Permitted Uses and Disclosures: Exchange for Health Care Operations
45 Code of Federal Regulations (CFR) 164.506(c)(4)
Although the HIPAA regulations have been in effect for quite some time, health care providers frequently still question whether the sharing of health information, even for routine purposes like treatment or care coordination, is permissible under HIPAA.
Health Insurance Portability and Accountability Act (HIPAA) governs how Covered Entities (CEs) protect and secure Protected Health Information (PHI). HIPAA also provides regulations that illustrates the circumstances in which CEs are permitted, but not required, to use and disclose PHI for specific actions without first obtaining an individual’s authorization: including for treatment and for health care operations of the disclosing CE or the recipient CE when the appropriate relationship exists.
Note: Other laws may apply.