45 CFR 164.512 — HIPAA Privacy Rule: Uses and disclosures for which an authorization or opportunity to agree or object is not required

What this rule requires your agency to do

• 1For specialized government functions (military, national security, protective services, State Department suitability, correctional custody, public-benefit programs, NICS reporting) and for workers' compensation, a covered entity may use or disclose PHI only as and to the extent the applicable conditions permit (§ 164.512(k)-(l)).(45 CFR 164.512 — HIPAA Privacy Rule: Uses and disclosures for which an authorization or opportunity to agree or object is not required)
• 2For research, a covered entity may use or disclose PHI without authorization only upon obtaining IRB/privacy-board waiver documentation meeting the specified criteria, or the required researcher representations for reviews preparatory to research or research on decedents' information (§ 164.512(i)).(45 CFR 164.512 — HIPAA Privacy Rule: Uses and disclosures for which an authorization or opportunity to agree or object is not required)
• 3For law enforcement purposes, a covered entity may disclose PHI only to a law enforcement official and only where the conditions in paragraphs (f)(1)-(f)(6) are met, including the limits on identification/location information and on disclosures about crime victims (§ 164.512(f)).(45 CFR 164.512 — HIPAA Privacy Rule: Uses and disclosures for which an authorization or opportunity to agree or object is not required)
• 4For judicial and administrative proceedings, a covered entity may disclose PHI only in response to a court/tribunal order (limited to the PHI authorized) or, absent an order, only upon receiving the required satisfactory assurances of notice or of a qualified protective order (§ 164.512(e)).(45 CFR 164.512 — HIPAA Privacy Rule: Uses and disclosures for which an authorization or opportunity to agree or object is not required)
• 5A covered entity may disclose PHI as required by law or for public health activities only to the extent it complies with, and limits the disclosure to, the relevant conditions in each standard, including the specified employer- and school-related conditions (§ 164.512(a)-(b)).(45 CFR 164.512 — HIPAA Privacy Rule: Uses and disclosures for which an authorization or opportunity to agree or object is not required)
• 6A covered entity may use or disclose PHI without authorization or opportunity to agree/object only in the situations covered by this section and only subject to the applicable conditions of the section and § 164.509, and must not make disclosures prohibited by § 164.502(a)(5)(iii) (§ 164.512 introductory text).(45 CFR 164.512 — HIPAA Privacy Rule: Uses and disclosures for which an authorization or opportunity to agree or object is not required)
• 7To avert a serious threat, a covered entity may use or disclose PHI only in good faith as necessary to prevent or lessen a serious and imminent threat to a person able to lessen it, or to help identify/apprehend an individual, subject to the stated limits and exclusions (§ 164.512(j)).(45 CFR 164.512 — HIPAA Privacy Rule: Uses and disclosures for which an authorization or opportunity to agree or object is not required)
• 8When disclosing PHI about a victim of abuse, neglect, or domestic violence, a covered entity must satisfy the required-by-law/agreement/expressly-authorized conditions and must promptly inform the individual unless an enumerated exception applies (§ 164.512(c)).(45 CFR 164.512 — HIPAA Privacy Rule: Uses and disclosures for which an authorization or opportunity to agree or object is not required)