2.1 Permitted Uses & Disclosures: TPO and Public Priority Exceptions

Permitted Uses & Disclosures: TPO and Public Priority Exceptions

The statutory architecture of the HIPAA Privacy Rule (45 CFR Part 160 and Part 164, Subparts A and E) is built upon a fundamental default principle: a covered entity (CE) may not use or disclose Protected Health Information (PHI) except as either permitted or required by the Rule, or as expressly authorized in writing by the individual who is the subject of the information (45 CFR § 164.502(a)).

For healthcare privacy compliance officers, mastering the statutory exceptions to this baseline rule is paramount. The Privacy Rule creates three distinct operational categories of permitted disclosures:

1. Routine Operational Disclosures (TPO): Uses and disclosures for Treatment, Payment, and Health Care Operations under 45 CFR § 164.506.
2. Disclosures Requiring an Opportunity to Agree or Object: Informal permission scenarios governed by 45 CFR § 164.510 (facility directories and involvement of family/caregivers).
3. National Priority Public Interest Exceptions: Disclosures permitted or required without patient authorization or opportunity to object under 45 CFR § 164.512.

+---------------------------------------------------------------------------------------------------+
|                         HIPAA PRIVACY RULE: PERMITTED DISCLOSURE ARCHITECTURE                     |
|                                                                                                   |
|   [DEFAULT RULE: 45 CFR § 164.502(a)]                                                             |
|   NO USE OR DISCLOSURE OF PHI WITHOUT A VALID WRITTEN PATIENT AUTHORIZATION                       |
|                                     |                                                             |
|                                     +-----------------------+                                     |
|                                     |                       |                                     |
|                                     v                       v                                     |
|   [ROUTINE OPERATIONS]    [OPPORTUNITY TO AGREE/OBJECT]  [NATIONAL PRIORITY EXCEPTIONS]           |
|   45 CFR § 164.506        45 CFR § 164.510               45 CFR § 164.512 (12 Exceptions)         |
|   - Treatment             - Facility Directories         - Required by Law (§ 164.512(a))         |
|   - Payment               - Family / Caregiver Care      - Public Health Activities (§ 164.512(b))|
|   - Health Care Ops       - Disaster Relief Orgs         - Victims of Abuse / Neglect (§ 164.512(c))|
|                                                          - Health Oversight Audits (§ 164.512(d)) |
|   * Minimum Necessary     * Oral agreement or            - Judicial / Subpoenas (§ 164.512(e))    |
|     applies to Payment/     implied consent permitted;   - Law Enforcement Requests (§ 164.512(f))|
|     Ops; EXEMPT for         patient may opt out at       - Decedents / Coroners (§ 164.512(g))    |
|     Treatment               any time                     - Organ Procurement (§ 164.512(h))       |
|                                                          - Research Waivers (§ 164.512(i))        |
|                                                          - Serious Threat / Tarasoff (§ 164.512(j))|
|                                                          - Specialized Gov Functions (§ 164.512(k))|
|                                                          - Workers' Compensation (§ 164.512(l))   |
+---------------------------------------------------------------------------------------------------+

---

1. Treatment, Payment, and Health Care Operations (TPO) Under 45 CFR § 164.506

Under 45 CFR § 164.506(c), a covered entity may use or disclose PHI for its own treatment, payment, or healthcare operations without obtaining patient authorization or consent. When HIPAA was initially promulgated in 2000, it briefly required mandatory written consent for TPO; however, the 2002 Privacy Rule modifications eliminated the mandatory consent requirement because it created severe operational bottlenecks in routine clinical care and pharmacy fulfillment.

Detailed Definitions of TPO Components (45 CFR § 164.501)

A. Treatment

Treatment encompasses the provision, coordination, or management of healthcare and related services by one or more healthcare providers. It includes:

• Direct coordination or management of healthcare with a third party (e.g., coordinating home health nursing following hospital discharge);
• Consultations between healthcare providers regarding a specific patient (e.g., a primary care physician consulting an oncologist);
• Referrals of a patient from one provider to another (e.g., transmitting medical charts and diagnostic imaging to a specialist).

Statutory Boundary: A covered entity may disclose PHI for the treatment activities of any healthcare provider, regardless of whether the receiving provider is a covered entity under HIPAA.

B. Payment

Payment encompasses the operational activities undertaken by a covered healthcare provider or health plan to obtain or provide reimbursement for healthcare services. Key activities include:

• Determining eligibility or coverage (including coordination of benefits and cost-sharing determinations);
• Billing, claims management, collection activities, and related healthcare data processing;
• Adjudicating claims and issuing explanation of benefits (EOBs);
• Medical necessity reviews, pre-admission screening, and pre-authorization of services;
• Utilization review activities, including concurrent and retrospective review of services.

Data Sharing Rule: A covered entity may disclose PHI to another covered entity or healthcare provider for the payment activities of the entity receiving the information (e.g., a hospital sending encounter notes to an ambulance company so the ambulance service can bill the insurer).

C. Health Care Operations

Health Care Operations are limited to specific statutory business functions essential for running a healthcare organization and maintaining clinical quality. 45 CFR § 164.501 restricts operations to six distinct categories:

1. Quality Improvement & Care Management: Quality assessment and improvement activities, outcome evaluation, population-based disease management, clinical guideline development, and case management / care coordination.
2. Competency Review & Training: Reviewing the competence or qualifications of healthcare professionals, evaluating practitioner performance, conducting training programs for medical/nursing students, and healthcare facility accreditation/credentialing.
3. Underwriting & Premium Rating: Underwriting, enrollment, premium rating, and creating/renewing health insurance contracts (subject to the statutory prohibition enacted under GINA against using genetic information for underwriting).
4. Auditing, Legal & Compliance Services: Conducting or arranging for medical review, legal services, and auditing functions, including fraud and abuse compliance programs.
5. Business Planning & Administration: Business planning, strategic development, merger and acquisition due diligence (where PHI is reviewed prior to entity transfer), and general administrative activities including customer service, grievance resolution, and internal HIPAA audits.

+---------------------------------------------------------------------------------------------------+
|                         DATA SHARING RULES FOR HEALTH CARE OPERATIONS                             |
|                                    (45 CFR § 164.506(c)(4))                                       |
|                                                                                                   |
|   A covered entity (CE-A) may disclose PHI to another covered entity (CE-B) for CE-B's operations |
|   ONLY IF ALL THREE of the following legal conditions are satisfied:                             |
|                                                                                                   |
|   1. RELATIONSHIP REQUIREMENT:                                                                    |
|      Both CE-A and CE-B must have (or have had) an existing relationship with the individual.     |
|                                                                                                   |
|   2. PERTAINING TO RELATIONSHIP:                                                                  |
|      The PHI disclosed must directly pertain to that existing patient relationship.               |
|                                                                                                   |
|   3. RESTRICTED OPERATIONAL PURPOSE (Only 4 permitted operational categories):                    |
|      a. Quality assessment, outcome evaluation, or population-based health management;           |
|      b. Population-based activities relating to improving health or reducing healthcare costs;   |
|      c. Reviewing competence, evaluating practitioner performance, or clinical training; OR       |
|      d. Health care fraud and abuse detection and compliance.                                     |
|                                                                                                   |
|   * PROHIBITED: General marketing, business planning, or fundraising for the receiving entity!   |
+---------------------------------------------------------------------------------------------------+

---

2. The Minimum Necessary Standard & Incidental Disclosures

The Minimum Necessary Rule (45 CFR § 164.502(b) & § 164.514(d))

When using or disclosing PHI, or requesting PHI from another covered entity, a covered entity must make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request.

Compliance Officer Trap: A common examination trap involves a physician requesting an entire 10-year medical history from another hospital to manage an acute inpatient crisis. A compliance officer who attempts to redact the record under the "minimum necessary standard" violates HIPAA operational guidance. Treatment disclosures between clinicians are 100% exempt from the minimum necessary standard to ensure clinical safety.

Incidental Uses and Disclosures (45 CFR § 164.502(a)(1)(iii))

An incidental use or disclosure is a secondary use or disclosure that cannot reasonably be prevented, is limited in nature, and occurs as a byproduct of an otherwise permitted use or disclosure. Incidental disclosures are lawful only if the covered entity has applied:

1. Reasonable Administrative, Technical, and Physical Safeguards (45 CFR § 164.530(c)); and
2. The Minimum Necessary Standard (where applicable).

+---------------------------------------------------------------------------------------------------+
|                         INCIDENTAL DISCLOSURE COMPLIANCE MATRIX                                   |
|                                                                                                   |
|   PERMISSIBLE INCIDENTAL DISCLOSURE (Lawful)          IMPERMISSIBLE PRIVACY BREACH (Violation)   |
|   +---------------------------------------------+     +-----------------------------------------+ |
|   | - Calling patient's name in waiting room    |     | - Calling patient name + clinical       | |
|   | - Sign-in sheet requesting name and arrival |     |   diagnosis / condition in waiting room | |
|   |   time only                                 |     | - Sign-in sheet listing medical reason  | |
|   | - Bedside clinical discussion in semi-      |     |   for visit (e.g. "Oncology/HIV")       | |
|   |   private room using lowered voices         |     | - Unattended EHR screen displaying chart| |
|   | - Whiteboard at nurse station listing room  |     |   facing a public hallway               | |
|   |   number and attending physician name       |     | - Whiteboard displaying full clinical   | |
|   |                                             |     |   details and sensitive lab results     | |
|   +---------------------------------------------+     +-----------------------------------------+ |
+---------------------------------------------------------------------------------------------------+

---

3. Disclosures Requiring Opportunity to Agree or Object (45 CFR § 164.510)

Under 45 CFR § 164.510, covered entities may disclose PHI in specific operational circumstances without a formal written authorization, provided the individual is informed in advance and given the opportunity to agree, prohibit, or restrict the disclosure. Permission may be obtained orally.

A. Facility Directories (45 CFR § 164.510(a))

A healthcare facility maintaining a patient directory may disclose limited information without written authorization:

• Permitted Directory Elements: (1) Patient name; (2) Location in the facility (e.g., room number); (3) General condition described in terms that do not communicate specific medical information (e.g., undetermined, good, fair, serious, critical); and (4) Religious affiliation.
• Rules of Release:
  • General public callers: Must ask for the patient by name. The facility may release name, location, and general condition (but NEVER religious affiliation).
  • Members of the Clergy: Do not need to ask for the patient by name; they may receive name, location, general condition, and religious affiliation.
• Incapacity Standard: If a patient is admitted unconscious or in an emergency, the facility may include the patient in the directory if it is consistent with any prior expressed preference and deemed in the patient's best interest using professional judgment. The facility must provide the opportunity to opt out as soon as the patient regains capacity.

B. Involvement in Care and Notification (45 CFR § 164.510(b))

A covered entity may disclose to a family member, relative, close personal friend, or any person identified by the individual, PHI directly relevant to that person's involvement in the patient's healthcare or payment for care:

• Patient Present and Competent: Provider may disclose if the patient agrees, does not object when offered the chance, or the provider reasonably infers from the circumstances that the patient does not object (e.g., spouse present during discharge instructions).
• Patient Incapacitated or Emergency: Provider may exercise professional judgment to determine whether disclosure is in the patient's best interest (e.g., allowing a neighbor to pick up a filled prescription, surgical status updates to an anxious spouse in the waiting room).

C. Disaster Relief Organizations (45 CFR § 164.510(b)(4))

Covered entities may disclose limited PHI (location and general condition) to public or private disaster relief agencies (e.g., the American Red Cross) to coordinate family notification during emergencies, even if oral agreement cannot be obtained due to emergency response interference.

---

4. National Priority Public Interest Disclosures (45 CFR § 164.512)

Congress and HHS established 12 national priority purposes where societal interests outweigh individual privacy rights. Under 45 CFR § 164.512, PHI may be disclosed without individual authorization or opportunity to agree/object.

+---------------------------------------------------------------------------------------------------+
|                         THE 12 NATIONAL PRIORITY EXCEPTIONS MATRIX                                |
|                                   (45 CFR § 164.512)                                              |
|                                                                                                   |
|   1. REQUIRED BY LAW (§ 164.512(a))       --> Mandated by statute, regulation, or court order.    |
|   2. PUBLIC HEALTH (§ 164.512(b))         --> CDC, FDA recalls, communicable diseases, OSHA.      |
|   3. ABUSE / NEGLECT (§ 164.512(c))       --> Adult/elder abuse (Child abuse under § 164.512(b)).  |
|   4. HEALTH OVERSIGHT (§ 164.512(d))      --> OIG, CMS, State Licensing Boards, DOJ audits.       |
|   5. JUDICIAL PROCEEDINGS (§ 164.512(e))  --> Court orders, subpoenas with assurances / QPOs.     |
|   6. LAW ENFORCEMENT (§ 164.512(f))       --> Warrants, fugitive tracing (8 items), crime on site.|
|   7. DECEDENTS / CORONERS (§ 164.512(g))  --> Coroners, medical examiners, funeral directors.     |
|   8. ORGAN PROCUREMENT (§ 164.512(h))     --> Organ Procurement Organizations (OPOs).             |
|   9. RESEARCH WAIVERS (§ 164.512(i))      --> IRB / Privacy Board waiver, prep-to-research.       |
|  10. SERIOUS THREAT (§ 164.512(j))        --> Imminent threat to safety / Tarasoff duty to warn.  |
|  11. SPECIALIZED GOV (§ 164.512(k))       --> Military command, national security, corrections.   |
|  12. WORKERS' COMP (§ 164.512(l))         --> State workers' compensation statutory schemes.      |
+---------------------------------------------------------------------------------------------------+

In-Depth Analysis of High-Stakes Public Interest Exceptions

A. Public Health Activities (§ 164.512(b)) vs. Abuse and Neglect (§ 164.512(c))

• Public Health Authorities: Disclosures to CDC, state/local health departments for disease tracking, vital records, and injury surveillance.
• FDA Surveillance: Disclosures to FDA-regulated entities to track adverse drug events, enable product recalls, or conduct post-marketing surveillance.
• Child Abuse vs. Adult Abuse Distinction:
  • Child Abuse / Neglect: Codified under § 164.512(b)(1)(ii) (Public Health). Reporting to child welfare authorities is mandatory/permitted without notifying parents or obtaining consent.
  • Adult Abuse, Neglect, or Domestic Violence: Governed under § 164.512(c). The covered entity must prompt notify the adult victim that a report was made, UNLESS the clinician believes in professional judgment that informing the victim would place them at risk of serious harm, or the notification would be made to a personal representative responsible for the abuse.

B. Health Oversight Activities (45 CFR § 164.512(d))

Disclosures are permitted to health oversight agencies (HHS Office of Inspector General, state licensing boards, CMS, DOJ Medicaid Fraud Control Units) for authorized audits, civil/criminal investigations, licensure proceedings, and program evaluations.

C. Judicial and Administrative Proceedings (45 CFR § 164.512(e))

Compliance officers must distinguish between two procedural pathways when responding to legal demands:

1. Court Order or Signed Administrative Judge Order: The covered entity may disclose only the specific PHI expressly authorized in the court order.
2. Subpoena, Discovery Request, or Summons (Not signed by a judge): A subpoena alone is insufficient. The covered entity may release PHI only if it receives:
   • Satisfactory Assurances of Notice: Written documentation proving the party seeking discovery made a good-faith attempt to serve written notice on the patient, providing adequate time to raise an objection in court, and no objection was filed (or objections were resolved); OR
   • Satisfactory Assurances of a Qualified Protective Order (QPO): Documentation proving the parties agreed to or requested a QPO from the court, which prohibits using PHI for any purpose outside the litigation and mandates returning or destroying all PHI at the end of proceedings.

D. Law Enforcement Inquiries (45 CFR § 164.512(f))

• Suspect / Fugitive Identification: Disclosures to assist law enforcement in locating a suspect, fugitive, material witness, or missing person are strictly limited to 8 demographic data elements: (1) Name and address; (2) Date and place of birth; (3) Social Security Number; (4) ABO blood type and Rh factor; (5) Type of injury; (6) Date and time of treatment; (7) Date and time of death; (8) Description of distinguishing physical characteristics.
• Strict Prohibition: Covered entities may never release DNA data, dental records, or body fluid / tissue typing samples under the fugitive identification exception.
• Victims of Crime: Permitted if the individual agrees, or if incapacitated and law enforcement confirms immediate investigative necessity and assures info will not be used against the victim.
• Crime on Premises: Permitted to report PHI that constitutes evidence of a crime occurring on the physical premises of the covered entity.

E. Serious and Imminent Threat to Health or Safety (45 CFR § 164.512(j))

Consistent with applicable state law (e.g., Tarasoff doctrines) and ethical codes, a covered entity may disclose PHI if it believes in good faith that disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, and the disclosure is made to a person reasonably able to prevent or lessen the threat (including the target of the threat or law enforcement).