HIPAA: OCR Releases New FAQs Clarifying Disclosures Amongst Covered Entities

On June 26, 2019, the Department of Health and Human Services Office for Civil Rights (OCR) issued two new FAQs that clarify:

The parameters around covered entities sharing protected health information (PHI) for a recipient covered entity’s health care operations; and That once a covered entity receives PHI under HIPAA, the recipient covered entity may use and disclose it without individual authorization in any way permitted by HIPAA (even if different than the reason the covered entity initially received the PHI). These FAQs, although focused on health plans, clarify for all covered entities the types of disclosures of PHI that are permitted for a recipient covered entity’s health care operations and that a covered entity is not restricted by HIPAA to only using and disclosing PHI for the purpose it was initially received.