|
§
164.532 Transition provisions.
a)
Standard: effect of prior consents and authorizations. Notwithstanding
other sections of this subpart, a covered entity may continue to use or disclose
protected health information pursuant to a consent, authorization, or other
express legal permission obtained from an individual permitting the
use or
disclosure of protected health information that does not comply with §§
164.506 or 164.508 of this subpart consistent with paragraph (b) of this section
(b)
Implementation specification: requirements for retaining effectiveness of
prior consents and authorizations. Notwithstanding other sections of this
subpart, the following provisions apply to use or disclosure by a
covered entity
of protected health information pursuant to a consent, authorization, or other
express legal permission obtained from an individual permitting the
use or
disclosure of protected health
information, if the consent, authorization, or
other express legal permission was obtained from an individual before the
applicable compliance date of this subpart and does not comply with §§ 164.506
or 164.508 of this subpart.
(1)
If the consent, authorization, or other express legal permission obtained from
an individual permits a use or disclosure for purposes of carrying out
treatment, payment, or health care
operations, the covered entity may, with
respect to protected health information that it created or received before the
applicable compliance date of this subpart and to which the consent,
authorization, or other express legal permission obtained from an individual
applies, use or disclose such information for purposes of carrying out treatment, payment, or health care
operations, provided that:
(i)
The covered entity does may not make any use or disclosure that is expressly
excluded from the a consent, authorization, or other express legal permission
obtained from an individual; and
(ii)
The covered entity complies with all limitations placed by the consent,
authorization, or other express legal permission obtained from an individual.
(2)
If the consent, authorization, or other express legal permission obtained from
an individual specifically permits a use or disclosure for a purpose other than
to carry out treatment, payment, or health care
operations, the covered entity
may, with respect to protected health information that it created or received
before the applicable compliance date of this subpart and to which the consent,
authorization, or other express legal permission obtained from an individual
applies, make such use or disclosure, provided that:
(i)
The covered entity does not make any use or disclosure that is expressly
excluded from the consent, authorization, or other express legal permission
obtained from an individual; and
(ii)
The covered entity complies with all limitations placed by the consent,
authorization, or other express legal permission obtained from an individual.
(3)
In the case of a consent, authorization, or other express legal permission
obtained from an individual that identifies a specific
research project that
includes treatment of individuals:
(i)
If the consent, authorization, or other express legal permission obtained from
an individual specifically permits a use or disclosure for purposes of the
project, the covered entity may, with respect to protected health information
that it created or received either before or after the applicable compliance
date of this subpart and to which the consent or authorization applies, make
such use or disclosure for purposes of that project, provided that the
covered
entity complies with all limitations placed by the consent, authorization, or
other express legal permission obtained from an individual.
(ii)
If the consent, authorization, or other express legal permission obtained from
an individual is a general consent to participate in the project, and a
covered
entity is conducting or participating in the research, such
covered entity may,
with respect to protected health information that it created or received as part
of the project before or after the applicable compliance date of this subpart,
make a use or disclosure for purposes of that project, provided that the
covered
entity complies with all limitations placed by the consent, authorization, or
other express legal permission obtained from an individual.
(4)
If, after the applicable compliance date of this subpart, a covered entity
agrees to a restriction requested by an individual under § 164.522(a), a
subsequent use or disclosure of protected health information that is subject to
the restriction based on a consent, authorization, or other express legal
permission obtained from an individual as given effect by paragraph (b) of this
section, must comply with such restriction.
|
