HIPAA GENERAL OPERATING POLICY # 15
USES AND DISCLOSURES FOR HEALTH OVERSIGHT ACTIVITIES
I. General Rule
Except as otherwise provided in HIPAA General Operating Policies 8, 44 and 45, a HCC may disclose PHI to a health oversight agency for oversight activities authorized by law, including audits, investigations, inspections, licensure or disciplinary actions, civil, administrative or criminal actions or other activities necessary for oversight of:
a. The health care system
b. Government benefit programs for which health information is relevant to beneficiary eligibility
c. Entities subject to government regulatory programs for which health information is necessary for determining compliance, or
d. Entities subject to civil rights laws for which health information is necessary for determining compliance.
A health oversight activity does not include an investigation or other activity in which the individual is the subject of the investigation or activity and such investigation or activity does not arise out of and is not directly related to the receipt of health care, a claim for public benefits related to health or qualification for or receipt of public benefits or services when a patient's health is integral to the claim for public benefits or services.
Revised 09/04/03