HIPAA GENERAL OPERATING POLICY #14
USES AND DISCLOSURES TO CARRY OUT TREATMENT,
PAYMENT, OR HEALTH CARE OPERATIONS
Except as otherwise provided in HIPAA General Operating Policies 8, 44 and 45, and for uses or disclosures for marketing purposes, a HCC may use or disclose PHI for treatment, payment or health care operations without an authorization, provided such use or disclosure is consistent with other applicable requirements of the Privacy Rule, as follows:
a. A HCC may use or disclose PHI for its own treatment, payment or health care operations.
b. A HCC may disclose PHI for treatment activities of a health care provider.
c. A HCC may disclose PHI to another Covered Entity or a health care provider for the payment activities of the entity that receives the information.
d. A HCC may disclose PHI to another Covered Entity for health care operations activities of the entity that receives the information, if each entity either has or had a relationship with the individual who is the subject of the PHI being requested, the PHI pertains to such relationship, and the disclosure is for the purpose of conducting quality assessment and improvement activities, reviewing the competence or qualifications of health care professionals, evaluating provider performance and conducting training programs, or health care fraud and abuse detection or compliance.
e. A Covered Entity that is in an OHCA may disclose PHI to another Covered Entity in the OHCA for any health care operations activities of the OHCA.
Notwithstanding the above, in non-emergency situations, written authorization is required to disclose health care information derived from mental health services provided by certain providers to outside health care practitioners or facilities for diagnosis, treatment or care.
Revised 09/04/03