Standards for Privacy of Individually Identifiable Health Information. Final Privacy Rule Preamble.. Section 164.504 - Uses and Disclosures - Organizational Requirements


Except for disclosures of protected health information by a covered entity that is a health care provider to another health care provider for treatment purposes, § 164.504 requires a covered entity to maintain documentation demonstrating that it meets the requirements set forth in this section and to demonstrate that it has obtained satisfactory assurance from business associates that meet the requirements of this part with each of its business associates. The burden is 5 minutes per entity times an annual average of 764,799 entities for a total burden of 63,733 burden hours.