146.816 Uses and disclosures of protected health information.
(1) In this section:
(a) “Business associate" has the meaning given in 45 CFR 160.103.
(b) “Covered entity" has the meaning given in 45 CFR 160.103.
(c) “Disclosure" has the meaning given in 45 CFR 160.103 and includes redisclosures and rereleases of information.
(d) “Health care operations" has the meaning given in 45 CFR 164.501.
(e) “Payment" has the meaning given in 45 CFR 164.501.
(f) “Protected health information" has the meaning given in 45 CFR 160.103.
(g) “Treatment" has the meaning given in 45 CFR 164.501.
(h) “Treatment facility" has the meaning given in s. 51.01 (19).
(i) “Use" has the meaning given in 45 CFR 160.103.
(2) Sections 51.30 (4) (a) and (e) and 146.82 and rules promulgated under s. 51.30 (12) do not apply to a use, disclosure, or request for disclosure of protected health information by a covered entity or its business associate that meets all the following criteria:
(a) The covered entity or its business associate makes the use, disclosure, or request for disclosure in compliance with 45 CFR 164.500 to 164.534.
(b) The covered entity or its business associate makes the use, disclosure, or request for disclosure in any of the following circumstances:
1. For purposes of treatment.
2. For purposes of payment.
3. For purposes of health care operations.
4. For purposes of disclosing information about a patient in a good faith effort to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.
5. For purposes of disclosing under s. 175.32 any threat made by a patient regarding violence in or targeted at a school in a good faith effort to prevent or lessen a serious and imminent threat to the health or safety of a student or school employee or the public.
(3) A covered entity that is a treatment facility shall comply with the notice of privacy practices obligations under 45 CFR 164.520, including the obligation to include in plain language in the notice of privacy practices a statement of the individual's rights with respect to protected health information and a brief description of how the individual may exercise those rights including the right to request restrictions on uses and disclosures of protected health information about the individual to carry out treatment, payment, or health care operations as provided in 45 CFR 164.522.
(4) The department shall make a comprehensive and accessible document written in commonly understood language that explains health information privacy rights available to all applicable health care facilities in the state and on the department's Internet site.
History: 2013 a. 238; 2017 a. 140, 143.