Part 3: Uses and Disclosures (FAQ 59 of 65)
59. Does HIPAA Allow Uses and Disclosures Without My Approval?
Yes, does it ever. The HIPAA rule allows dozens of different uses and disclosures without any need for patient consent or authorization. The rule permits so many uses and disclosures that it is hard to count them. The rule has about five pages of dense type describing allowable uses and disclosures of health records.
One important feature of the rule's allowable uses and disclosures is that they are mostly permissive. Just because a use or disclosure can be made without violating the rule does not mean that a covered entity must make the disclosure. A covered entity can just say no to almost any person who asks for a disclosure permitted by the rule. This means that the rule itself is not the most important factor in determining how your record may be used or disclosed. In most cases, it is up to your health care provider or insurer to decide whether to make your record available for a particular activity. If anyone tells you that HIPAA requires a disclosure, you should be very suspicious.
The only two types of disclosure that the rule actually requires are:
We will go over one type of allowable use and disclosure in detail in FAQ 59 to give you better insight into the complexity of use and disclosure.