National Priority Purposes

The Privacy Rule permits UNC to use and disclose protected health information, without an individual's authorization or permission, for the following purposes:

• Required by Law - Entities may use and disclose protected health information without authorization as required by law (including statute, regulation, or court orders)
• Public Health Activities - Covered entities may disclose information to:
  • Public Health authorities authorized by law to collect or receive such information for preventing or controlling disease, injury, or disability
  • Entities subject to FDA regulation regarding FDA regulated products or activities for purposes such as adverse event reporting, tracking of products, product recalls, and post-marketing surveillance
  • Individuals who may have contracted or been exposed to a communicable disease when notification is authorized by law
  • Employers, regarding employees when used by employers for information concerning work-related illness or injury or workplace related medical surveillance because such information is needed by the employer to comply with the Occupation Safety and Health Administration (OSHA)
• Victims of Abuse, Neglect, or Domestic Violence - In certain circumstances, covered entities may disclose PHI to appropriate government authorities regarding victims of abuse, neglect, or domestic violence
• Health Oversight Activities - For the purpose of legally authorized audits and investigations
• Judicial and Administrative Proceedings - If the request for information is court ordered or through an administrative tribunal.
• Law Enforcement Purposes - Only under the following circumstances:
  • As required by law or other lawful process (court orders, court-ordered warrants, subpoenas)
  • Administrative requests to identify or locate a suspect, fugitive, material witness, or missing person
  • In response to a law enforcement official's request for information regarding a victim or suspected victim of a crime
  • To alert law enforcement of a person's death IF the covered entity suspects that criminal activity caused the death
  • When an entity believes that PHI is evidence of a crime that occurred on its premises
  • By a covered health care provider in a medical emergency not occurring on its premises, when necessary to inform law enforcement about the commission and nature of a crime, the location of the crime or crime victims, and the perpetrator of the crime
• Descendents - To Funeral Directors as needed, and to Coroners or Medical Examiners to identify a deceased person, determine the cause of death, and perform other functions authorized by law
• Cadaveric Organ, Eye, or Tissue Donation - To facilitate the donation and transplantation of cadaveric organs, eyes, and tissue
• Research - "Research" is any systematic investigation designed to develop or contribute to generalizable knowledge. The Privacy Rule permits use of PHI for research purposes, without anindividual's authorization, provided the covered entity obtains either:
  • documentation that a waiver of individual's authorization for the use or disclose of PHI about them for research purposes has been approved by an Institutional Review Board or Privacy Board
  • Representations from the researcher that the use of the PHI is solely to prepare a research protocol or for similar purposes preparatory to research, that the researcher will not remove any PHI from the covered entity, and that PHI for which access is sought is necessary for the research
  • Representations from the researcher that the use of PHI is necessary for the research, and, at the request of the covered entity, documentation of the death of the individuals about whom information is sought. Researchers may also use or disclose PHI for a limited data set for research purposes
• Serious Threat to Health or Safety- If necessary to prevent or lessen a serious and imminent threat to a person or the public, when such disclosure is made to someone they believe can prevent or lessen the threat (including the target of the threat)
• Essential Government Functions - Such functions include assuring proper execution of a military mission, conducting intelligence and national security activities that are authorized by law, providing protective services, making medical suitability determination for State Department employees, protecting the health and safety of inmates or employees in a correctional institution and determining eligibility for or conducting enrollment in certain government benefit programs
• Workers' Compensation - To comply with Workers' Compensation laws and other similar programs providing benefits for work-related injuries or illnesses