[Code of Federal Regulations]

[Title 45, Volume 1]

[Revised as of October 1, 2006]

From the U.S. Government Printing Office via GPO Access

[CITE: 45CFR164.506]



[Page 761]

 

                        TITLE 45--PUBLIC WELFARE

 

                    SUBTITLE A--DEPARTMENT OF HEALTH

                           AND HUMAN SERVICES

 

PART 164_SECURITY AND PRIVACY--Table of Contents

 

    Subpart E_Privacy of Individually Identifiable Health Information

 

Sec.  164.506  Uses and disclosures to carry out treatment, payment, or 

health care operations.



    (a) Standard: Permitted uses and disclosures. Except with respect to 

uses or disclosures that require an authorization under Sec.  

164.508(a)(2) and (3), a covered entity may use or disclose protected 

health information for treatment, payment, or health care operations as 

set forth in paragraph (c) of this section, provided that such use or 

disclosure is consistent with other applicable requirements of this 

subpart.

    (b) Standard: Consent for uses and disclosures permitted. (1) A 

covered entity may obtain consent of the individual to use or disclose 

protected health information to carry out treatment, payment, or health 

care operations.

    (2) Consent, under paragraph (b) of this section, shall not be 

effective to permit a use or disclosure of protected health information 

when an authorization, under Sec.  164.508, is required or when another 

condition must be met for such use or disclosure to be permissible under 

this subpart.

    (c) Implementation specifications: Treatment, payment, or health 

care operations. (1) A covered entity may use or disclose protected 

health information for its own treatment, payment, or health care 

operations.

    (2) A covered entity may disclose protected health information for 

treatment activities of a health care provider.

    (3) A covered entity may disclose protected health information to 

another covered entity or a health care provider for the payment 

activities of the entity that receives the information.

    (4) A covered entity may disclose protected health information to 

another covered entity for health care operations activities of the 

entity that receives the information, if each entity either has or had a 

relationship with the individual who is the subject of the protected 

health information being requested, the protected health information 

pertains to such relationship, and the disclosure is:

    (i) For a purpose listed in paragraph (1) or (2) of the definition 

of health care operations; or

    (ii) For the purpose of health care fraud and abuse detection or 

compliance.

    (5) A covered entity that participates in an organized health care 

arrangement may disclose protected health information about an 

individual to another covered entity that participates in the organized 

health care arrangement for any health care operations activities of the 

organized health care arrangement.



[67 FR 53268, Aug. 14, 2002]