From the Guidelines
The correct option for the HIPAA Privacy Rule exception question is A: "When an entity requests disclosure in writing, but without a court order." The HIPAA Privacy Rule allows certain disclosures of Protected Health Information (PHI) without patient authorization for public policy purposes, but these exceptions are specific and limited.
- Organ donation (option B) is a legitimate exception under HIPAA, as it is considered a public health activity 1.
- Research purposes with proper safeguards (option C) are also permitted, as long as the research is conducted in accordance with the HIPAA regulations 1.
- Disclosures required by law, national security, or intelligence activities (option D) are allowed under the HIPAA Privacy Rule, as they are considered necessary for public health and safety 1. However, a mere written request from an entity without a court order or other legal requirement is not sufficient to permit disclosure without authorization. For a disclosure to be permitted, it must fall under specific regulatory provisions, such as a court order, subpoena, or other legal process, as outlined in the Code of Federal Regulations (CFR): 45 CFR § 160.103 and 45 CFR § 164.512(b) 1. Simply receiving a written request does not create an obligation or permission to disclose PHI under the Privacy Rule, making option A the exception that does not apply.
From the Research
Public Policy Purposes and HIPAA Privacy Rule Exceptions
The HIPAA Privacy Rule has several exceptions that permit the disclosure of Protected Health Information (PHI) without participant authorization. These exceptions include:
- When required by law, for national security, or intelligence activities
- For organ donation
- For research purposes
Exceptions Analysis
Analyzing the given options:
- A. When an entity requests disclosure in writing, but without a court order: This is not a valid exception to the HIPAA Privacy Rule, as a court order or other legal process is typically required for disclosure without authorization.
- B. For organ donation: This is a valid exception, as the HIPAA Privacy Rule permits disclosure of PHI for organ donation purposes 2, 3, 4, 5, 6 are not relevant to this topic.
- C. For research purposes: This is also a valid exception, as the HIPAA Privacy Rule permits disclosure of PHI for research purposes, subject to certain conditions and limitations.
- D. When required by law, for national security, or intelligence activities: This is another valid exception, as the HIPAA Privacy Rule permits disclosure of PHI when required by law or for national security or intelligence activities.
Given the options, the correct answer is: