(a) Standard: Permitted uses and disclosures. Except with respect to uses or disclosures that require an authorization under § 164.508(a)(2) through (4) or that are prohibited under § 164.502(a)(5)(i), a covered entity may use or disclose protected health information for treatment, payment, or health care operations as set forth in paragraph (c) of this section, provided that such use or disclosure is consistent with other applicable requirements of this subpart.
(b) Standard: Consent for uses and disclosures permitted. (1) A covered entity may obtain consent of the individual to use or disclose protected health information to carry out treatment, payment, or health care operations.
(2) Consent, under paragraph (b) of this section, shall not be effective to permit a use or disclosure of protected health information when an authorization, under § 164.508, is required or when another condition must be met for such use or disclosure to be permissible under this subpart.
(c) Implementation specifications: Treatment, payment, or health care operations. (1) A covered entity may use or disclose protected health information for its own treatment, payment, or health care operations.
(2) A covered entity may disclose protected health information for treatment activities of a health care provider.
(3) A covered entity may disclose protected health information to another covered entity or a health care provider for the payment activities of the entity that receives the information.
(4) A covered entity may disclose protected health information to another covered entity for health care operations activities of the entity that receives the information, if each entity either has or had a relationship with the individual who is the subject of the protected health information being requested, the protected health information pertains to such relationship, and the disclosure is:
(i) For a purpose listed in paragraph (1) or (2) of the definition of health care operations; or
(ii) For the purpose of health care fraud and abuse detection or compliance.
(5) A covered entity that participates in an organized health care arrangement may disclose protected health information about an individual to other participants in the organized health care arrangement for any health care operations activities of the organized health care arrangement.
[67 FR 53268, Aug. 14, 2002, as amended at 78 FR 5698, Jan. 25, 2013]
Notes of Decisions
Cited in
29
cases (
7 in the last 5 years), 2003–2025 · leading case:
Cohan v. Ayabe., 322 P.3d 948 (Haw. 2014).
Cohan v. Ayabe., 322 P.3d 948 (Haw. 2014).
· cites it 6× “” 45 C.F.R. § 164.506 (c)(1). “Health care operations” is defined to include the following activities of the covered entity (to the extent the activities are related to covered functions): (5) Business planning and development, such as conducting cost-management and…”
Jill C. Barber v. Camden Clark Mem'l Hosp. Corp., 815 S.E.2d 474 (W. Va. 2018).
· cites it 2× “to himself, herself or another; (6) For treatment or internal review purposes, to staff of the mental health facility where the patient is being cared for or to other health professionals involved in treatment of the patient; and (7) Without the patient’s consent as provided for…”
A. B. v. The Oregon Clinic, 321 Or. App. 60 (Or. Ct. App. 2022).
· cites it 3× “l- evant on appeal, defendant argued that it was entitled to judgment as a matter of law on plaintiff’s breach of confi- dence claim because its disclosure of plaintiff’s information was permissible under HIPAA’s Privacy Rule and state law allowing the disclosure of PHI from one…”
Premier, Inc. v. Peterson, 804 S.E.2d 599 (N.C. Ct. App. 2017).
· cites it 2× “Although a Hospital Site may freely share information with other entities in the Hospital Network and remain HIPPA compliant, see 45 C.F.R. § 164.506 (c)(5), a Hospital Site or Network must have a BAA in place with any third party in order to share data with that entity.”
RT Vanderbilt Co., Inc. v. Franklin, 290 S.W.3d 654 (Ky. Ct. App. 2009).
“See 45 C.F.R. 164.506 and 164.502. Not knowing the names of the individuals involved in the study did not hamper Vanderbilt’s ability to cross-examine Dr.”
In re Miguel M., 950 N.E.2d 107 (NY 2011).
“The treatment exception permits disclosure of protected health information “for treatment activities of a health care provider” (45 CFR 164.506 [c] [2]). “Treatment” is defined as: “the provision, coordination, or management of health care and related services by one or more…”
Steinberg v. CVS Caremark Corp., 899 F. Supp. 2d 331 (E.D. Pa. 2012).
“” 45 C.F.R. §§ 164.506 , 164.501. The CAC’s allegations suggest two types of disclosures of customer data in this case.”
Suesbury v. Caceres, 840 A.2d 1285 (D.C. 2004).
“Under the Privacy Rule, which represents the most stringent federal regulations to date concerning the privacy of health information, a medical office’s “permitted uses and disclosures” of protected health information, such as Suesbury’s medical condition and T-cell count,…”
Lewis v. Clement, 1 Misc. 3d 464 (N.Y. Sup. Ct. 2003).
“Specifically, 45 CFR 164.506 (c) (4) provides: “A covered entity may disclose protected health information to another covered entity for health care operations activities of the entity that receives the information, if each entity either has or had a relationship with the…”
Annotations are extracted automatically from the opinions in the
Syfert caselaw corpus and ranked by authority, recency, and
treatment. Dots show Syfertize treatment of the citing case itself.