NRPM: Standards for Privacy of Individually Identifiable Health Information. 12. Additional uses and disclosures required by other law. (§ 164.510(n))


In § 164.510(n) we propose to allow covered entities to use or disclose protected health information if such use or disclosure is not addressed elsewhere in § 164.510, is required by other law, and the disclosure meets all the relevant requirements of such law.

Other laws may require uses or disclosures of protected health information for purposes not captured by the other provisions of proposed § 164.510. An example is State workers’ compensation laws, which could require health care providers to disclose protected health information to a workers’ compensation insurer or to an employer. Covered entities generally could make uses and disclosures required by such other laws.

Where such a use or disclosure would also be addressed by other provisions of this regulation, the covered entity would also have to follow the requirements of this regulation. Where the provisions of the other law requirements are contrary to the provisions in this proposed rule and more protective of the individual’s privacy, the provisions of the other law would generally control. See discussion in section II.I below.

We have included this section because it is not our intention to obstruct access to information deemed important enough by other authorities to require it by law. We considered omitting this provision because we are concerned that we do not know enough about the required disclosures it would encompass, but decided to retain it in order to raise the issue of permitting disclosures for other, undetermined purposes. We solicit comment on the possible effects of omitting or narrowing this provision.

Under this section, health care providers could make reports of abuse of any person that are required by State law. All States require reports of abuse. All States require reporting to child protective agencies of instances of child abuse or neglect that they identify, and most States require similar reports of abuse or neglect of elderly persons. These are valuable requirements which we support and encourage. The Act (in section 1178(b)) specifically requires that this regulation not interfere with State requirements for reporting of abuse. Additionally, all States require health care providers to report gunshot wounds and certain other health conditions related to violence; this provision would permit such reports.

Section 164.518(c), requiring verification of the identity and legal authority of persons requesting disclosure of protected health information would apply to disclosures under § 164.510(n). As noted above, we are not familiar with all of the disclosures of protected health information that are mandated by State law, so we cannot be certain that the verification requirements in § 164.518(c) would always be appropriate. We solicit comments on whether those requirements would be appropriate for all disclosures that would be permitted here.