Health Information Compliance Alert

Question:  When does the HIPAA Privacy Rule allow an incidental healthcare disclosure?

Answer:Under HIPAA, an incidental disclosure is “a secondary use or disclosure that cannot reasonably be prevented, is limited in nature, and that occurs as a result of another use or disclosure that is permitted by the HIPAA Rule.”

HIPAA allows incidental disclosures in certain situations. According to a May 20 blog posting by attorney Mary Beth Gettins of Gettins’ Law, HIPAA permits incidental disclosures:

1. If the disclosure is a by-product of a permissible or required use or disclosure, and

2. As long as the covered entity (CE) has applied reasonable safeguards, and

3. If the CE has implemented the minimum necessary standards, with respect to the permitted or required use or disclosure.

Resource: For more information on incidental uses and disclosures, go to www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/incidentalusesanddisclosures.html.