[Code of Federal Regulations]
[Title 45, Volume 1]
[Revised as of October 1, 2004]
From the U.S. Government Printing Office via GPO Access
[CITE: 45CFR164.506]

[Page 750-751]
 
                        TITLE 45--PUBLIC WELFARE
 
                    SUBTITLE A--DEPARTMENT OF HEALTH
                         AND HUMAN SERVICES
 
PART 164_SECURITY AND PRIVACY--Table of Contents
 
    Subpart E_Privacy of Individually Identifiable Health Information
 
Sec. 164.506  Uses and disclosures to carry out treatment, payment, or 
health care operations.

    (a) Standard: Permitted uses and disclosures. Except with respect to 
uses or disclosures that require an authorization under Sec. 
164.508(a)(2) and (3), a covered entity may use or disclose protected 
health information for treatment, payment, or health care operations as 
set forth in paragraph (c) of

[[Page 751]]

this section, provided that such use or disclosure is consistent with 
other applicable requirements of this subpart.
    (b) Standard: Consent for uses and disclosures permitted. (1) A 
covered entity may obtain consent of the individual to use or disclose 
protected health information to carry out treatment, payment, or health 
care operations.
    (2) Consent, under paragraph (b) of this section, shall not be 
effective to permit a use or disclosure of protected health information 
when an authorization, under Sec. 164.508, is required or when another 
condition must be met for such use or disclosure to be permissible under 
this subpart.
    (c) Implementation specifications: Treatment, payment, or health 
care operations.
    (1) A covered entity may use or disclose protected health 
information for its own treatment, payment, or health care operations.
    (2) A covered entity may disclose protected health information for 
treatment activities of a health care provider.
    (3) A covered entity may disclose protected health information to 
another covered entity or a health care provider for the payment 
activities of the entity that receives the information.
    (4) A covered entity may disclose protected health information to 
another covered entity for health care operations activities of the 
entity that receives the information, if each entity either has or had a 
relationship with the individual who is the subject of the protected 
health information being requested, the protected health information 
pertains to such relationship, and the disclosure is:
    (i) For a purpose listed in paragraph (1) or (2) of the definition 
of health care operations; or
    (ii) For the purpose of health care fraud and abuse detection or 
compliance.
    (5) A covered entity that participates in an organized health care 
arrangement may disclose protected health information about an 
individual to another covered entity that participates in the organized 
health care arrangement for any health care operations activities of the 
organized health care arrangement.

[67 FR 53268, Aug. 14, 2002]