Use and Disclosure
The Privacy Rule prohibits the use and disclosure of PHI for purposes not related to treatment, payment, or health care operations. The identity of a person requesting PHI and his/her authority to receive such information must be verified prior to release of PHI. Computer matches are accessed via system terminals or through personal computers connected to the system.
As a covered entity, DHS is permitted, but not required, to use and disclose PHI, without an individual’s authorization in certain situations and for specific purposes.
The following uses and disclosures do not require authorization from the individual:
treatment, payment, and health care operations (TPO)
public health agencies activities
health oversight and regulatory agency activities
judicial proceedings and law enforcement investigations
healthcare fraud investigations
emergency situations
de-identified information (health information not connected with information identifying the individual)
The following uses and disclosures do require authorization from the individual:
third party disclosures
marketing and fund raising activities
non-health related affiliates
underwriting or related affiliates
employment determinations
sale, rental or barter of PHI
psychotherapy records other than psychotherapy notes