HIPAA_PHI_DISCLOSURE_001

rules/regulations/us/hipaa_phi_disclosure.yaml

Citation

45 CFR §164.502(a) Standard. A covered entity or business associate may not use or disclose protected health information, except as permitted or required by this subpart or by subpart C of part 160 of this subchapter.

Condition

Protected health information (PHI) may be used or disclosed only as the HIPAA Privacy Rule permits or requires, for example for treatment, payment or health care operations (45 CFR 164.506), for the purposes in 45 CFR 164.512, or with a valid authorization (45 CFR 164.508).

Layer 1 detects

disclose, share, transmit or send (alone or with the endings s, d, ed, ing, ted or ting, and also at the end of a longer word), followed anywhere later on the same line by health, medical or patient, then information, data or records. It matches wording, not meaning: it fires on disclosures the rule's own description permits, such as treatment ("Send the patient records to the treating orthopedist for tomorrow's surgery."), and on training about disclosure; it misses a disclosure told in other words ("Email Mr. Gomez's HIV test result to his employer's HR manager, they asked for it."); and it does not read the treatment, payment, operations, 164.512 or authorization exceptions. Whether a disclosure is permitted is judged in Layer 2.

Condition type

regex; metadata condition in the file, not run by the engine

Status in the file

approved