Home : Academic/Research : Health Sciences

PERMITTED USES AND DISCLOSURES
Under HIPAA, PHI generally may be used or disclosed within or outside a health care entity without obtaining individual written authorization if the use or disclosure is for treatment, payment or health care operations, e.g. billing, auditors, QA. However, Minnesota law has more restrictive rules that apply when individual health information is disclosed for these purposes outside the University. Combining HIPAA and Minnesota law, the following rules apply.

1. USES AND DISCLOSURES TO OTHER UNIVERSITY COMPONENTS, BUSINESS ASSOCIATES OR A RELATED HEALTH CARE ENTITY
   Individual health information may be used or disclosed without written authorization or consent within the University or to the business associates of the University for the health care components' treatment, payment or health care operations (see the health care operations definition for a list of activities that constitute health care operations). Individual health information also may be disclosed to other providers within related health care entities or within other provider components of the University when necessary for the current treatment of the individual.

2. USES AND DISCLOSURES TO UNRELATED ENTITES OUTSIDE THE UNIVERSITY
   In some situations individual health information may be released outside the University if consent required by Minnesota law is first obtained. In these situations, the health care component may, but is not required to obtain a HIPAA authorization prior to use or disclosure. The consent required by Minnesota is required at minimum for:
   1. disclosure to another health care provider (who is not a related health care entity or within other provider components of the University) for the individual's treatment;
   2. disclosure to another covered entity or health care provider (who is not a related health care entity or within other provider components of the University) for payment activities of the receiving entity;
   3. to another covered entity (who is not a related health care entity or within other provider components of the University) for health care operations activities of the receiving entity for certain health care operations of the receiving entity where both the University health care component and the receiving entity has or had a relationship with the individual and the information pertains to that relationship. If these conditions are met, the health care operations purposes for which the individual health information may be used or disclosed after obtaining the consent required by Minnesota law are:
      • Conducting quality assessment and improvement activities, including outcomes evaluation and development of clinical guidelines where generalizable knowledge is not the primary purpose, population based activities related to improving health or reducing health care costs, protocol development, case management and care coordination, contacting health care providers and patients with information about treatment alternatives, and related functions that do not include treatment;
      • Reviewing the competence or qualifications of health care professionals;
      • Evaluating practitioner and provider performance & health plan performance;
      • Conducting training programs in which students, trainees or practitioners in areas of health care learn under supervision to practice or improve their skills as health care providers;
      • Training of non-health care professionals;
      • Accreditation, certification, licensing, or credentialing activities; or
      • Health care fraud and abuse detection and compliance programs.

HIPAA authorization is required if the disclosure is for the treatment, payment or health care operations activities of an entity outside the University (i.e. any entity that is not a University health care component) when the activity is not described in one of the categories described above.

If an entity outside the University performs a health care operations activity for or on behalf of the University, this entity may be a business associate of the University and the requirements of Administrative Procedure: Disclosing PHI to Business Associates will apply.

USING AND DISCLOSING LIMITED DATA SETS FOR HEALTH CARE OPERATIONS
Information, for the purpose of health care operations also may be used or disclosed as part of a limited data set when a data use agreement is in place between the health care component of the University and the recipient of the limited data set. See Administrative Procedure: Creating and Disclosing a Limited Data Set.

USE OR DISCLOSE OF PSYCHOTHERAPY NOTES FOR TREATMENT, PAYMENT OR HEALTH CARE OPERATIONS WITHOUT HIPAA AUTHORIZATION
Psychotherapy notes are afforded special protection and separate HIPAA authorization is almost always required before they may be used or disclosed. Psychotherapy notes may be used or disclosed without separate written authorization for the following treatment, payment and health care operations purposes:

1. use for the purpose of treatment by the provider who created the notes;
2. use or disclosure by the health care component for its own training programs in which students, trainees or practitioners in mental health learn under supervision to practice or improve their skills in counseling;
3. use or disclosure by the University to defend itself in a legal action or other proceeding brought by the individual;

All other uses and disclosures of psychotherapy notes for treatment, payment and health care operations require authorization. Certain other uses and disclosures of psychotherapy notes may be made without authorization, including those to the Secretary for compliance and select disclosures for a public purpose (see Administrative Procedure: Disclosing Individual Health Information for Public Purposes). See Administrative Procedure: Obtaining Individual Authorization for Use and Disclosure of PHI for a complete list of psychotherapy note uses and disclosures that may be made without authorization.