PRIVACY & CONFIDENTIALITY
42 CFR Part 2
Programs may not use or disclose any information about any patient unless the patient has consented in writing (on a form that meets the requirements established by the regulations) or unless another very limited exception specified in the regulations applies. Any disclosure must be limited to the information necessary to carry out the purpose of the disclosure.
The Privacy Rule
The Privacy Rule permits uses and disclosures for “treatment, payment and health care operations” as well as certain other disclosures without the individual’s prior written authorization. Disclosures not otherwise specifically permitted or required by the Privacy Rule must have an authorization that meets certain requirements. With certain exceptions, the Privacy Rule generally requires that uses and disclosures of PHI be the minimum necessary for the intended purpose of the use or disclosure.