HIPAA Privacy Rule

Permitted and required uses and disclosures of PHI (164.502, 164.506, 164.508, 164.510, 164.512, 164.514) – HIPAA Privacy Rule

HIPAA Privacy Rule 164.502b: Minimum necessary standard

When using, disclosing, or requesting PHI, a covered entity must make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose, per 164.502(b) and 164.514(d), with defined exceptions (disclosures to the individual, treatment disclosures, authorized disclosures, disclosures required by law, and disclosures required for Privacy Rule compliance review).

Maintained by Gerard Blokdyk

Other controls in Permitted and required uses and disclosures of PHI (164.502, 164.506, 164.508, 164.510, 164.512, 164.514) – HIPAA Privacy Rule

164.502a General rule: PHI may be used or disclosed only as the Privacy Rule permits or requires, or with written authorization
164.502g Personal representatives
164.506 Uses and disclosures for treatment, payment and health care operations (TPO)
164.508 Authorization required for uses and disclosures not otherwise permitted
164.510 Uses and disclosures requiring an opportunity to agree or object
164.512 Uses and disclosures for which authorization or opportunity to agree or object is not required
164.514d De-identification of protected health information
164.514h Verification of identity and authority before certain disclosures

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All HIPAA Privacy Rule controls