There are permitted uses and disclosures of PHI for different purposes within the healthcare sector. All employees of an organization that acts as a covered entity or business associate must be aware of these guidelines. It is always permitted to use and disclose PHI for treatment, payment and health care operations. If the reason for disclosing the PHI is not for one of these purposes an authorization must be obtained. By following these guidelines, an organization may stay in compliance with HIPAA’s rules and be able to share protected health information.
Disclosure refers to the transfer, release, provision of access to, or divulging in any other manner of information outside the entity holding the information. These definitions are applicable to the sharing of electronic, paper or oral communications. This does not include the disclosure of PHI to the Individual himself or herself.
Use is a sharing, employment, application, use, examination or analysis identifiable health information within the entity that maintains such information.
A major difference between Disclosure and Use is that use PHI is internal to the covered entity while disclosure focuses on external communication of PHI.
