HIPAA DISCLOSURE ACCOUNTING REQUIREMENTS

TYPE OF DISCLOSURE

ACCOUNTING REQUIRED

ACCOUNTING

NOT REQUIRED

Covered entities must disclose PHI:

• To the individual 164.502 (a)(2)(I)

x

• To HDC for compliance investigation purposes 164.502 (a)(2)(ii)

x

Covered entities may disclose PHI:

• For treatment, payment, and healthcare operations purposes 164.502 (a)(1)(iii)

x

• With authorization of the individual 164.502 (a)(1)(iv) & 64.508 (a)

x

• Pursuant to a verbal agreement after individual has been given the opportunity to agree or object (e.g. facility directory, next of kin, close personal friend, person involved in individual's care) or for notification or emergency circumstance. 164.510

x

• Disclosures not permitted by law

x

• Without consent or authorization if:

• Incident to a permitted use or disclosure 164.502 (a)(1)(iii)

x

• Required by law 164.512 (a)(1) if: related to child abuse, neglect, or domestic violence 164.512 (c); in the course of judicial and administrative proceedings164.512 (e)(1); or for law enforcement purposes 164.512 (f)

x

• for certain public health activities including disclosures for the purpose of preventing or controlling disease and disclosures related to victims of child abuse or neglect 164.512 (b)(1)

x

• Health oversight 164.512 (d)(1)

x

• About decedents 164.512 (g)(1)

x

• for purposes of cadaveric organ donation 164.512 (h)

x

• for certain research purposes 164.512 (i)(1)

x

• to avert a serious threat to health or safety 164.512 (j)(1)

x

• for specialized government functions 164.512 (k)(1)

x

• for national security or intelligence purposes (164.512 (k)(2)

x

• to correctional institutions or law enforcement officials (164.512 (k)(5)

x

• for worker's compensation 164.512 (l)

x

• for certain marketing or fundraising, exceptions 164.501 & 164.514 (f)(1)

x

• as part of a limited data set 164.514 (e)

x