Patient’s Guide to HIPAA – Uses and Disclosures: Does HIPAA Allow Uses and Disclosures Without My Approval?
You are reading the Patient’s Guide to HIPAA, FAQ 58 .
HIPAA Guide Quick Links:
FAQ 58: Does HIPAA Allow Uses and Disclosures Without My Approval?
Yes, does it ever. The HIPAA rule allows dozens of different uses and disclosures without any need for patient consent or authorization. The rule permits so many uses and disclosures that it is hard to count them. The rule has about five pages of dense type describing allowable uses and disclosures of health records.
One important feature of the rule’s allowable uses and disclosures is that they are mostly permissive. Just because a use or disclosure can be made without violating the rule does not mean that a covered entity must make the disclosure. A covered entity can just say no to almost any person who asks for a disclosure permitted by the rule. This means that the rule itself is not the most important factor in determining how your record may be used or disclosed. In most cases, it is up to your health care provider or insurer to decide whether to make your record available for a particular activity. If anyone tells you that HIPAA requires a disclosure, you should be suspicious.
The only two types of disclosure that the rule actually requires are:
1) when a patient asks for access to his or her own record, and
2) when the Secretary of HHS needs access to records to oversee or enforce the HIPAA rule itself. For all other uses and disclosures, it is up to the covered entity to decide whether the use or disclosure is appropriate, legal, and ethical. Of course, other laws may affect that decision, and many laws require disclosure of health records.
We also want to remind you that the HIPAA rule establishes a floor of privacy protection. If state law or other federal law has higher standards and better privacy protections, then that law controls. If HIPAA allows a disclosure that is prohibited by law in your state, a covered entity in your state may not make the disclosure.
We will go over one type of allowable use and disclosure in detail to give you better insight into the complexity of use and disclosure. We will then provide general information on the other permissible uses and disclosures.
Roadmap: Patient’s Guide to HIPAA: Part 3: What You Should Know about Uses and Disclosures (FAQ 58 of 65)