Proposed Revisions, Federal Register, 3/27/2002

Existing Language,
Final Rule, 12/28/2000

§ 164.506 Uses and disclosures to carry out treatment, payment, or health care operations.

§ 164.506 Consent for uses or disclosures to carry out treatment, payment, or health care operations.

(a) Standard: Permitted uses and disclosures.

Except with respect to uses or disclosures that require an authorization under §164.508(a)(2) and (3), a covered entity may use or disclose protected health information for treatment, payment, or health care operations as set forth in paragraph (c) of this section, provided that such use or disclosure is consistent with other applicable requirements of this subpart.

[§ 164.506, Consent for uses or disclosures to carry out treatment, payment, or health care operations, deleted in its entirety]

(b) Standard: Consent permitted.

(1) A covered entity may obtain consent of the individual to use or disclose protected health information to carry out treatment, payment, or health care operations.

(2) Consent of an individual under this paragraph shall not be effective to permit a use or disclosure of protected health information that is not otherwise permitted or required by this subpart. 

[new (c) relating to disclosures of TPO to another entity. See AIS Side-by-Side, “Disclosures for TPO of Another Entity.”]

Proposed Revisions, Federal Register, 3/27/2002

Existing Language,
Final Rule, 12/28/2000

§ 164.502 Uses and disclosures of protected health information: general rules.

§ 164.502 Uses and disclosures of protected health information: general rules.

(a) Standard.

 [No changes to (a)(1)(I)]

(a) Standard. A covered entity may not use or disclose protected health information, except as permitted or required by this subpart or by subpart C of part 160 of this subchapter.

(1) Permitted uses and disclosures. A covered entity is permitted to use or disclose protected health information as follows:

(i) To the individual;

(ii) For treatment, payment, or health care operations, as permitted by and in compliance with §164.506;

(iii) As incident to a use or disclosure otherwise permitted or required by this subpart, provided that the covered entity has complied with the applicable requirements of §164.502(b), §164.514(d), and §164.530(c) with respect to such otherwise permitted or required uses or disclosures;

[clauses (ii) and (iii), below, are deleted and replaced]

(ii) Pursuant to and in compliance with a consent that complies with § 164.506, to carry out treatment, payment, or health care operations;

(iii) Without consent, if consent is not required under § 164.506(a) and has not been sought under § 164.506(a)(4), to carry out treatment, payment, or health care operations, except with respect to psychotherapy notes;

[No changes to (iv) and (v).}

(iv) Pursuant to and in compliance with an authorization that complies with § 164.508;

(v) Pursuant to an agreement under, or as otherwise permitted by, § 164.510; and

[conforming change to (vi)]

(vi) As permitted by and in compliance with this section, § 164.512, or § 164.514(f), and (g).

(vi) As permitted by and in compliance with this section, § 164.512, or § 164.514(e), (f), and (g).

(2) Required disclosures.

[No changes to (2) Required disclosures.]

(2) Required disclosures. A covered entity is required to disclose protected health information:

(i) To an individual, when requested under, and as required by §§ 164.524 or 164.528; and

(ii) When required by the Secretary under subpart C of part 160 of this subchapter to investigate or determine the covered entity's compliance with this subpart.

[For modifications to (b) and (g), see AIS Side-by-Side, “Minimum Necessary,” and “Parents and Minors.”]

[No other changes proposed to section.]

§ 164.532 Transition provisions.

§ 164.532 Transition provisions.

(a) Standard: Effect of prior authorizations.

Notwithstanding §§164.508 and 164.512(i), a covered entity may use or disclose protected health information, consistent with paragraphs (b) and (c) of this section, pursuant to an authorization or other express legal permission obtained from an individual permitting the use or disclosure of protected health information, informed consent of the individual to participate in research, or a waiver of informed consent by an IRB.

(b) Implementation specification: Effect of prior authorization for purposes other than research.

Notwithstanding §164.508, a covered entity may use or disclose protected health information that it created or received prior to the applicable compliance date of this subpart pursuant to an authorization or other express legal permission obtained from an individual prior to the applicable compliance date of this subpart, provided that the authorization or other express legal permission specifically permits such use or disclosure and there is no agreed-to restriction in accordance with §164.522(a).

[For changes to provisions relating to (c) research and (d) business associates, and (e) deemed compliance, see AIS Side-by-Side,  “Research” and “Business Associates” respectively.]

[§164.532, Transition provisions, deleted in its entirety replaced with revised language.]