Common use of Protected Data Use and Disclosure Permitted by HIPAA Clause in Contracts

Protected Data Use and Disclosure Permitted by HIPAA. To the extent a disclosure or use of Protected Data is a disclosure or use of “Protected Health Information” (PHI) of an individual, as that term is defined in Section 160.103 of Title 45, Code of Federal Regulations, the following Privacy Rule provisions apply to permit such Protected Data disclosure and/or use by CDPH and Data Recipient, without the consent or authorization of the individual who is the subject of the PHI: a) The HIPAA Privacy Rule creates a special rule for a subset of public health disclosures whereby HIPAA cannot preempt state law if, “[t]he provision of state law, including state procedures established under such law, as applicable, provides for the reporting of disease or injury, child abuse, birth, or death, or for the conduct of public health surveillance, investigation, or intervention.” (45 C.F.R. § 60.203(c) [XXXXXX Xxx, § 00000, sub. (a)].) [NOTE: See State laws and regulations listed in §§ IV.A and IV.B, above.]; b) A covered entity may disclose PHI to a “public health authority” carrying out public health activities authorized by law; (45 C.F.R. § 164.512(b).); and c) Other, non-public health-specific provisions of HIPAA may also provide the legal basis for all or specific Protected Data uses and disclosures.

Protected Data Use and Disclosure Permitted by HIPAA. To the extent a disclosure or use of Protected Data is a disclosure or use of “Protected Health Information” (PHI) of an individual, as that term is defined in Section 160.103 of Title 45, Code of Federal Regulations, the following Privacy Rule provisions apply to permit such Protected Data disclosure and/or use by CDPH and Data Recipient, without the consent or authorization of the individual who is the subject of the PHI: a) a. The HIPAA Privacy Rule creates a special rule for a subset of public health disclosures whereby HIPAA cannot preempt state law if, “[t]he provision of state law, including state procedures established under such law, as applicable, provides for the reporting of disease or injury, child abuse, birth, or death, or for the conduct of public health surveillance, investigation, or intervention.” (45 C.F.R. § 60.203(c) [XXXXXX XxxTitle 45, § 00000Code of Federal Regulations, sub. (aSection 160.203(c)].) [NOTE: See State laws and regulations listed in §§ Sections IV.A and IV.B, above.]; b) b. A covered entity may disclose PHI to a “public health authority” carrying out public health activities authorized by law; (45 C.F.R. § Title 45, Code of Federal Regulations, Section 164.512(b).); and c) c. Other, non-public health-specific provisions of HIPAA may also provide the legal basis for all or specific Protected Data uses and disclosures.