Oklahoma State University Center for Health Sciences
OSU-CHS Centernet

Privacy Policies & Procedures

Section 3 - Uses and Disclosures to Carry Out Treatment, Payment or Health Care Operations

 

Title: Permitted Uses and Disclosures Policy: PRV-03.01
Category: HIPAA Compliance Authority: 45 CFR §
HIPAA Section:
164.506
Standard: Uses and Disclosures to Carry out Treatment, Payment, or Health Care Operations Responsibility: Health Care Components
Effective Date: 04/14/2003
Download a printable PDF of this policy
Approved by: OSU Legal Counsel Revised: 7/1/2013
Purpose

To establish the permitted uses and disclosures of protected health information in regards to Treatment, payment or healthcare operations.

Policy
  1. Permitted Uses and Disclosures - Except with respect to uses or disclosures that require an authorization under §164.508(a)(2) through (4) or that are prohibited under § 164.502(a)(5)(i), OSU may use or disclose protected health information for treatment, payment, or health care operations as set forth in paragraph (c) of this section, provided that such use or disclosure is consistent with other applicable requirements of the Privacy Rule.  §164.506(a)
  1. Consent for Uses and Disclosures Permitted – OSU may obtain consent of the individual to use or disclose protected health information to carry out treatment, payment or health care operations.  §164.506(b)
    • Consent under paragraph 2 of this policy shall not be effective to permit a use or disclosure of protected health information when an authorization under §164.508 Uses and Disclosures for Which an Authorization is Required, is required or when another condition must be met for such use or disclosure to be permissible under the Privacy Rule.  §164.506(b)(2)

  1. Treatment, Payment, or health care operations – OSU may use or disclose protected health information for its own treatment, payment, or health care operations.  §164.506(c)(1)
    • OSU may disclose protected health information for treatment activities of a health care provider.  §164.506(c)(2)
    • OSU may disclose protected health information to another covered entity or a health care provider for the payment activities of the entity that receives the information.  §164.506(c)(3)
    • OSU may disclose protected health information to another covered entity for health care operations activities of the entity that receives the information, if each entity either has or had a relationship with the individual who is the subject of the protected health information being requested, the protected health information pertains to such relationship, and the disclosure is:  §164.506(c)(4)
      1. For a purpose listed in paragraph 1 or 2 of the definition of health care operations; or §164.506(c)(4)(i)
      2. For a purpose of health care fraud and abuse detection or compliance.  §164.506(c)(4)(ii)
    1. If OSU participates in an organized health care arrangement may disclose protected health information about an individual to other participants in the organized health care arrangement for any health care operations activities of the organized health care arrangement.  §164.506(c)(5)

 

Procedure

OSU will use protected health information for the purposes of Treatment, Payment or Health Care Operations of its individual patients.  OSU adopts the definitions of such as defined by the Code of Federal Regulations.

Possible reasons for using or disclosing PHI for Health Care Operations include, but are not limited to the following:

  • Activities to enhance the quality of care
  • Fraud and abuse detection
  • Compliance programs
  • Quality assessment and improvement activities
  • Population based activities relating to improving care or reducing costs
  • Case management
  • Conducting medical training programs
  • Accreditation, certification, licensing, or credentialing
  • IT Support
  • Reports for Executive Administration personnel

These uses and/or disclosures must adhere to the minimum necessary standards of HIPAA.

Any other uses of PHI are permitted only with a valid consent from the patient and will be addressed in other policies. 

If OSU obtains a consent and an authorization or written legal permission from the individual for a disclosure of PHI, only the most restrictive will be recognized. 

In the case of conflicting consents and authorizations, OSU will resolve the situation by:

  1. Obtaining a new consent from the individual; or
  2. Communicating orally or in writing with the individual in order to determine the individual’s preference in resolving the conflict.  OSU will then document the individual’s preference and may only disclose the PHI in accordance with that preference.

top of page top

 

OSU-CHS on Facebook OSU-CHS on Twitter OSU Medicine on You Tube