May a covered entity use or disclose protected health information for litigation? May a covered entity use or disclose protected health information for litigation?
May a covered entity use or disclose protected health information for litigation?
Answer:
A covered entity may use or disclose protected health information as permitted or required by the Privacy Rule, see 45 CFR 164.502(a)
(PDF); and, subject to certain conditions the Rule typically permits
uses and disclosures for litigation, whether for judicial or
administrative proceedings, under particular provisions for judicial and
administrative proceedings set forth at 45 CFR 164.512(e) (GPO), or as part of the covered entity’s health care operations, 45 CFR 164.506(a) (PDF).
Depending on the context, a covered entity’s use or disclosure of
protected health information in the course of litigation also may be
permitted under a number of other provisions of the Rule, including uses
or disclosures that are:
- required by law (as when the court has ordered certain disclosures),
- for a proceeding before a health oversight agency (as in a contested licensing revocation),
- for payment purposes (as in a collection action on an unpaid claim), or
- with the individual’s written authorization.
Where a covered entity is a party to a legal proceeding, such as
a plaintiff or defendant, the covered entity may use or disclose
protected health information for purposes of the litigation as part of
its health care operations. The definition of “health care operations”
at 45 CFR 164.501
(GPO) includes a covered entity’s activities of conducting or arranging
for legal services to the extent such activities are related to the
covered entity’s covered functions (i.e., those functions that make the
entity a health plan, health care provider, or health care
clearinghouse), including legal services related to an entity’s
treatment or payment functions. Thus, for example, a covered entity that
is a defendant in a malpractice action or a plaintiff in a suit to
obtain payment may use or disclose protected health information for such
litigation as part of its health care operations. The covered entity,
however, must make reasonable efforts to limit such uses and disclosures
to the minimum necessary to accomplish the intended purpose. See 45 CFR 164.502(b) , 164.514(d).
Where the covered entity is not a party to the proceeding, the
covered entity may disclose protected health information for the
litigation in response to a court order, subpoena, discovery request, or
other lawful process, provided the applicable requirements of 45 CFR 164.512(e) (GPO) for disclosures for judicial and administrative proceedings are met.
| What is a covered entity’s obligation under the Breach Notification Rule if it transmits an individual’s PHI to a third party designated by the individual in an access request, and the entity discovers the information was breached in transit? This guidance remains in effect only to the extent that it is consistent with the court’s order in Ciox Health, LLC v. Azar, No. 18-cv-0040 (D.D.C. January 23, 2020), which may be found at https://ecf.dcd.uscourts.gov/cgi-bin/show_public_doc?2018cv0040-51. More information about the order is available at https://www.hhs.gov/hipaa/court-order-right-of-access/index.html. Any provision within this guidance that has been vacated by the Ciox Health decision is rescinded. ...read more |
| DOVER (Oct. 21, 2022) – The Delaware Division of Developmental Disabilities Services is announcing today that it is mailing letters to service recipients and legal guardians who were impacted by a recent data breach incident and is providing information to the public regarding the incident. On August 23, 2022, staff within the Division of Developmental Disabilities Services (DDDS) discovered that in the process of creating new user accounts in the division’s client database, DDDS staff inadvertently provided access to individual records of 7074 individuals. As a result of these actions, 159 new users had potential access to service recipients’ ...read more |
| Issued by: Office for Civil Rights (OCR) What if a HIPAA covered entity (or business associate) uses a CSP to maintain ePHI without first executing a business associate agreement with that CSP? Answer: If a covered entity (or business associate) uses a CSP to maintain (e.g., to process or store) electronic protected health information (ePHI) without entering into a BAA with the CSP, the covered entity (or business associate) is in violation of the HIPAA Rules. 45 C.F.R §§164.308(b)(1) and §164.502(e). OCR has entered into a resolution agreement and corrective action plan with a covered entity that OCR determined ...read more |
| Direct Liability of Business Associates In 2009, Congress enacted the Health Information Technology for Economic and Clinical Health (HITECH) Act,1 making business associates of covered entities directly liable for compliance with certain requirements of the HIPAA Rules. Consistent with the HITECH Act, the HHS Office for Civil Rights (OCR) issued a final rule in 2013 to modify the HIPAA Privacy, Security, Breach Notification, and Enforcement Rules.2 Among other things, the final rule identifies provisions of the HIPAA Rules that apply directly to business associates and for which business associates are directly liable.3 As set forth in the HITECH ...read more |
|
August 2026
| Su | Mo | Tu | We | Th | Fr | Sa |
| | | | | | 1 |
| 2 | 3 | 4 | 5 | 6 | 7 | 8 |
| 9 | 10 | 11 | 12 | 13 | 14 | 15 |
| 16 | 17 | 18 | 19 | 20 | 21 | 22 |
| 23 | 24 | 25 | 26 | 27 | 28 | 29 |
| 30 | 31 |
Blog Home
Newest Blog Entries
1/21/25 Understanding Business Associate Agreements
11/12/22 Modernizing Medicine Agrees to Pay $45 Million to Resolve Allegations of Accepting and Paying Illegal Kickbacks and Causing False Claims
11/12/22 Indian National Charged in $8 Million COVID-19 Relief Fraud Scheme
11/12/22 Former Hospital Employee Pleads Guilty To Criminal HIPPA Charges
11/12/22 Covered entities and those persons rendered accountable by general principles of corporate criminal liability may be prosecuted directly under 42 U.S.C. § 1320d-6
11/12/22 The Delaware Division of Developmental Disabilities Services Data Breach
11/12/22 OCR Settles Three Cases with Dental Practices for Patient Right of Access under HIPAA
11/12/22 HHS Issues Guidance on HIPAA and Audio-Only Telehealth
11/12/22 Five Former Methodist Hospital Employees Charged with HIPAA Violations
11/12/22 May a covered entity use or disclose protected health information for litigation?
11/12/22 When does the Privacy Rule allow covered entities to disclose protected health information to law enforcement officials?
Blog Archives
January 2025 (1)
November 2022 (54)
Blog Labels
EHR Fraud (1)
Covered Entity (40)
BAA (4)
Data Breach (1)
PPP Fraud (1)
Telehealth (1)
HIPAA Enforcement (3)
HIPAA (2)
ePHI (2)
|
