hipaa logo

Part 3: Uses and Disclosures (FAQ 59 of 65)

 

59. Does HIPAA Allow Uses and Disclosures Without My Approval?

Yes, does it ever. The HIPAA rule allows dozens of different uses and disclosures without any need for patient consent or authorization. The rule permits so many uses and disclosures that it is hard to count them. The rule has about five pages of dense type describing allowable uses and disclosures of health records.

SIDEBAR:

Many of HIPAA's allowable uses and disclosures come with terms, conditions, and procedures that the covered entity or the person seeking the information must meet. A simple list of authorized recipients or recognized purposes doesn't necessarily tell you that much. The terms, conditions, and procedures make a big difference to the scope and ease of disclosures. We won't cover all those terms, conditions, and procedures all here because of the complexity. The details are crucial important if you are a covered entity concerned about when it is permissible to make a disclosure. A patient may need to know the details when trying to decide if a covered entity made a disclosure properly. However, a patient with that requirement will have to look elsewhere for the specifics.

One important feature of the rule's allowable uses and disclosures is that they are mostly permissive. Just because a use or disclosure can be made without violating the rule does not mean that a covered entity must make the disclosure. A covered entity can just say no to almost any person who asks for a disclosure permitted by the rule. This means that the rule itself is not the most important factor in determining how your record may be used or disclosed. In most cases, it is up to your health care provider or insurer to decide whether to make your record available for a particular activity. If anyone tells you that HIPAA requires a disclosure, you should be very suspicious.

The only two types of disclosure that the rule actually requires are:

  1. when a patient asks for access to his or her own record, and
  2. when the Secretary of HHS needs access to records to oversee or enforce the HIPAA rule itself. For all other uses and disclosures, it is up to the covered entity to decide whether the use or disclosure is appropriate, legal, and ethical. Of course, other laws may affect that decision.
RULE OF THUMB:

We also want to remind you that the HIPAA rule establishes a floor of privacy protection. If state law or other federal law has higher standards and better privacy protections, then that law controls. If HIPAA allows a disclosure that is prohibited by law in your state, a covered entity in your state may not make the disclosure.

We will go over one type of allowable use and disclosure in detail in FAQ 59 to give you better insight into the complexity of use and disclosure.

 

Jump to list of FAQs 1-65 | See all of Part 3