The NPRM proposed to
prohibit the use or disclosure of protected health information for research without individual authorization as stipulated in proposed § 164.508 unless the covered entity had documentation indicating that an IRB or privacy board had determined that the following waiver criteria had been met:
Not exact matches
Unauthorized
use,
disclosure or copying of this information
or any part thereof is strictly
prohibited and may be unlawful.
The presentation may contain confidential information and unauthorized
use,
disclosure, copying, dissemination,
or redistribution is strictly
prohibited.
If you are not the intended recipient of the email, any
disclosure, copying, distribution
or use of its contents is strictly
prohibited.
Specifically, the new subsections 247.98 (5) and (6) of the Code
prohibit collection
or use by,
or disclosure to, employers of the results of genetic tests without the written consent of the employee.
If you are not the addressee, note that any
disclosure, copying, distribution,
or use of the contents of this message is
prohibited.
In order to strike a balance between fulsome
disclosure and privacy rights, the Courts have developed a law known as the «implied undertaking of confidentiality» which
prohibits a party who receives this forced
disclosure from making
use of the documents / information outside of the lawsuit without consent of the other parties
or a court order.
We
prohibit the
use of broad
or blanket authorizations requesting the
use or disclosure of protected health information for a wide range of unspecified purposes.
The proposed rule would have required that covered health care providers permit individuals to request restrictions of
uses and
disclosures of protected health information and would have
prohibited covered providers from
using or disclosing protected health information in violation of any agreed - to restriction.
We proposed to
prohibit covered entities from conditioning treatment
or payment on authorization for the
use or disclosure of any other protected health information (see proposed § 164.508 (a)(2)(iii)-RRB-.
Comment: A few commenters suggested we
prohibit health care clearinghouses from seeking authorization for the
use or disclosure of protected health information for marketing purposes.
For example, a few commenters suggested we should
prohibit covered entities from seeking authorization for any
use or disclosure for marketing purposes that benefit a third party.
If the
disclosure is pursuant to a satisfactory assurance from the party seeking the
disclosure, at least a good faith attempt has been made to notify the individual in writing of the
disclosure before it is made
or the parties have sought a qualified protective order that
prohibits them from
using or disclosing the protected health information for any purpose other than the litigation
or proceeding for which the information was requested and that the information will be returned to the covered entity
or destroyed at the end of the litigation
or the proceeding.
Thus, so long as the
use of debt collectors is consistent with the regulatory requirements (such as, providers obtain the proper consents, the
disclosure is of the minimum amount of information necessary to collect the debt, the provider
or health plan enter into a business associate agreement with the debt collector, etc.), relying upon debt collectors to obtain reimbursement for the provision of health care would not be
prohibited by the regulation.
This comment also suggested the following as such appropriate safeguard: granting only the right to inspect and take notes; allowing copying of only certain portions of records;
prohibiting removing records from the premises; placing limits on subsequent
use and
disclosure; and requiring return
or destruction of the information at the earliest possible time.)
Comment: Many commenters suggested we
prohibit disclosure of psychotherapy notes without authorization for
uses and
disclosures under proposed § 164.510 of the NPRM,
or that protections should be extended to particular
uses and
disclosures, such as
disclosures for public health, law enforcement, health oversight, and judicial and administrative proceedings.
A covered health care provider must inform an individual of the protected health information that it may include in a directory and the persons to whom it may disclose such information (including
disclosures to clergy of information regarding religious affiliation) and provide the individual with the opportunity to restrict
or prohibit some
or all of the
uses or disclosures permitted by paragraph (a)(1) of this section.
Comment: One commenter recommended that when information from health records is provided to authorized external users, this information should be accompanied by a statement
prohibiting use of the information for other than the stated purpose;
prohibiting disclosure by the recipient to any other party without written authorization from the patient,
or the patient's legal representative, unless such information is urgently needed for the patient's continuing care
or otherwise required by law; and requiring destruction of the information after the stated need has been fulfilled.
We also suggest that this approach ignores the fact that each separate provision of law usually represents a nuanced policy choice to, for example, permit this
use or prohibit that
disclosure; the aggregated approach proposed would fail to recognize and weigh such policy choices.
We proposed to
prohibit covered entities from implementing a change to an information policy
or procedure described in the notice until the notice was updated to reflect the change, unless a compelling reason existed to make a
use or disclosure or take other action that the notice would not have permitted.
Response: We proposed to
prohibit covered entities from conditioning treatment, payment,
or enrollment in a health plan on an authorization for the
use or disclosure of psychotherapy notes (see proposed § 164.508 (a)(3)(iii)-RRB-.
(iii) Section 164.502 relating to
uses and
disclosures of protected health information, except that a clearinghouse is
prohibited from
using or disclosing protected health information other than as permitted in the business associate contract under which it created
or received the protected health information;
In the case of authorization for
use or disclosure of psychotherapy notes
or research information unrelated to treatment, we proposed to
prohibit covered entities from conditioning treatment, payment,
or enrollment in a health plan on obtaining such an authorization.
If another federal law
prohibits a covered entity from
using or disclosing information that is also protected health information, but the privacy regulation permits the
use or disclosure, a covered entity will need to comply with the other federal law and not
use or disclose the information.
For example, if a conflict Start Printed Page 82482appears to exist because a previous statute
or regulation requires a specific
use or disclosure of protected health information that the rules below appear to
prohibit, the
use or disclosure pursuant to that statute
or regulation would not be a violation of the privacy regulation because § 164.512 (a) permits covered entities to
use or disclose protected health information as required by law.
We do not
prohibit covered entities from seeking an individual's written permission for
use or disclosure of protected health information to carry out treatment, payment,
or health care operations.
(C) If a
use or disclosure for any purpose described in paragraphs (b)(1)(ii)(A)
or (B) of this section is
prohibited or materially limited by other applicable law, the description of such
use or disclosure must reflect the more stringent law as defined in § 160.202 of this subchapter.
We also proposed to
prohibit covered entities from seeking individual authorization for
uses and
disclosures for treatment, payment, and health care operations unless required by state
or other applicable law.
In the proposed rule, we would have
prohibited all covered entities from requiring the individual's written legal permission (as proposed, an «authorization») for the
use or disclosure of protected health information to carry out treatment, payment,
or health care operations.
If you are not an intended recipient
or responsible for delivering the message to an intended recipient, any review,
disclosure, conversion to hard copy, dissemination, reproduction
or other
use of any part of this communication is strictly
prohibited, as is the taking
or omitting of any action in reliance upon this communication.