HIPAA Privacy Rule 164.506: Uses and disclosures for treatment, payment and health care operations (TPO)

A covered entity may use or disclose PHI for its own treatment, payment, and health care operations without authorization, and may disclose for another covered entity's treatment activities and, within limits, for the other entity's payment and certain health care operations activities, per 164.506.