45 CFR 164.502 — HIPAA Privacy Rule: Uses and Disclosures of PHI, General Rules

What this rule requires your agency to do

• 1Do not use or disclose PHI to conduct a criminal, civil, or administrative investigation into, impose liability on, or identify any person for the mere act of seeking, obtaining, providing, or facilitating lawful reproductive health care, subject to the applicability, presumption, and attestation rules (§ 164.502(a)(5)(iii)).(45 CFR 164.502 — HIPAA Privacy Rule: Uses and Disclosures of PHI, General Rules)
• 2Do not use or disclose genetic information for underwriting purposes (a health plan, excluding certain long-term care issuers), and do not sell PHI except pursuant to § 164.508(a)(4) (§ 164.502(a)(5)(i)-(ii)).(45 CFR 164.502 — HIPAA Privacy Rule: Uses and Disclosures of PHI, General Rules)
• 3Disclose PHI to a business associate only after obtaining satisfactory assurances, documented through a written contract or other written agreement meeting § 164.504(e), that the business associate will appropriately safeguard the information (§ 164.502(e)).(45 CFR 164.502 — HIPAA Privacy Rule: Uses and Disclosures of PHI, General Rules)
• 4Do not use or disclose PHI in violation of a restriction agreed to under § 164.522(a)(1) (§ 164.502(c)).(45 CFR 164.502 — HIPAA Privacy Rule: Uses and Disclosures of PHI, General Rules)
• 5Make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose when using, disclosing, or requesting PHI, except for the enumerated exceptions such as treatment disclosures, disclosures to the individual, and authorized disclosures (§ 164.502(b)).(45 CFR 164.502 — HIPAA Privacy Rule: Uses and Disclosures of PHI, General Rules)
• 6Do not use or disclose PHI except as permitted or required by subpart E or by subpart C of part 160; use or disclose PHI only through the permitted categories (to the individual; treatment, payment, health care operations; incidental; valid authorization; agreement under § 164.510; or as otherwise permitted) (§ 164.502(a)(1)).(45 CFR 164.502 — HIPAA Privacy Rule: Uses and Disclosures of PHI, General Rules)
• 7Disclose PHI when required — to the individual under § 164.524 or § 164.528, and to the Secretary for a compliance investigation; business associates must likewise disclose to the Secretary and to the covered entity/individual to satisfy § 164.524 electronic-copy obligations (§ 164.502(a)(2), (a)(4)).(45 CFR 164.502 — HIPAA Privacy Rule: Uses and Disclosures of PHI, General Rules)
• 8Treat a personal representative as the individual with respect to relevant PHI (subject to the abuse/neglect/endangerment and unemancipated-minor exceptions), and comply with the requirements of subpart E for a deceased individual's PHI for 50 years following death (§ 164.502(f), (g)).(45 CFR 164.502 — HIPAA Privacy Rule: Uses and Disclosures of PHI, General Rules)