[Code of Federal Regulations]
[Title 45, Volume 1]
[Revised as of October 1, 2001]
From the U.S. Government Printing Office via GPO Access
[CITE: 45CFR164.510]

[Page 701-702]
 
                        TITLE 45--PUBLIC WELFARE
 
                    SUBTITLE A--DEPARTMENT OF HEALTH
                           AND HUMAN SERVICES
 
PART 164--SECURITY AND PRIVACY--Table of Contents
 
   Subpart E--Privacy of Individually Identifiable Health Information
 
Sec. 164.510  Uses and disclosures requiring an opportunity for the individual to agree or to object.

    A covered entity may use or disclose protected health information 
without the written consent or authorization of the individual as 
described by Secs. 164.506 and 164.508, respectively, provided that the 
individual is informed in advance of the use or disclosure and has the 
opportunity to agree to or prohibit or restrict the disclosure in 
accordance with the applicable requirements of this section. The covered 
entity may orally inform the individual of and obtain the individual's 
oral agreement or objection to a use or disclosure permitted by this 
section.
    (a) Standard: use and disclosure for facility directories. (1) 
Permitted uses and disclosure. Except when an objection is expressed in 
accordance with paragraphs (a)(2) or (3) of this section, a covered 
health care provider may:
    (i) Use the following protected health information to maintain a 
directory of individuals in its facility:
    (A) The individual's name;
    (B) The individual's location in the covered health care provider's 
facility;
    (C) The individual's condition described in general terms that does 
not communicate specific medical information about the individual; and
    (D) The individual's religious affiliation; and
    (ii) Disclose for directory purposes such information:
    (A) To members of the clergy; or
    (B) Except for religious affiliation, to other persons who ask for 
the individual by name.
    (2) Opportunity to object. A covered health care provider must 
inform an individual of the protected health information that it may 
include in a directory and the persons to whom it may disclose such 
information (including disclosures to clergy of information regarding 
religious affiliation) and provide the individual with the opportunity 
to restrict or prohibit some or all of the uses or disclosures permitted 
by paragraph (a)(1) of this section.
    (3) Emergency circumstances. (i) If the opportunity to object to 
uses or disclosures required by paragraph (a)(2) of this section cannot 
practicably be provided because of the individual's incapacity or an 
emergency treatment circumstance, a covered health care provider may use 
or disclose some or all of the protected health information permitted by 
paragraph (a)(1) of this section for the facility's directory, if such 
disclosure is:
    (A) Consistent with a prior expressed preference of the individual, 
if any, that is known to the covered health care provider; and
    (B) In the individual's best interest as determined by the covered 
health care provider, in the exercise of professional judgment.

[[Page 702]]

    (ii) The covered health care provider must inform the individual and 
provide an opportunity to object to uses or disclosures for directory 
purposes as required by paragraph (a)(2) of this section when it becomes 
practicable to do so.
    (b) Standard: uses and disclosures for involvement in the 
individual's care and notification purposes. (1) Permitted uses and 
disclosures. (i) A covered entity may, in accordance with paragraphs 
(b)(2) or (3) of this section, disclose to a family member, other 
relative, or a close personal friend of the individual, or any other 
person identified by the individual, the protected health information 
directly relevant to such person's involvement with the individual's 
care or payment related to the individual's health care.
    (ii) A covered entity may use or disclose protected health 
information to notify, or assist in the notification of (including 
identifying or locating), a family member, a personal representative of 
the individual, or another person responsible for the care of the 
individual of the individual's location, general condition, or death. 
Any such use or disclosure of protected health information for such 
notification purposes must be in accordance with paragraphs (b)(2), (3), 
or (4) of this section, as applicable.
    (2) Uses and disclosures with the individual present. If the 
individual is present for, or otherwise available prior to, a use or 
disclosure permitted by paragraph (b)(1) of this section and has the 
capacity to make health care decisions, the covered entity may use or 
disclose the protected health information if it:
    (i) Obtains the individual's agreement;
    (ii) Provides the individual with the opportunity to object to the 
disclosure, and the individual does not express an objection; or
    (iii) Reasonably infers from the circumstances, based the exercise 
of professional judgment, that the individual does not object to the 
disclosure.
    (3) Limited uses and disclosures when the individual is not present. 
If the individual is not present for, or the opportunity to agree or 
object to the use or disclosure cannot practicably be provided because 
of the individual's incapacity or an emergency circumstance, the covered 
entity may, in the exercise of professional judgment, determine whether 
the disclosure is in the best interests of the individual and, if so, 
disclose only the protected health information that is directly relevant 
to the person's involvement with the individual's health care. A covered 
entity may use professional judgment and its experience with common 
practice to make reasonable inferences of the individual's best interest 
in allowing a person to act on behalf of the individual to pick up 
filled prescriptions, medical supplies, X-rays, or other similar forms 
of protected health information.
    (4) Use and disclosures for disaster relief purposes. A covered 
entity may use or disclose protected health information to a public or 
private entity authorized by law or by its charter to assist in disaster 
relief efforts, for the purpose of coordinating with such entities the 
uses or disclosures permitted by paragraph (b)(1)(ii) of this section. 
The requirements in paragraphs (b)(2) and (3) of this section apply to 
such uses and disclosure to the extent that the covered entity, in the 
exercise of professional judgment, determines that the requirements do 
not interfere with the ability to respond to the emergency 
circumstances.