The Privacy Rule generally requires healthcare providers to take reasonable steps to limit the use and disclosure of, and the request for PHI to the minimum necessary to accomplish the intended purpose. These provisions do not apply to uses of disclosures made pursuant to an authorization request by the individual. Healthcare entities must keep records of PHI disclosures. Information provided below, if completed properly, will constitute an adequate record.
Note: Uses and disclosures for reasons other than treatment, payment, or operations may be permitted without prior consent in case of an emergency.