NRPM: Standards for Privacy of Individually Identifiable Health Information. 5. Uses and disclosures for treatment, payment and health care operations.


Under this rule, covered entities with limited exceptions would be permitted to use and disclose protected health information without individual authorization for treatment and payment purposes, and for related purposes that we have defined as health care operations. (See § 164.506.) We would construe the terms “treatment” and “payment” broadly. In section II.B. of this preamble, we describe the types of activities that would be considered health care operations.