The United States Department of Health and Human Services (HHS), Office of the National Coordinator for Health IT (ONC), and Office for Civil Rights (OCR) have worked together to develop two fact sheets on HIPAA Permitted Uses and Disclosures. The effort was made to lessen confusion among healthcare organizations on when and where they could transfer PHI without requiring specific patient authorization.
The fact sheet entitled "Permitted Uses and Disclosures: Exchange for Health Care Operations" provides the following examples of permitted transfers between a covered entity (CE) and another CE or business associate (BA). The following activities are listed as permitted for the purposes of healthcare care operations activities and do not require written patient consent so long as the proper relationship between the two parties has been established as per outlined HIPAA guidelines:
Conducting quality assessment and improvement activities
Developing clinical guidelines
Conducting patient safety activities as defined in applicable regulations
Conducting population-based activities relating to improving health or reducing health care cost
Conducting case management and care coordination (including care planning)
Contacting health care providers and patients with information about treatment alternatives
Reviewing qualifications of health care professionals
Evaluating performance of health care providers and/or health plans
Conducting training programs or credentialing activities
Supporting fraud and abuse detection and compliance programs
These activities are permitted so long as (1) both CEs have or had a relationship with the patient, (2) the transferred PHI is related to the relationship and (3) the 'discloser' only discloses the minimum information required to execute the health care operation. The fact sheet includes subsequent examples of uses by health care management companies for quality improvements and assessments.
More information about the HIPAA fact sheets and requisite relationship requirements between involved parties can be found on the HHS Website.