a patient’s PHI to a law enforcement officer in certain situations, including
when the covered entity suspects that the death of the patient may have
resulted from criminal conduct. 56 The theory behind these permitted
information uses and disclosures is that treating patients, allowing health care
providers to obtain reimbursement for providing health care, training medical
students and residents, complying with state law, and alerting law
enforcement officers to the suspicion of criminal activity outweigh an
individual’s interest in maintaining complete confidentiality of his or her
The first rule requires no prior authorization from the individual who is
the subject of the information before the information use or disclosure may
occur. Under the second rule, a covered entity may use and disclose an
individual’s PHI for certain activities, but only if the individual is informed
in advance of the use or disclosure and has the opportunity to agree to or
prohibit or restrict the use or disclosure. 57 Because the Privacy Rule allows
the covered entity to orally inform the individual of (and capture an oral
agreement or oral objection to) a use or disclosure permitted by these
provisions, this second rule is sometimes referred to as the “oral permission
rule,” although a more practical written permission also will suffice.
Under the second rule, a covered entity may conduct five sets of
information uses and disclosures once the individual who is the subject of the
information has been notified and has either agreed or not objected to the
information use or disclosure. 58 These five sets of information uses and
disclosures include ( 1) certain uses and disclosures of directory information,
such as name, location, general condition, and religious affiliation; 59 ( 2)
certain uses and disclosures that would allow other persons to be involved in
a patient’s care or payment for care; 60 ( 3) certain uses and disclosures that
would help notify, or assist in the notification of, family members, personal
representatives, and other persons responsible for the care of the individual
of the individual’s location, general condition, or death; 61 ( 4) certain uses and
disclosures for disaster relief purposes; 62 and ( 5) certain disclosures to family
members and other persons who were involved in the individual’s care or
payment for health care prior to the individual’s death of PHI that is relevant
to that person’s involvement. 63
is limited to the relevant requirements of such law.”).
56. See id. § 164.512(f)( 4).
57. See id. § 164.510.
58. See id.
59. See id. § 164.510(a).
60. See id. § 164.510(b)( 1)( i).
61. See id. § 164.510(b)( 1)( ii).
62. See id. § 164.510(b)( 4).
63. See id. § 164.510(b)( 5).