Analysis by the AHIMA Policy and Government Relations Team
Uses and Disclosures Requiring an Opportunity for the Individual to Agree or to Object
The Rule states (§164.510) that "a covered entity may use or disclose PHI without the written consent or authorization of the individual as described in the sections..[on Consents and Authorizations], respectively, provided the individual is informed in advance of the use or disclosure and has the opportunity to agree to or prohibit or restrict the disclosure in accordance with the applicable requirements of this section. The covered entity may orally inform the individual of and obtain the individual’s oral agreement or objection to a use or disclosure permitted by this section.
Standard: Use and Disclosure for Facility Directories
Permitted Uses and Disclosure
Except when an objection is expressed in accordance with the sections immediately below, a covered healthcare provider may:
- Use the following PHI to maintain a directory of individuals in its facility:
- The individual’s name;
- The individual’s location in the covered healthcare provider’s facility;
- The individual’s condition described in general terms that does not communicate specific medical information about the individual; and
- The individual’s religious affiliation; and
- Disclose for directory purposes such information:
- To members of the clergy, or
- Except for religious affiliation, to other persons who ask for the individual by name.
Opportunity to Object
A covered healthcare provider must inform an individual of the PHI that it may include in a directory and the persons to whom it may disclose such information (including disclosures to clergy of information regarding religious affiliation) and provide the individual with the opportunity to restrict or prohibit some or all of the uses or disclosures permitted by the paragraph [just above].
Emergency Circumstances
- If the opportunity to object to uses or disclosures required by this section cannot practicably be provided because of the individual’s incapacity or an emergency treatment circumstance, a covered healthcare provider may use or disclose some or all of the PHI permitted by "permitted uses and disclosure" [just above] for the facility’s directory, if such disclosure is:
- Consistent with a prior expressed preference of the individual, if any, that is known to the covered healthcare provider; and
- In the individual’s best interest as determined by the covered healthcare provider, in the exercise of professional judgment.
- The covered healthcare provider must inform the individual and provide an opportunity to object to uses or disclosures for directory purposes as required when it becomes practicable.
Standard: Uses and Disclosures for Involvement in the Individual’s Care and Notification Purposes
Permitted Uses and Disclosures
- A covered entity may disclose to a family member, other relative, or a close personal friend of the individual, or any other person identified by the individual, the PHI directly relevant to such person’s involvement with the individual’s care or payment related to the individual’s healthcare. |
- A covered entity may use or disclose PHI to notify, or assist in the notification of (including identifying or locating), a family member, a personal representative of the individual, or another person responsible for the care of the individual of the individual’s location, general condition, or death. Any such use or disclosure of PHI for such notification purposes must be in accordance with this section as applicable.
Uses and Disclosures with the Individual Present
If the individual is present for, or otherwise available prior to, a use or disclosure permitted by "permitted uses and disclosures" [just above], and has the capacity to make healthcare decisions, the covered entity may use or disclose the PHI if it:
- Obtains the individual’s agreement;
- Provides the individual with the opportunity to object to the disclosure, and the individual does not express an objection; or
- Reasonably infers from the circumstances, based the exercise of professional judgment, that the individual does not object to the disclosure.
Limited Use and Disclosures When the Individual Is Not Present
If the individual is not present for, or the opportunity to agree or object to the use or disclosure cannot practicably be provided because of the individual’s incapacity or an emergency circumstance, the covered entity may, in the exercise of professional judgment, determine whether the disclosure is in the best interests of the individual and, if so, disclose only the PHI that is directly relevant to the person’s involvement with the individual’s healthcare. A covered entity may use professional judgment and its experience with common practice to make reasonable inferences of the individual’s best interest in allowing a person to act on behalf of the individual to pick up filled prescriptions, medical supplies, X-rays, or other similar forms of PHI.
Use and Disclosures for Disaster Relief Purposes
A covered entity may use or disclose PHI to a public or private entity authorized by law or by its charter to assist in disaster relief efforts, for the purpose of coordinating with such entities the uses or disclosures permitted above. The requirements related to the presence of the individual apply to such uses and disclosure to the extent that the covered entity, in the exercise of professional judgment, determines that the requirements do not interfere with the ability to respond to the emergency circumstances.
Go to next section, Use and Disclosures for Which Consent, an Authorization, or Opportunity to Agree or Object Is Not Required.
Go to previous section, Uses and Disclosures for Which an Authorization Is Required.
Go to document index.