HIPAA Privacy Rule 164.514h: Verification of identity and authority before certain disclosures

Before disclosing PHI, a covered entity must verify the identity of a person requesting PHI and the authority of any person to have access to PHI if the identity or authority is not already known, including specific verification for public officials (presentation of an agency badge or credentials in person, appropriate government letterhead if written, or other written documentation establishing the person acts under government authority), per 164.514(h).

Other controls in Permitted and required uses and disclosures of PHI (164.502, 164.506, 164.508, 164.510, 164.512, 164.514) – HIPAA Privacy Rule

164.502a General rule: PHI may be used or disclosed only as the Privacy Rule permits or requires, or with written authorization
164.502b Minimum necessary standard
164.502g Personal representatives
164.506 Uses and disclosures for treatment, payment and health care operations (TPO)
164.508 Authorization required for uses and disclosures not otherwise permitted
164.510 Uses and disclosures requiring an opportunity to agree or object
164.512 Uses and disclosures for which authorization or opportunity to agree or object is not required
164.514d De-identification of protected health information

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All HIPAA Privacy Rule controls