Source: http://www.law.cornell.edu/cfr/text/45/164.502
Timestamp: 2015-01-31 04:43:13
Document Index: 724097609

Matched Legal Cases: ['art 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', 'art 160', 'art 160', '§ 164', '§ 164', '§ 164', 'art 160', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164']

45 CFR 164.502 - Uses and disclosures of protected health information: General rules. | LII / Legal Information Institute
CFR › Title 45 › Subtitle A › Subchapter C › Part 164 › Subpart E › Section 164.502 45 CFR 164.502 - Uses and disclosures of protected health information: General rules.
§ 164.502
Uses and disclosures of protected health information: General rules.
Covered entities: Permitted uses and disclosures.
For treatment, payment, or health care operations, as permitted by and in compliance with § 164.506;
Incident to a use or disclosure otherwise permitted or required by this subpart, provided that the covered entity has complied with the applicable requirements of §§ 164.502(b), 164.514(d), and 164.530(c) with respect to such otherwise permitted or required use or disclosure;
Except for uses and disclosures prohibited under § 164.502(a)(5)(i), pursuant to and in compliance with a valid authorization under § 164.508;
Pursuant to an agreement under, or as otherwise permitted by, § 164.510; and
As permitted by and in compliance with this section, § 164.512, § 164.514(e), (f), or (g).
Covered entities: Required disclosures.
To an individual, when requested under, and required by § 164.524 or § 164.528; and
When required by the Secretary under subpart C of part 160 of this subchapter to investigate or determine the covered entity's compliance with this subchapter.
Business associates: Permitted uses and disclosures.
Business associates: Required uses and disclosures.
A business associate is required to disclose protected health information:
When required by the Secretary under subpart C of part 160 of this subchapter to investigate or determine the business associate's compliance with this subchapter.
To the covered entity, individual, or individual's designee, as necessary to satisfy a covered entity's obligations under § 164.524(c)(2)(ii) and (3)(ii) with respect to an individual's request for an electronic copy of protected health information.
Prohibited uses and disclosures.
Use and disclosure of genetic information for underwriting purposes:
Notwithstanding any other provision of this subpart, a health plan, excluding an issuer of a long-term care policy falling within paragraph (1)(viii) of the definition of health plan, shall not use or disclose protected health information that is genetic information for underwriting purposes. For purposes of paragraph (a)(5)(i) of this section, underwriting purposes means, with respect to a health plan:
Except as provided in paragraph (a)(5)(i)(B) of this section:
Underwriting purposes does not include determinations of medical appropriateness where an individual seeks a benefit under the plan, coverage, or policy.
Except pursuant to and in compliance with § 164.508(a)(4), a covered entity or business associate may not sell protected health information.
For purposes of this paragraph, sale of protected health information means:
Standard: Minimum necessary—
Minimum necessary applies. When using or disclosing protected health information or when requesting protected health information from another covered entity or business associate, a covered entity or business associate must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request.
Minimum necessary does not apply.
Uses or disclosures made to the individual, as permitted under paragraph (a)(1)(i) of this section or as required by paragraph (a)(2)(i) of this section;
Uses or disclosures made pursuant to an authorization under § 164.508;
Disclosures made to the Secretary in accordance with subpart C of part 160 of this subchapter;
Uses or disclosures that are required by law, as described by § 164.512(a); and
Uses or disclosures that are required for compliance with applicable requirements of this subchapter.
Standard: Uses and disclosures of protected health information subject to an agreed upon restriction.
A covered entity that has agreed to a restriction pursuant to § 164.522(a)(1) may not use or disclose the protected health information covered by the restriction in violation of such restriction, except as otherwise provided in § 164.522(a).
Standard: Uses and disclosures of de-identified protected health information.
Uses and disclosures to create de-identified information.
A covered entity may use protected health information to create information that is not individually identifiable health information or disclose protected health information only to a business associate for such purpose, whether or not the de-identified information is to be used by the covered entity.
Uses and disclosures of de-identified information.
Health information that meets the standard and implementation specifications for de-identification under § 164.514(a) and (b) is considered not to be individually identifiable health information, i.e., de-identified. The requirements of this subpart do not apply to information that has been de-identified in accordance with the applicable requirements of § 164.514, provided that:
Disclosure of a code or other means of record identification designed to enable coded or otherwise de-identified information to be re-identified constitutes disclosure of protected health information; and
If de-identified information is re-identified, a covered entity may use or disclose such re-identified information only as permitted or required by this subpart.
Standard: Disclosures to business associates.
A covered entity may disclose protected health information to a business associate and may allow a business associate to create, receive, maintain, or transmit protected health information on its behalf, if the covered entity obtains satisfactory assurance that the business associate will appropriately safeguard the information. A covered entity is not required to obtain such satisfactory assurances from a business associate that is a subcontractor.
A business associate may disclose protected health information to a business associate that is a subcontractor and may allow the subcontractor to create, receive, maintain, or transmit protected health information on its behalf, if the business associate obtains satisfactory assurances, in accordance with § 164.504(e)(1)(i), that the subcontractor will appropriately safeguard the information.
The satisfactory assurances required by paragraph (e)(1) of this section must be documented through a written contract or other written agreement or arrangement with the business associate that meets the applicable requirements of § 164.504(e).
Standard: Deceased individuals.
A covered entity must comply with the requirements of this subpart with respect to the protected health information of a deceased individual for a period of 50 years following the death of the individual.
Standard: Personal representatives.
As specified in this paragraph, a covered entity must, except as provided in paragraphs (g)(3) and (g)(5) of this section, treat a personal representative as the individual for purposes of this subchapter.
Implementation specification: Adults and emancipated minors.
If under applicable law a person has authority to act on behalf of an individual who is an adult or an emancipated minor in making decisions related to health care, a covered entity must treat such person as a personal representative under this subchapter, with respect to protected health information relevant to such personal representation.
Implementation specification: Unemancipated minors.
If under applicable law a parent, guardian, or other person acting in loco parentis has authority to act on behalf of an individual who is an unemancipated minor in making decisions related to health care, a covered entity must treat such person as a personal representative under this subchapter, with respect to protected health information relevant to such personal representation, except that such person may not be a personal representative of an unemancipated minor, and the minor has the authority to act as an individual, with respect to protected health information pertaining to a health care service, if:
A parent, guardian, or other person acting in loco parentis assents to an agreement of confidentiality between a covered health care provider and the minor with respect to such health care service.
If, and to the extent, permitted or required by an applicable provision of State or other law, including applicable case law, a covered entity may disclose, or provide access in accordance with § 164.524 to, protected health information about an unemancipated minor to a parent, guardian, or other person acting in loco parentis;
If, and to the extent, prohibited by an applicable provision of State or other law, including applicable case law, a covered entity may not disclose, or provide access in accordance with § 164.524 to, protected health information about an unemancipated minor to a parent, guardian, or other person acting in loco parentis; and
Where the parent, guardian, or other person acting in loco parentis, is not the personal representative under paragraphs (g)(3)(i)(A), (B), or (C) of this section and where there is no applicable access provision under State or other law, including case law, a covered entity may provide or deny access under § 164.524 to a parent, guardian, or other person acting in loco parentis, if such action is consistent with State or other applicable law, provided that such decision must be made by a licensed health care professional, in the exercise of professional judgment.
Implementation specification: Deceased individuals.
If under applicable law an executor, administrator, or other person has authority to act on behalf of a deceased individual or of the individual's estate, a covered entity must treat such person as a personal representative under this subchapter, with respect to protected health information relevant to such personal representation.
Implementation specification: Abuse, neglect, endangerment situations.
Notwithstanding a State law or any requirement of this paragraph to the contrary, a covered entity may elect not to treat a person as the personal representative of an individual if:
The covered entity has a reasonable belief that:
The individual has been or may be subjected to domestic violence, abuse, or neglect by such person; or
Treating such person as the personal representative could endanger the individual; and
Standard: Confidential communications.
A covered health care provider or health plan must comply with the applicable requirements of § 164.522(b) in communicating protected health information.
Standard: Uses and disclosures consistent with notice.
A covered entity that is required by § 164.520 to have a notice may not use or disclose protected health information in a manner inconsistent with such notice. A covered entity that is required by § 164.520(b)(1)(iii) to include a specific statement in its notice if it intends to engage in an activity listed in § 164.520(b)(1)(iii)(A)-(C), may not use or disclose protected health information for such activities, unless the required statement is included in the notice.
Standard: Disclosures by whistleblowers and workforce member crime victims—
Disclosures by whistleblowers.
A covered entity is not considered to have violated the requirements of this subpart if a member of its workforce or a business associate discloses protected health information, provided that:
An attorney retained by or on behalf of the workforce member or business associate for the purpose of determining the legal options of the workforce member or business associate with regard to the conduct described in paragraph (j)(1)(i) of this section.
Disclosures by workforce members who are victims of a crime.
A covered entity is not considered to have violated the requirements of this subpart if a member of its workforce who is the victim of a criminal act discloses protected health information to a law enforcement official, provided that:
The protected health information disclosed is about the suspected perpetrator of the criminal act; and
The protected health information disclosed is limited to the information listed in § 164.512(f)(2)(i).