45 CFR 164.514 — HIPAA Privacy Rule: Other requirements relating to uses and disclosures of protected health information (de-identification, minimum necessary, limited data set, fundraising, verification)

What this rule requires your agency to do

• 1A covered entity may treat health information as de-identified only if it meets either the expert-determination method (with documented methods and results) or the Safe Harbor method removing all 18 listed identifiers with no actual knowledge the information could identify an individual (§ 164.514(a)-(b)).(45 CFR 164.514 — HIPAA Privacy Rule: Other requirements relating to uses and disclosures of protected health information (de-identification, minimum necessary, limited data set, fundraising, verification))
• 2Prior to any permitted disclosure, a covered entity must verify the identity and authority of a requesting person not known to it, obtain any documentation/statements required as a condition of disclosure, and may reasonably rely on facially compliant documentation, including the specified means for public officials (§ 164.514(h)).(45 CFR 164.514 — HIPAA Privacy Rule: Other requirements relating to uses and disclosures of protected health information (de-identification, minimum necessary, limited data set, fundraising, verification))
• 3A covered entity that assigns a re-identification code must ensure the code is not derived from or related to the individual and must not use or disclose the code for any other purpose or disclose the re-identification mechanism (§ 164.514(c)).(45 CFR 164.514 — HIPAA Privacy Rule: Other requirements relating to uses and disclosures of protected health information (de-identification, minimum necessary, limited data set, fundraising, verification))
• 4A covered entity must identify the workforce persons/classes needing access to PHI and the categories of PHI needed, and make reasonable efforts to limit their access accordingly (minimum necessary uses) (§ 164.514(d)(2)).(45 CFR 164.514 — HIPAA Privacy Rule: Other requirements relating to uses and disclosures of protected health information (de-identification, minimum necessary, limited data set, fundraising, verification))
• 5A covered entity may use or disclose a limited data set only for research, public health, or health care operations, only after excluding the 16 listed direct identifiers, and only under a data use agreement meeting the specified contents; and must cure or discontinue on knowledge of a recipient's material breach (§ 164.514(e)).(45 CFR 164.514 — HIPAA Privacy Rule: Other requirements relating to uses and disclosures of protected health information (de-identification, minimum necessary, limited data set, fundraising, verification))
• 6A covered entity may use or disclose the specified PHI for its own fundraising without authorization only if its notice of privacy practices includes the required statement, each communication offers a clear opt-out that is not unduly burdensome, treatment/payment is not conditioned on the choice, and it does not contact individuals who have opted out (§ 164.514(f)).(45 CFR 164.514 — HIPAA Privacy Rule: Other requirements relating to uses and disclosures of protected health information (de-identification, minimum necessary, limited data set, fundraising, verification))
• 7A covered entity must limit routine/recurring disclosures via policies/protocols and, for other disclosures, develop criteria and review requests individually to disclose only the minimum necessary; it may reasonably rely on certain requesters' representations (§ 164.514(d)(3)).(45 CFR 164.514 — HIPAA Privacy Rule: Other requirements relating to uses and disclosures of protected health information (de-identification, minimum necessary, limited data set, fundraising, verification))
• 8A covered entity must limit its requests for PHI from other covered entities to the minimum necessary via policies for routine requests and criteria-based review for others, and may not use, disclose, or request an entire medical record except when specifically justified (§ 164.514(d)(4)-(5)).(45 CFR 164.514 — HIPAA Privacy Rule: Other requirements relating to uses and disclosures of protected health information (de-identification, minimum necessary, limited data set, fundraising, verification))