Source: http://www.annalsofhealthlaw.com/annalsofhealthlaw/vol__26_issue_1?pg=19
Timestamp: 2019-04-19 11:04:02+00:00

Document:
(providing the definition of breach and its exceptions).
70. 45 C.F.R. § 160.103; Health Insurance Technology for Economic and Clinical Health Act § 17921.
71. 45 C.F.R. § 164.502(b), 164.514(d) (2013).
72. 45 C.F.R. § 164.502(b), 164.514(d).
73. 45 C.F.R. § 164.502(b), 164.514(d). The minimum necessary rule does not apply when disclosed to a health care provider for treatment, payment, for operational purposes, or to the individual, pursuant to authorization, for Office for Civil Rights (OCR) complaint investigation, or pursuant to a legal demand; see SUMMARY OF THE HIPAA PRIVACY RULE, U.S. DEP’T HEALTH & HUMAN SERVS. 4–11, https://www.hhs.gov/sites/default/files/privacy summary.pdf (last revised May 2003) (explaining the instances when a CE is permitted to use and disclosures protected health information, the authorization requirements a CE must obtain before any use or disclosure of protected health information, and when the minimum necessary requirement is not imposed on a CE).
74. 45 C.F.R. § 164.520. The three-year distribution depends on material changes not being made. If material changes are made to the notice, the notice must be posted and distributed within 60 days.
75. 45 C.F.R. § 164.520(b).

References: § 160
 § 17921
 § 164
 § 164
 § 164
 § 164
 § 164