What are examples of permitted uses and disclosures of PHI?


Editorial team Published on

Under the HIPAA Privacy Rule, covered entities may use and disclose Protected Health Information (PHI) without a patient's written authorization for specific core activities, public interests, and legal requirements.

Core Permitted Uses (TPO)

  • Treatment: Providing, coordinating, or managing health care and related services among healthcare providers.
  • Payment: Activities by a health plan or provider to obtain or provide reimbursement for care (e.g., billing, eligibility determinations).
  • Health Care Operations: Administrative, financial, legal, and quality improvement activities of the covered entity (e.g., case management, audits, training).

Disclosures to the Individual

  • Patient Access: Giving individuals access to inspect or obtain a copy of their own medical records.
  • HHS Compliance: Disclosing PHI to the U.S. Department of Health and Human Services during an investigation or compliance review.

Opportunity to Agree or Object

  • Informal Permission: Sharing information with family, friends, or others involved in the patient's care by asking directly or assuming agreement based on clear circumstances.
  • Disaster Relief: Disclosing PHI to disaster relief organizations to notify family members of a patient's location or condition.

Public Interest and National Priority Purposes (12 Priorities)

Covered entities may disclose PHI without permission for specific public and governmental goals:

  • Required by Law: Mandated reporting for statutes, regulations, or court orders (e.g., communicable disease tracking).
  • Public Health Activities: Reporting to public health authorities for disease prevention, control, or injury tracking.
  • Abuse or Neglect: Disclosing information regarding victims of abuse, neglect, or domestic violence to government authorities.
  • Health Oversight: Sharing data with health oversight agencies for audits, civil/criminal investigations, or licensure actions.
  • Legal Proceedings: Responding to judicial and administrative proceedings via court orders or subpoenas.
  • Law Enforcement: Assisting law enforcement under restricted conditions (e.g., identifying a suspect or reporting a crime on premises).
  • Decedents and Organ Donation: Sharing details with coroners, medical examiners, funeral directors, and organ procurement organizations.
  • Research: Research approved by an Institutional Review Board (IRB) or privacy board waiver.
  • Serious Threats to Health/Safety: Averting an imminent and serious threat to the health or safety of a person or the public.
  • Specialized Government Functions: Activities regarding military, national security, and correctional institutions.
  • Workers' Compensation: Disclosures authorized to comply with workers' compensation laws.