USE and DISCLOSURE of PHI
- USE: Protected Health Information is “used” when shared, examined, applied or analyzed within the covered entity that maintains the information.
- DISCLOSURE: Protected Health information is “disclosed” when released, transferred, been given access to or divulged outside the entity holding the information.
Minimum Necessary Standard
- Protected health information should not be used or disclosed when it is not necessary to satisfy a particular purpose or carry out a function
- Requires covered entities to evaluate their practices and enhance safeguards as needed to limit unnecessary or inappropriate access to and disclosure of protected health information