NRPM: Standards for Privacy of Individually Identifiable Health Information. 1. Use and disclosure for treatment, payment, and health care operations. (§ 164.506(a))


We are proposing that, subject to limited exceptions for psychotherapy notes and research information unrelated to treatment discussed below, a covered entity be permitted to use or disclose protected health information without individual authorization for treatment, payment or health care operations.

The Secretary’s Recommendations proposed that covered entities be able to use individually identifiable health information without authorization of the identified individual for treatment and payment and for purposes that are “compatible with and directly related to” treatment and payment. The Recommendations further explained that the terms “treatment” and “payment” were to be construed broadly, encompassing treatment and payment for all patients. They also noted that the test of “compatible with and directly related to” is meant to be more restrictive than the test currently used in the Privacy Act, 5. U.S.C. 552a, for determining whether a proposed “routine use” is sufficiently related to the primary purpose for which the information would be collected to permit its release under the proposed “routine use.” The Privacy Act permits release of such information if the proposed routine use is “compatible with” the purpose for which the information is collected. Our proposal is intended to be consistent with this discussion from the Secretary’s Recommendations.