Standards for Privacy of Individually Identifiable Health Information. Final Privacy Rule Preamble.. Introduction


The final rule's requirements regarding disclosures for directory information and to family members or others involved in an individual's care are in a section separate from that covering disclosures allowed for other national priority purposes. In the final rule, we place most of the other disclosures for national priority purposes in a new § 164.512.

As in the NPRM, in § 164.512 of the final rule, we allow covered entities to make these national priority uses and disclosures without individual authorization. As in the NPRM, these uses and disclosures are discretionary. Covered entities are free to decide whether or not to use or disclose protected health information for any or all of the permitted categories. However, as in the NPRM, nothing in the final rule provides authority for a covered entity to restrict or refuse to make a use or disclosure mandated by other law.

The new § 164.512 includes paragraphs on: uses and disclosures required by law; uses and disclosures for public health activities; disclosures about victims of abuse, neglect, or domestic violence; uses and disclosures for health oversight activities; disclosures for judicial and administrative proceedings; disclosures for law enforcement purposes; uses and disclosures about decedents; uses and disclosures for cadaveric donation of organs, eyes, or tissues; uses and disclosures for research purposes; uses and disclosures to avert a serious threat to health or safety (which we had called "emergency circumstances" in the NPRM); uses and disclosures for specialized government functions (referred to as "specialized classes" in the NPRM); and disclosures to comply with workers' compensation laws.

Section 164.512(c) in the final rule, which addresses uses and disclosures regarding adult victims of abuse, neglect and domestic violence, is new, although it incorporates some provisions from proposed § 164.510 of the NPRM. In the final rule we also eliminate proposed § 164.510(g) on government health data systems and proposed § 164.510(i) on banking and payment processes. These changes are discussed below.

Approach to Use of Protected Health Information

Proposed § 164.510 of the NPRM included specific subparagraphs addressing uses of protected health information by covered entities that were also public health agencies, health oversight agencies, government entities conducting judicial or administrative proceedings, or government heath data systems. Such covered entities could use protected health information in all instances for which they could disclose the information for these purposes. In the final rule, as discussed below, we retain this language in the paragraphs on public health activities and health oversight. However, we eliminate this clause with respect to uses of protected health information for judicial and administrative proceedings, because we no longer believe that there would be any situations in which a covered entity would also be a judicial or administrative tribunal. Proposed § 164.510(e) of the NPRM, regarding disclosure of protected health information to coroners, did not include such a provision. In the final rule we have added it because we believe there are situations in which a covered entity, for example, a public hospital conducting post-mortem investigations, may need to use protected health information for the same purposes for which it would have disclosed the information to a coroner.

While the right to request restrictions under § 164.522 and the consents required under § 164.506 do not apply to the use and disclosure of protected health information under § 164.512, we do not intend to preempt any state or other restrictions, or any right to enforce such agreements or consents under other law.

We note that a covered entity may use or disclose protected health information as permitted by and in accordance with one of the paragraphs of § 164.512, regardless of whether that use or disclosure fails to meet the requirements for use or disclosure under a different paragraph in § 164.512 or elsewhere in the rule.

Verification for Disclosures under § 164.512

In § 164.510(a) of the NPRM, we proposed that covered entities verify the identity and authority of persons to whom they made disclosure under the section. In the final rule, we generally have retained the proposed requirements. Verification requirements are discussed in § 164.514 of the final rule.