General principle for uses and disclosures

OCR Privacy Brief: Summary of the HIPAA Privacy Rule

Basic Principle. A major purpose of the Privacy Rule is to define and limit the circumstances in which an individual's protected heath information may be used or disclosed by covered entities. A covered entity may not use or disclose protected health information, except either: (1) as the Privacy Rule permits or requires; or (2) as the individual who is the subject of the information (or the individual's personal representative) authorizes in writing.¹⁶

Required Disclosures. A covered entity must disclose protected health information in only two situations: (a) to individuals (or their personal representatives) specifically when they request access to, or an accounting of disclosures of, their protected health information; and (b) to HHS when it is undertaking a compliance investigation or review or enforcement action.¹⁷ See OCR "Government Access" Guidance.

¹⁶45 C.F.R. §164.502(a).

¹⁷ 45 C.F.R. §164.502(a)(2).