |             | implement.  |
|           | notification purposes as    |             |             |
|           | provided in § 164.510;      |             | Update SOR  |
|           |                             |             | and/or      |
|           | **(iv)** For national       |             | policy.     |
|           | security or intelligence    |             |             |
|           | purposes as provided in §   |             | Have        |
|           | 164.512(k)(2);              |             | workgroup   |
|           |                             |             | consisted   |
|           | **(v)** To correctional     |             | of          |
|           | institutions or law         |             | appropriate |
|           | enforcement officials as    |             | staff       |
|           | provided in §               |             | develop     |
|           | 164.512(k)(5); or           |             | policy and  |
|           |                             |             | procedure   |
|           | **(vi)** That occurred      |             | to          |
|           | prior to the compliance     |             | implement.  |
|           | date for the covered        |             |             |
|           | entity.                     |             | Update SOR  |
|           |                             |             | and/or      |
|           | **(2)(i)** The covered      |             | policy.     |
|           | entity must temporarily     |             |             |
|           | suspend an individual's     |             | Have        |
|           | right to receive an         |             | workgroup   |
|           | accounting of disclosures   |             | consisted   |
|           | to a health oversight       |             | of          |
|           | agency or law enforcement   |             | appropriate |
|           | official, as provided in §  |             | staff       |
|           | 164.512(d) or (f),          |             | develop     |
|           | respectively, for the time  |             | policy and  |
|           | specified by such agency or |             | procedure   |
|           | official, if such agency or |             | to          |
|           | official provides the       |             | implement.  |
|           | covered entity with a       |             |             |
|           | written statement that such |             |             |
|           | an accounting to the        |             |             |
|           | individual would be         |             |             |
|           | reasonably likely to impede |             |             |
|           | the agency\'s activities    |             |             |
|           | and specifying the time for |             |             |
|           | which such a suspension is  |             |             |
|           | required.                   |             |             |
|           |                             |             |             |
|           | **(ii)** If the agency or   |             |             |
|           | official statement in       |             |             |
|           | paragraph (a)(2)(i) of this |             |             |
|           | section is made orally, the |             |             |
|           | covered entity must:        |             |             |
|           |                             |             |             |
|           | **(A)** Document the        |             |             |
|           | statement, including the    |             |             |
|           | identity of the agency or   |             |             |
|           | official making the         |             |             |
|           | statement;                  |             |             |
|           |                             |             |             |
|           | **(B)** Temporarily suspend |             |             |
|           | the individual's right to   |             |             |
|           | an accounting of            |             |             |
|           | disclosures subject to the  |             |             |
|           | statement; and              |             |             |
|           |                             |             |             |
|           | **(C)** Limit the temporary |             |             |
|           | suspension to no longer     |             |             |
|           | than 30 days from the date  |             |             |
|           | of the oral statement,      |             |             |
|           | unless a written statement  |             |             |
|           | pursuant to paragraph       |             |             |
|           | (a)(2)(i) of this section   |             |             |
|           | is submitted during that    |             |             |
|           | time.                       |             |             |
|           |                             |             |             |
|           | **(3)** An individual may   |             |             |
|           | request an accounting of    |             |             |
|           | disclosures for a period of |             |             |
|           | time less than six years    |             |             |
|           | from the date of the        |             |             |
|           | request.                    |             |             |
|           |                             |             |             |
|           | **(b)** [Implementation     |             |             |
|           | specifications: content of  |             |             |
|           | the                         |             |             |
|           | accounting.]{.underline}    |             |             |
|           | The covered entity must     |             |             |
|           | provide the individual with |             |             |
|           | a written accounting that   |             |             |
|           | meets the following         |             |             |
|           | requirements.               |             |             |
|           |                             |             |             |
|           | **(1)** Except as otherwise |             |             |
|           | provided by paragraph (a)   |             |             |
|           | of this section, the        |             |             |
|           | accounting must include     |             |             |
|           | disclosures of protected    |             |             |
|           | health information that     |             |             |
|           | occurred during the six     |             |             |
|           | years (or such shorter time |             |             |
|           | period at the request of    |             |             |
|           | the individual as provided  |             |             |
|           | in paragraph (a)(3) of this |             |             |
|           | section) prior to the date  |             |             |
|           | of the request for an       |             |             |
|           | accounting, including       |             |             |
|           | disclosures to or by        |             |             |
|           | business associates of the  |             |             |
|           | covered entity.             |             |             |
|           |                             |             |             |
|           | **(2)** The accounting must |             |             |
|           | include for each            |             |             |
|           | disclosure:                 |             |             |
|           |                             |             |             |
|           | **(i)** The date of the     |             |             |
|           | disclosure;                 |             |             |
|           |                             |             |             |
|           | **(ii)** The name of the    |             |             |
|           | entity or person who        |             |             |
|           | received the protected      |             |             |
|           | health information and, if  |             |             |
|           | known, the address of such  |             |             |
|           | entity or person;           |             |             |
|           |                             |             |             |
|           | **(iii)** A brief           |             |             |
|           | description of the          |             |             |
|           | protected health            |             |             |
|           | information disclosed; and  |             |             |
|           |                             |             |             |
|           | **(iv)** A brief statement  |             |             |
|           | of the purpose of the       |             |             |
|           | disclosure that reasonably  |             |             |
|           | informs the individual of   |             |             |
|           | the basis for the           |             |             |
|           | disclosure; or, in lieu of  |             |             |
|           | such statement:             |             |             |
|           |                             |             |             |
|           | **(A)** A copy of the       |             |             |
|           | individual's written        |             |             |
|           | authorization pursuant to § |             |             |
|           | 164.508; or                 |             |             |
|           |                             |             |             |
|           | **(B)** A copy of a written |             |             |
|           | request for a disclosure    |             |             |
|           | under §§ 164.502(a)(2)(ii)  |             |             |
|           | or 164.512, if any.         |             |             |
|           |                             |             |             |
|           | **(3)** If, during the      |             |             |
|           | period covered by the       |             |             |
|           | accounting, the covered     |             |             |
|           | entity has made multiple    |             |             |
|           | disclosures of protected    |             |             |
|           | health information to the   |             |             |
|           | same person or entity for a |             |             |
|           | single purpose under §§     |             |             |
|           | 164.502(a)(2)(ii) or        |             |             |
|           | 164.512, or pursuant to a   |             |             |
|           | single authorization under  |             |             |
|           | § 164.508, the accounting   |             |             |
|           | may, with respect to such   |             |             |
|           | multiple disclosures,       |             |             |
|           | provide:                    |             |             |
|           |                             |             |             |
|           | **(i)** The information     |             |             |
|           | required by paragraph       |             |             |
|           | (b)(2) of this section for  |             |             |
|           | the first disclosure during |             |             |
|           | the accounting period;      |             |             |
|           |                             |             |             |
|           | **(ii)** The frequency,     |             |             |
|           | periodicity, or number of   |             |             |
|           | the disclosures made during |             |             |
|           | the accounting period; and  |             |             |
|           |                             |             |             |
|           | **(iii)** The date of the   |             |             |
|           | last such disclosure during |             |             |
|           | the accounting period.      |             |             |
|           |                             |             |             |
|           | **(c)** [Implementation     |             |             |
|           | specifications: provision   |             |             |
|           | of the                      |             |             |
|           | accounting.]{.underline}    |             |             |
|           |                             |             |             |
|           | **(1)** The covered entity  |             |             |
|           | must act on the             |             |             |
|           | individual's request for an |             |             |
|           | accounting, no later than   |             |             |
|           | 60 days after receipt of    |             |             |
|           | such a request, as follows. |             |             |
|           |                             |             |             |
|           | **(i)** The covered entity  |             |             |
|           | must provide the individual |             |             |
|           | with the accounting         |             |             |
|           | requested; or               |             |             |
|           |                             |             |             |
|           | **(ii)** If the covered     |             |             |
|           | entity is unable to provide |             |             |
|           | the accounting within the   |             |             |
|           | time required by paragraph  |             |             |
|           | (c)(1) of this section, the |             |             |
|           | covered entity may extend   |             |             |
|           | the time to provide the     |             |             |
|           | accounting by no more than  |             |             |
|           | 30 days, provided that:     |             |             |
|           |                             |             |             |
|           | **(A)** The covered entity, |             |             |
|           | within the time limit set   |             |             |
|           | by paragraph (c)(1) of this |             |             |
|           | section, provides the       |             |             |
|           | individual with a written   |             |             |
|           | statement of the reasons    |             |             |
|           | for the delay and the date  |             |             |
|           | by which the covered entity |             |             |
|           | will provide the            |             |             |
|           | accounting; and             |             |             |
|           |                             |             |             |
|           | **(B)** The covered entity  |             |             |
|           | may have only one such      |             |             |
|           | extension of time for       |             |             |
|           | action on a request for an  |             |             |
|           | accounting.                 |             |             |
|           |                             |             |             |
|           | **(2)** The covered entity  |             |             |
|           | must provide the first      |             |             |
|           | accounting to an individual |             |             |
|           | in any 12 month period      |             |             |
|           | without charge. The covered |             |             |
|           | entity may impose a         |             |             |
|           | reasonable, cost-based fee  |             |             |
|           | for each subsequent request |             |             |
|           | for an accounting by the    |             |             |
|           | same individual within the  |             |             |
|           | 12 month period, provided   |             |             |
|           | that the covered entity     |             |             |
|           | informs the individual in   |             |             |
|           | advance of the fee and      |             |             |
|           | provides the individual     |             |             |
|           | with an opportunity to      |             |             |
|           | withdraw or modify the      |             |             |
|           | request for a subsequent    |             |             |
|           | accounting in order to      |             |             |
|           | avoid or reduce the fee.    |             |             |
|           |                             |             |             |
|           | **(d)** [Implementation     |             |             |
|           | specification:              |             |             |
|           | documentation.]{.underline} |             |             |
|           | A covered entity must       |             |             |
|           | document the following and  |             |             |
|           | retain the documentation as |             |             |
|           | required by § 164.530(j):   |             |             |
|           |                             |             |             |
|           | **(1)** The information     |             |             |
|           | required to be included in  |             |             |
|           | an accounting under         |             |             |
|           | paragraph (b) of this       |             |             |
|           | section for disclosures of  |             |             |
|           | protected health            |             |             |
|           | information that are        |             |             |
|           | subject to an accounting    |             |             |
|           | under paragraph (a) of this |             |             |
|           | section;                    |             |             |
|           |                             |             |             |
|           | **(2)** The written         |             |             |
|           | accounting that is provided |             |             |
|           | to the individual under     |             |             |
|           | this section; and           |             |             |
|           |                             |             |             |
|           | **(3)** The titles of the   |             |             |
|           | persons or offices          |             |             |
|           | responsible for receiving   |             |             |
|           | and processing requests for |             |             |
|           | an accounting by            |             |             |
|           | individuals.                |             |             |
+-----------+-----------------------------+-------------+-------------+
| ###       | **(a)(1)** [Standard:       | 5 USC       | At the HQ   |
| # [**§ 16 | personnel                   | 552a(f); 45 | level, a PA |
| 4.530 Adm | designations.]{.underline}  | CFR 5b.2;   | Officer is  |
| inistrati |                             | IHS Privacy | a full-time |
| ve requir | \(i\) A covered entity must | Act         | position;   |
| ements**] | designate a privacy         | Procedures. | Area-level, |
| (../HIPAA | official who is responsible |             | privacy act |
| %20Privac | for the development and     |             | respo       |
| y%20Rule. | implementation of the       |             | nsibilities |
| doc#_Hlk5 | policies and procedures of  |             | are         |
| 16630177) | the entity.                 |             | delegated   |
|           |                             |             | in most     |
|           | **(ii)** A covered entity   |             | cases to    |
|           | must designate a contact    |             | Medical     |
|           | person or office who is     |             | Records     |
|           | responsible for receiving   |             | positions;  |
|           | complaints under this       |             | SU-level,   |
|           | section and who is able to  |             | PA          |
|           | provide further information |             | respo       |
|           | about matters covered by    |             | nsibilities |
|           | the notice required by §    |             | are covered |
|           | 164.520.                    |             | by Medical  |
|           |                             |             | Records     |
|           | **(2)** [Implementation     |             | Supv./HIMS  |
|           | specification: personnel    |             | staff.      |
|           | designations.]{.underline}  |             |             |
|           | A covered entity must       |             | Have        |
|           | document the personnel      |             | workgroup   |
|           | designations in paragraph   |             | consisted   |
|           | (a)(1) of this section as   |             | of          |
|           | required by paragraph (j)   |             | appropriate |
|           | of this section.            |             | staff       |
|           |                             |             | develop     |
|           | **(b)(1)** [Standard:       |             | policy and  |
|           | training.]{.underline} A    |             | procedure   |
|           | covered entity must train   |             | to          |
|           | all members of its          |             | implement.  |
|           | workforce on the policies   |             |             |
|           | and procedures with respect |             | Existing    |
|           | to protected health         |             | Area PA and |
|           | information required by     |             | contracted  |
|           | this subpart, as necessary  |             | trainers    |
|           | and appropriate for the     |             | (designed   |
|           | members of the workforce to |             | specific to |
|           | carry out their function    |             | IHS) can    |
|           | within the covered entity.  |             | accomplish  |
|           |                             |             | training.   |
|           | **(2)** [Implementation     |             |             |
|           | specifications:             |             | Have        |
|           | training.]{.underline}      |             | workgroup   |
|           |                             |             | consisted   |
|           | **(i)** A covered entity    |             | of          |
|           | must provide training that  |             | appropriate |
|           | meets the requirements of   |             | staff       |
|           | paragraph (b)(1) of this    |             | develop     |
|           | section, as follows:        |             | policy and  |
|           |                             |             | procedure   |
|           | **(A)** To each member of   |             | to          |
|           | the covered entity\'s       |             | implement.  |
|           | workforce by no later than  |             |             |
|           | the compliance date for the |             | Have        |
|           | covered entity;             |             | workgroup   |
|           |                             |             | consisted   |
|           | **(B)** Thereafter, to each |             | of          |
|           | new member of the workforce |             | appropriate |
|           | within a reasonable period  |             | staff       |
|           | of time after the person    |             | develop     |
|           | joins the covered entity's  |             | policy and  |
|           | workforce; and              |             | procedure   |
|           |                             |             | to          |
|           | **(C)** To each member of   |             | implement.  |
|           | the covered entity's        |             |             |
|           | workforce whose functions   |             | Have        |
|           | are affected by a material  |             | workgroup   |
|           | change in the policies or   |             | consisted   |
|           | procedures required by this |             | of          |
|           | subpart, within a           |             | appropriate |
|           | reasonable period of time   |             | staff       |
|           | after the material change   |             | develop     |
|           | becomes effective in        |             | policy and  |
|           | accordance with paragraph   |             | procedure   |
|           | (i) of this section.        |             | to          |
|           |                             |             | implement.  |
|           | **(ii)** A covered entity   |             |             |
|           | must document that the      |             | Have        |
|           | training as described in    |             | workgroup   |
|           | paragraph (b)(2)(i) of this |             | consisted   |
|           | section has been provided,  |             | of          |
|           | as required by paragraph    |             | appropriate |
|           | (j) of this section.        |             | staff       |
|           |                             |             | develop     |
|           | **(c)(1)** [Standard:       |             | policy and  |
|           | safeguards.]{.underline} A  |             | procedure   |
|           | covered entity must have in |             | to          |
|           | place appropriate           |             | implement.  |
|           | administrative, technical,  |             |             |
|           | and physical safeguards to  |             | Have        |
|           | protect the privacy of      |             | workgroup   |
|           | protected health            |             | consisted   |
|           | information.                |             | of          |
|           |                             |             | appropriate |
|           | **(2)** [Implementation     |             | staff       |
|           | specification:              |             | develop     |
|           | safeguards.]{.underline} A  |             | policy and  |
|           | covered entity must         |             | procedure   |
|           | reasonably safeguard        |             | to          |
|           | protected health            |             | implement.  |
|           | information from any        |             |             |
|           | intentional or              |             | Have        |
|           | unintentional use or        |             | workgroup   |
|           | disclosure that is in       |             | consisted   |
|           | violation of the standards, |             | of          |
|           | implementation              |             | appropriate |
|           | specifications or other     |             | staff       |
|           | requirements of this        |             | develop     |
|           | subpart.                    |             | policy and  |
|           |                             |             | procedure   |
|           | **(d)(1)** [Standard:       |             | to          |
|           | complaints to the covered   |             | implement.  |
|           | entity.]{.underline} A      |             |             |
|           | covered entity must provide |             | Have        |
|           | a process for individuals   |             | workgroup   |
|           | to make complaints          |             | consisted   |
|           | concerning the covered      |             | of          |
|           | entity\'s policies and      |             | appropriate |
|           | procedures required by this |             | staff       |
|           | subpart or its compliance   |             | develop     |
|           | with such policies and      |             | policy and  |
|           | procedures or the           |             | procedure   |
|           | requirements of this        |             | to          |
|           | subpart.                    |             | implement.  |
|           |                             |             |             |
|           | **(2)** [Implementation     |             | Have        |
|           | specification:              |             | workgroup   |
|           | documentation of            |             | consisted   |
|           | complaints.]{.underline} As |             | of          |
|           | required by paragraph (j)   |             | appropriate |
|           | of this section, a covered  |             | staff       |
|           | entity must document all    |             | develop     |
|           | complaints received, and    |             | policy and  |
|           | their disposition, if any.  |             | procedure   |
|           |                             |             | to          |
|           | **(e)(1)** [Standard:       |             | implement.  |
|           | sanctions]{.underline}. A   |             |             |
|           | covered entity must have    |             | (OPH,       |
|           | and apply appropriate       |             | medical,    |
|           | sanctions against members   |             | business    |
|           | of its workforce who fail   |             | office,     |
|           | to comply with the privacy  |             | chs,        |
|           | policies and procedures of  |             | privacy     |
|           | the covered entity or the   |             | staff, OGC, |
|           | requirements of this        |             | etc.)       |
|           | subpart. This standard does |             |             |
|           | not apply to a member of    |             | Have        |
|           | the covered entity's        |             | workgroup   |
|           | workforce with respect to   |             | consisted   |
|           | actions that are covered by |             | of          |
|           | and that meet the           |             | appropriate |
|           | conditions of § 164.502(j)  |             | staff       |
|           | or paragraph (g)(2) of this |             | develop     |
|           | section.                    |             | policy and  |
|           |                             |             | procedure   |
|           | **(2)** [Implementation     |             | to          |
|           | specification:              |             | implement.  |
|           | documentation.]{.underline} |             |             |
|           | As required by paragraph    |             | (OPH,       |
|           | (j) of this section, a      |             | medical,    |
|           | covered entity must         |             | business    |
|           | document the sanctions that |             | office,     |
|           | are applied, if any.        |             | chs,        |
|           |                             |             | privacy     |
|           | **(f)** [Standard:          |             | staff, OGC, |
|           | mitigation.]{.underline} A  |             | etc.)       |
|           | covered entity must         |             |             |
|           | mitigate, to the extent     |             | Have        |
|           | practicable, any harmful    |             | workgroup   |
|           | effect that is known to the |             | consisted   |
|           | covered entity of a use or  |             | of          |
|           | disclosure of protected     |             | appropriate |
|           | health information in       |             | staff       |
|           | violation of its policies   |             | develop     |
|           | and procedures or the       |             | policy and  |
|           | requirements of this        |             | procedure   |
|           | subpart by the covered      |             | to          |
|           | entity or its business      |             | implement.  |
|           | associate.                  |             |             |
|           |                             |             | (OPH,       |
|           | **(g)** [Standard:          |             | medical,    |
|           | refraining from             |             | business    |
|           | intimidating or retaliatory |             | office,     |
|           | acts.]{.underline} A        |             | chs,        |
|           | covered entity may not      |             | privacy     |
|           | intimidate, threaten,       |             | staff, OGC, |
|           | coerce, discriminate        |             | etc.)       |
|           | against, or take other      |             |             |
|           | retaliatory action against: |             | Have        |
|           |                             |             | workgroup   |
|           | **(1)**                     |             | consisted   |
|           | [Individuals.]{.underline}  |             | of          |
|           | Any individual for the      |             | appropriate |
|           | exercise by the individual  |             | staff       |
|           | of any right under, or for  |             | develop     |
|           | participation by the        |             | policy and  |
|           | individual in any process   |             | procedure   |
|           | established by this         |             | to          |
|           | subpart, including the      |             | implement.  |
|           | filing of a complaint under |             |             |
|           | this section;               |             | (OPH,       |
|           |                             |             | medical,    |
|           | **(2**) [Individuals and    |             | business    |
|           | others.]{.underline} Any    |             | office,     |
|           | individual or other person  |             | chs,        |
|           | for:                        |             | privacy     |
|           |                             |             | staff, OGC, |
|           | **(i)** Filing of a         |             | etc.)       |
|           | complaint with the          |             |             |
|           | Secretary under subpart C   |             | Have        |
|           | of part 160 of this         |             | workgroup   |
|           | subchapter;                 |             | consisted   |
|           |                             |             | of          |
|           | **(ii)** Testifying,        |             | appropriate |
|           | assisting, or participating |             | staff       |
|           | in an investigation,        |             | develop     |
|           | compliance review,          |             | policy and  |
|           | proceeding, or hearing      |             | procedure   |
|           | under Part C of Title XI;   |             | to          |
|           | or                          |             | implement.  |
|           |                             |             |             |
|           | **(iii)** Opposing any act  |             | (OPH,       |
|           | or practice made unlawful   |             | medical,    |
|           | by this subpart, provided   |             | business    |
|           | the individual or person    |             | office,     |
|           | has a good faith belief     |             | chs,        |
|           | that the practice opposed   |             | privacy     |
|           | is unlawful, and the manner |             | staff, OGC, |
|           | of the opposition is        |             | etc.)       |
|           | reasonable and does not     |             |             |
|           | involve a disclosure of     |             | Have        |
|           | protected health            |             | workgroup   |
|           | information in violation of |             | consisted   |
|           | this subpart.               |             | of          |
|           |                             |             | appropriate |
|           | **(h)** [Standard: waiver   |             | staff       |
|           | of rights.]{.underline} A   |             | develop     |
|           | covered entity may not      |             | policy and  |
|           | require individuals to      |             | procedure   |
|           | waive their rights under §  |             | to          |
|           | 160.306 of this subchapter  |             | implement.  |
|           | or this subpart as a        |             |             |
|           | condition of the provision  |             | (OPH,       |
|           | of treatment, payment,      |             | medical,    |
|           | enrollment in a health      |             | business    |
|           | plan, or eligibility for    |             | office,     |
|           | benefits.                   |             | chs,        |
|           |                             |             | privacy     |
|           | **(i)(1)** [Standard:       |             | staff, OGC, |
|           | policies and                |             | etc.)       |
|           | procedures.]{.underline} A  |             |             |
|           | covered entity must         |             | Have        |
|           | implement policies and      |             | workgroup   |
|           | procedures with respect to  |             | consisted   |
|           | protected health            |             | of          |
|           | information that are        |             | appropriate |
|           | designed to comply with the |             | staff       |
|           | standards, implementation   |             | develop     |
|           | specifications, or other    |             | policy and  |
|           | requirements of this        |             | procedure   |
|           | subpart. The policies and   |             | to          |
|           | procedures must be          |             | implement.  |
|           | reasonably designed, taking |             |             |
|           | into account the size of    |             | (OPH,       |
|           | and the type of activities  |             | medical,    |
|           | that relate to protected    |             | business    |
|           | health information          |             | office,     |
|           | undertaken by the covered   |             | chs,        |
|           | entity, to ensure such      |             | privacy     |
|           | compliance. This standard   |             | staff, OGC, |
|           | is not to be construed to   |             | etc.)       |
|           | permit or excuse an action  |             |             |
|           | that violates any other     |             | May not be  |
|           | standard, implementation    |             | applicable  |
|           | specification, or other     |             | to IHS.     |
|           | requirement of this         |             |             |
|           | subpart.                    |             |             |
|           |                             |             |             |
|           | **(2)** [Standard: changes  |             |             |
|           | to policies or              |             |             |
|           | procedures.]{.underline}    |             |             |
|           |                             |             |             |
|           | **(i)** A covered entity    |             |             |
|           | must change its policies    |             |             |
|           | and procedures as necessary |             |             |
|           | and appropriate to comply   |             |             |
|           | with changes in the law,    |             |             |
|           | including the standards,    |             |             |
|           | requirements, and           |             |             |
|           | implementation              |             |             |
|           | specifications of this      |             |             |
|           | subpart;                    |             |             |
|           |                             |             |             |
|           | **(ii)** When a covered     |             |             |
|           | entity changes a privacy    |             |             |
|           | practice that is stated in  |             |             |
|           | the notice described in §   |             |             |
|           | 164.520, and makes          |             |             |
|           | corresponding changes to    |             |             |
|           | its policies and            |             |             |
|           | procedures, it may make the |             |             |
|           | changes effective for       |             |             |
|           | protected health            |             |             |
|           | information that it created |             |             |
|           | or received prior to the    |             |             |
|           | effective date of the       |             |             |
|           | notice revision, if the     |             |             |
|           | covered entity has, in      |             |             |
|           | accordance with § 164.520   |             |             |
|           | (b)(1)(v)(C), included in   |             |             |
|           | the notice a statement      |             |             |
|           | reserving its right to make |             |             |
|           | such a change in its        |             |             |
|           | privacy practices; or       |             |             |
|           |                             |             |             |
|           | **(iii)** A covered entity  |             |             |
|           | may make any other changes  |             |             |
|           | to policies and procedures  |             |             |
|           | at any time, provided that  |             |             |
|           | the changes are documented  |             |             |
|           | and implemented in          |             |             |
|           | accordance with paragraph   |             |             |
|           | (i)(5) of this section.     |             |             |
|           |                             |             |             |
|           | **(3)** [Implementation     |             |             |
|           | specification: changes in   |             |             |
|           | law.]{.underline} Whenever  |             |             |
|           | there is a change in law    |             |             |
|           | that necessitates a change  |             |             |
|           | to the covered entity's     |             |             |
|           | policies or procedures, the |             |             |
|           | covered entity must         |             |             |
|           | promptly document and       |             |             |
|           | implement the revised       |             |             |
|           | policy or procedure. If the |             |             |
|           | change in law materially    |             |             |
|           | affects the content of the  |             |             |
|           | notice required by §        |             |             |
|           | 164.520, the covered entity |             |             |
|           | must promptly make the      |             |             |
|           | appropriate revisions to    |             |             |
|           | the notice in accordance    |             |             |
|           | with § 164.520(b)(3).       |             |             |
|           | Nothing in this paragraph   |             |             |
|           | may be used by a covered    |             |             |
|           | entity to excuse a failure  |             |             |
|           | to comply with the law.     |             |             |
|           |                             |             |             |
|           | **(4)** [Implementation     |             |             |
|           | specifications: changes to  |             |             |
|           | privacy practices stated in |             |             |
|           | the notice.]{.underline}    |             |             |
|           |                             |             |             |
|           | **(i)** To implement a      |             |             |
|           | change as provided by       |             |             |
|           | paragraph (i)(2)(ii) of     |             |             |
|           | this section, a covered     |             |             |
|           | entity must:                |             |             |
|           |                             |             |             |
|           | **(A)** Ensure that the     |             |             |
|           | policy or procedure, as     |             |             |
|           | revised to reflect a change |             |             |
|           | in the covered entity's     |             |             |
|           | privacy practice as stated  |             |             |
|           | in its notice, complies     |             |             |
|           | with the standards,         |             |             |
|           | requirements, and           |             |             |
|           | implementation              |             |             |
|           | specifications of this      |             |             |
|           | subpart;                    |             |             |
|           |                             |             |             |
|           | **(B)** Document the policy |             |             |
|           | or procedure, as revised,   |             |             |
|           | as required by paragraph    |             |             |
|           | (j) of this section; and    |             |             |
|           |                             |             |             |
|           | **(C)** Revise the notice   |             |             |
|           | as required by §            |             |             |
|           | 164.520(b)(3) to state the  |             |             |
|           | changed practice and make   |             |             |
|           | the revised notice          |             |             |
|           | available as required by §  |             |             |
|           | 164.520(c). The covered     |             |             |
|           | entity may not implement a  |             |             |
|           | change to a policy or       |             |             |
|           | procedure prior to the      |             |             |
|           | effective date of the       |             |             |
|           | revised notice.             |             |             |
|           |                             |             |             |
|           | **(ii)** If a covered       |             |             |
|           | entity has not reserved its |             |             |
|           | right under §164.520        |             |             |
|           | (b)(1)(v)(C) to change a    |             |             |
|           | privacy practice that is    |             |             |
|           | stated in the notice, the   |             |             |
|           | covered entity is bound by  |             |             |
|           | the privacy practices as    |             |             |
|           | stated in the notice with   |             |             |
|           | respect to protected health |             |             |
|           | information created or      |             |             |
|           | received while such notice  |             |             |
|           | is in effect. A covered     |             |             |
|           | entity may change a privacy |             |             |
|           | practice that is stated in  |             |             |
|           | the notice, and the related |             |             |
|           | policies and procedures,    |             |             |
|           | without having reserved the |             |             |
|           | right to do so, provided    |             |             |
|           | that:                       |             |             |
|           |                             |             |             |
|           | **(A)** Such change meets   |             |             |
|           | the implementation the      |             |             |
|           | requirements in paragraphs  |             |             |
|           | (i)(4)(i)(A)-(C) of this    |             |             |
|           | section; and                |             |             |
|           |                             |             |             |
|           | **(B)** Such change is      |             |             |
|           | effective only with respect |             |             |
|           | to protected health         |             |             |
|           | information created or      |             |             |
|           | received after the          |             |             |
|           | effective date of the       |             |             |
|           | notice.                     |             |             |
|           |                             |             |             |
|           | **(5)** [Implementation     |             |             |
|           | specification: changes to   |             |             |
|           | other policies or           |             |             |
|           | procedures.]{.underline} A  |             |             |
|           | covered entity may change,  |             |             |
|           | at any time, a policy or    |             |             |
|           | procedure that does not     |             |             |
|           | materially affect the       |             |             |
|           | content of the notice       |             |             |
|           | required by § 164.520,      |             |             |
|           | provided that:              |             |             |
|           |                             |             |             |
|           | **(i)** The policy or       |             |             |
|           | procedure, as revised,      |             |             |
|           | complies with the           |             |             |
|           | standards, requirements,    |             |             |
|           | and implementation          |             |             |
|           | specifications of this      |             |             |
|           | subpart; and                |             |             |
|           |                             |             |             |
|           | **(ii)** Prior to the       |             |             |
|           | effective date of the       |             |             |
|           | change, the policy or       |             |             |
|           | procedure, as revised, is   |             |             |
|           | documented as required by   |             |             |
|           | paragraph (j) of this       |             |             |
|           | section.                    |             |             |
|           |                             |             |             |
|           | **(j)(1)** [Standard:       |             |             |
|           | documentation.]{.underline} |             |             |
|           | A covered entity must:      |             |             |
|           |                             |             |             |
|           | **(i)** Maintain the        |             |             |
|           | policies and procedures     |             |             |
|           | provided for in paragraph   |             |             |
|           | (i) of this section in      |             |             |
|           | written or electronic form; |             |             |
|           |                             |             |             |
|           | **(ii)** If a communication |             |             |
|           | is required by this subpart |             |             |
|           | to be in writing, maintain  |             |             |
|           | such writing, or an         |             |             |
|           | electronic copy, as         |             |             |
|           | documentation; and          |             |             |
|           |                             |             |             |
|           | **(iii)** If an action,     |             |             |
|           | activity, or designation is |             |             |
|           | required by this subpart to |             |             |
|           | be documented, maintain a   |             |             |
|           | written or electronic       |             |             |
|           | record of such action,      |             |             |
|           | activity, or designation.   |             |             |
|           |                             |             |             |
|           | **(2)** [Implementation     |             |             |
|           | specification: retention    |             |             |
|           | period.]{.underline} A      |             |             |
|           | covered entity must retain  |             |             |
|           | the documentation required  |             |             |
|           | by paragraph (j)(1) of this |             |             |
|           | section for six years from  |             |             |
|           | the date of its creation or |             |             |
|           | the date when it last was   |             |             |
|           | in effect, whichever is     |             |             |
|           | later.                      |             |             |
|           |                             |             |             |
|           | **(k)** [Standard: group    |             |             |
|           | health plans.]{.underline}  |             |             |
|           |                             |             |             |
|           | **(1)** A group health plan |             |             |
|           | is not subject to the       |             |             |
|           | standards or implementation |             |             |
|           | specifications in           |             |             |
|           | paragraphs (a) through (f)  |             |             |
|           | and (i) of this section, to |             |             |
|           | the extent that:            |             |             |
|           |                             |             |             |
|           | **(i)** The group health    |             |             |
|           | plan provides health        |             |             |
|           | benefits solely through an  |             |             |
|           | insurance contract with a   |             |             |
|           | health insurance issuer or  |             |             |
|           | an HMO; and ,               |             |             |
|           |                             |             |             |
|           | **(ii)** The group health   |             |             |
|           | plan does not create or     |             |             |
|           | receive protected health    |             |             |
|           | information, except for:    |             |             |
|           |                             |             |             |
|           | **(A)** Summary health      |             |             |
|           | information as defined in § |             |             |
|           | 164.504(a); or              |             |             |
|           |                             |             |             |
|           | **(B)** Information on      |             |             |
|           | whether the individual is   |             |             |
|           | participating in the group  |             |             |
|           | health plan, or is enrolled |             |             |
|           | in or has disenrolled from  |             |             |
|           | a health insurance issuer   |             |             |
|           | or HMO offered by the plan. |             |             |
|           |                             |             |             |
|           | **(2)** A group health plan |             |             |
|           | described in paragraph      |             |             |
|           | (k)(1) of this section is   |             |             |
|           | subject to the standard and |             |             |
|           | implementation              |             |             |
|           | specification in paragraph  |             |             |
|           | (j) of this section only    |             |             |
|           | with respect to plan        |             |             |
|           | documents amended in        |             |             |
|           | accordance with §           |             |             |
|           | 164.504(f).                 |             |             |
+-----------+-----------------------------+-------------+-------------+
| #### [    | **(a)** [Standard: effect   |             | Have        |
| **§ 164.5 | of prior consents and       |             | workgroup   |
| 32 Transi | a                           |             | consisted   |
| tion prov | uthorizations.]{.underline} |             | of          |
| isions**] | Notwithstanding other       |             | appropriate |
| (../HIPAA | sections of this subpart, a |             | staff       |
| %20Privac | covered entity may continue |             | develop     |
| y%20Rule. | to use or disclose          |             | policy and  |
| doc#_Hlk5 | protected health            |             | procedure   |
| 16630231) | information pursuant to a   |             | to          |
|           | consent, authorization, or  |             | implement.  |
|           | other express legal         |             |             |
|           | permission obtained from an |             | (OPH,       |
|           | individual permitting the   |             | medical,    |
|           | use or disclosure of        |             | business    |
|           | protected health            |             | office,     |
|           | information that does not   |             | chs,        |
|           | comply with §§ 164.506 or   |             | privacy     |
|           | 164.508 of this subpart     |             | staff, OGC, |
|           | consistent with paragraph   |             | etc.)       |
|           | (b) of this section.        |             |             |
|           |                             |             | Have        |
|           | **(b)** [Implementation     |             | workgroup   |
|           | specification: requirements |             | consisted   |
|           | for retaining effectiveness |             | of          |
|           | of prior consents and       |             | appropriate |
|           | a                           |             | staff       |
|           | uthorizations.]{.underline} |             | develop     |
|           | Notwithstanding other       |             | policy and  |
|           | sections of this subpart,   |             | procedure   |
|           | the following provisions    |             | to          |
|           | apply to use or disclosure  |             | implement.  |
|           | by a covered entity of      |             |             |
|           | protected health            |             | (OPH,       |
|           | information pursuant to a   |             | medical,    |
|           | consent, authorization, or  |             | business    |
|           | other express legal         |             | office,     |
|           | permission obtained from an |             | chs,        |
|           | individual permitting the   |             | privacy     |
|           | use or disclosure of        |             | staff, OGC, |
|           | protected health            |             | etc.)       |
|           | information, if the         |             |             |
|           | consent, authorization, or  |             |             |
|           | other express legal         |             |             |
|           | permission was obtained     |             |             |
|           | from an individual before   |             |             |
|           | the applicable compliance   |             |             |
|           | date of this subpart and    |             |             |
|           | does not comply with §§     |             |             |
|           | 164.506 or 164.508 of this  |             |             |
|           | subpart.                    |             |             |
|           |                             |             |             |
|           | **(1)** If the consent,     |             |             |
|           | authorization, or other     |             |             |
|           | express legal permission    |             |             |
|           | obtained from an individual |             |             |
|           | permits a use or disclosure |             |             |
|           | for purposes of carrying    |             |             |
|           | out treatment, payment, or  |             |             |
|           | health care operations, the |             |             |
|           | covered entity may, with    |             |             |
|           | respect to protected health |             |             |
|           | information that it created |             |             |
|           | or received before the      |             |             |
|           | applicable compliance date  |             |             |
|           | of this subpart and to      |             |             |
|           | which the consent,          |             |             |
|           | authorization, or other     |             |             |
|           | express legal permission    |             |             |
|           | obtained from an individual |             |             |
|           | applies, use or disclose    |             |             |
|           | such information for        |             |             |
|           | purposes of carrying out    |             |             |
|           | treatment, payment, or      |             |             |
|           | health care operations,     |             |             |
|           | provided that:              |             |             |
|           |                             |             |             |
|           | **(i)** The covered entity  |             |             |
|           | does may not make any use   |             |             |
|           | or disclosure that is       |             |             |
|           | expressly excluded from the |             |             |
|           | a consent, authorization,   |             |             |
|           | or other express legal      |             |             |
|           | permission obtained from an |             |             |
|           | individual; and             |             |             |
|           |                             |             |             |
|           | **(ii)** The covered entity |             |             |
|           | complies with all           |             |             |
|           | limitations placed by the   |             |             |
|           | consent, authorization, or  |             |             |
|           | other express legal         |             |             |
|           | permission obtained from an |             |             |
|           | individual.                 |             |             |
|           |                             |             |             |
|           | **(2**) If the consent,     |             |             |
|           | authorization, or other     |             |             |
|           | express legal permission    |             |             |
|           | obtained from an individual |             |             |
|           | specifically permits a use  |             |             |
|           | or disclosure for a purpose |             |             |
|           | other than to carry out     |             |             |
|           | treatment, payment, or      |             |             |
|           | health care operations, the |             |             |
|           | covered entity may, with    |             |             |
|           | respect to protected health |             |             |
|           | information that it created |             |             |
|           | or received before the      |             |             |
|           | applicable compliance date  |             |             |
|           | of this subpart and to      |             |             |
|           | which the consent,          |             |             |
|           | authorization, or other     |             |             |
|           | express legal permission    |             |             |
|           | obtained from an individual |             |             |
|           | applies, make such use or   |             |             |
|           | disclosure, provided that:  |             |             |
|           |                             |             |             |
|           | **(i)** The covered entity  |             |             |
|           | does not make any use or    |             |             |
|           | disclosure that is          |             |             |
|           | expressly excluded from the |             |             |
|           | consent, authorization, or  |             |             |
|           | other express legal         |             |             |
|           | permission obtained from an |             |             |
|           | individual; and             |             |             |
|           |                             |             |             |
|           | **(ii)** The covered entity |             |             |
|           | complies with all           |             |             |
|           | limitations placed by the   |             |             |
|           | consent, authorization, or  |             |             |
|           | other express legal         |             |             |
|           | permission obtained from an |             |             |
|           | individual.                 |             |             |
|           |                             |             |             |
|           | **(3)** In the case of a    |             |             |
|           | consent, authorization, or  |             |             |
|           | other express legal         |             |             |
|           | permission obtained from an |             |             |
|           | individual that identifies  |             |             |
|           | a specific research project |             |             |
|           | that includes treatment of  |             |             |
|           | individuals:                |             |             |
|           |                             |             |             |
|           | **(i)** If the consent,     |             |             |
|           | authorization, or other     |             |             |
|           | express legal permission    |             |             |
|           | obtained from an individual |             |             |
|           | specifically permits a use  |             |             |
|           | or disclosure for purposes  |             |             |
|           | of the project, the covered |             |             |
|           | entity may, with respect to |             |             |
|           | protected health            |             |             |
|           | information that it created |             |             |
|           | or received either before   |             |             |
|           | or after the applicable     |             |             |
|           | compliance date of this     |             |             |
|           | subpart and to which the    |             |             |
|           | consent or authorization    |             |             |
|           | applies, make such use or   |             |             |
|           | disclosure for purposes of  |             |             |
|           | that project, provided that |             |             |
|           | the covered entity complies |             |             |
|           | with all limitations placed |             |             |
|           | by the consent,             |             |             |
|           | authorization, or other     |             |             |
|           | express legal permission    |             |             |
|           | obtained from an            |             |             |
|           | individual.                 |             |             |
|           |                             |             |             |
|           | **(ii)** If the consent,    |             |             |
|           | authorization, or other     |             |             |
|           | express legal permission    |             |             |
|           | obtained from an individual |             |             |
|           | is a general consent to     |             |             |
|           | participate in the project, |             |             |
|           | and a covered entity is     |             |             |
|           | conducting or participating |             |             |
|           | in the research, such       |             |             |
|           | covered entity may, with    |             |             |
|           | respect to protected health |             |             |
|           | information that it created |             |             |
|           | or received as part of the  |             |             |
|           | project before or after the |             |             |
|           | applicable compliance date  |             |             |
|           | of this subpart, make a use |             |             |
|           | or disclosure for purposes  |             |             |
|           | of that project, provided   |             |             |
|           | that the covered entity     |             |             |
|           | complies with all           |             |             |
|           | limitations placed by the   |             |             |
|           | consent, authorization, or  |             |             |
|           | other express legal         |             |             |
|           | permission obtained from an |             |             |
|           | individual.                 |             |             |
|           |                             |             |             |
|           | **(4)** If, after the       |             |             |
|           | applicable compliance date  |             |             |
|           | of this subpart, a covered  |             |             |
|           | entity agrees to a          |             |             |
|           | restriction requested by an |             |             |
|           | individual under §          |             |             |
|           | 164.522(a), a subsequent    |             |             |
|           | use or disclosure of        |             |             |
|           | protected health            |             |             |
|           | information that is subject |             |             |
|           | to the restriction based on |             |             |
|           | a consent, authorization,   |             |             |
|           | or other express legal      |             |             |
|           | permission obtained from an |             |             |
|           | individual as given effect  |             |             |
|           | by paragraph (b) of this    |             |             |
|           | section, must comply with   |             |             |
|           | such restriction.           |             |             |
+-----------+-----------------------------+-------------+-------------+
| #### [**  | \(a\) [Health care          |             | Compliance  |
| § 164.534 | providers.]{.underline} A   |             | info for    |
|  Complian | covered health care         |             | im          |
| ce dates  | provider must comply with   |             | plementing. |
| for initi | the applicable requirements |             |             |
| al implem | of this subpart no later    |             |             |
| entation  | than ~~February 26, 2003~~. |             |             |
| of the pr | April 14, 2003.             |             |             |
| ivacy sta |                             |             |             |
| ndards**] | \(b\) [Health               |             |             |
| (../HIPAA | plans.]{.underline} A       |             |             |
| %20Privac | health plan must comply     |             |             |
| y%20Rule. | with the applicable         |             |             |
| doc#_Hlk5 | requirements of this        |             |             |
| 16630268) | subpart no later than the   |             |             |
|           | following date, as          |             |             |
|           | applicable:                 |             |             |
|           |                             |             |             |
|           | \(1\) [Health plans other   |             |             |
|           | than small health           |             |             |
|           | plans]{.underline} --       |             |             |
|           | ~~February 26, 2003.~~      |             |             |
|           | April 14, 2003.             |             |             |
|           |                             |             |             |
|           | \(2\) [Small health         |             |             |
|           | plans]{.underline} --       |             |             |
|           | ~~February 26, 2004.~~      |             |             |
|           | April 14, 2004.             |             |             |
|           |                             |             |             |
|           | \(c\) [Health care          |             |             |
|           | c                           |             |             |
|           | learinghouses.]{.underline} |             |             |
|           | A health care clearinghouse |             |             |
|           | must comply with the        |             |             |
|           | applicable requirements of  |             |             |
|           | this subpart no later than  |             |             |
|           | ~~February 26, 2003.~~      |             |             |
|           | April 14, 2003.             |             |             |
+-----------+-----------------------------+-------------+-------------+