HIPAA Training Course

Page 8 of 10

OK TO SHARE

When PHI Can Be Shared:
A provider is permitted to use and disclose PHI without an individual's authorization for the following purposes or situations:
• The patient has a right to obtain his or her own medical information and PHI. This enables the patient to check their own records for errors or to personally deliver their records to a provider.
• A provider can use PHI for treatment, payment, and health care operations.
• Informal permission may be obtained by asking the individual outright, or by circumstances that clearly give the individual the opportunity to agree, acquiesce, or object. For example, a man is receiving care in the emergency room. His wife arrived separately and is in the waiting room asking about the man's condition. You could informally tell the man that his wife is outside and is asking about his condition. If the man objects, then you may not release any information.
• Where the individual is incapacitated, in an emergency situation, or not available, a provider generally may make such uses and disclosures if in their professional judgment the use or disclosure is determined to be in the best interests of the individual.