Permitted Use or Disclosure Sample Clauses

Permitted Use or Disclosure. Select the following as appropriate: □ Decedent Information. Under HIPAA, the use or disclosure of PHI is permitted without written Authorization from the personal representative of the patient, a Waiver of Authorization, or DUA when for research as long as the Covered Entity obtains certain representations from the researcher; However, UMMC requires a DUA in order to obtain representations. By executing this DUA, Recipient is declaring 1) Use or disclosure being sought is solely for research and use of PHI of decedents; 2) PHI being sought is necessary for research; and 3) At the request of the Covered Entity, documentation of the death of the individuals about whom information is being sought. Decedent information is protected for 50 years following the date of death. □ Treatment/Payment/Healthcare Operations within UMMC. Under HIPAA, the use or disclosure of PHI is permitted without the patient’s written Authorization when for Treatment, Payment, or Health Care Operations (TPO). Definitions of these activities are specified in 45 CFR §164.501. Employees are to use and disclose only that information that is minimally necessary to perform their job duties. By executing this DUA, employee agrees to data use and/or disclosure obligations. □ IRB Approved Research. Under HIPAA, the use or disclosure of PHI for research is permitted without the patient’s written Authorization, if a HIPAA Waiver of Authorization or HIPAA Alteration of Authorization from an Institutional Review Board (IRB) or Privacy Board has been approved. By executing this DUA, Recipient declares receipt of IRB approval and shall attach one of the following approval letters 1) HIPAA Alteration of Authorization; or 2) HIPAA Waiver. □ Limited Data Set. Under HIPAA, the use or disclosure of PHI is permitted without the patient’s written Authorization when it is for Research, Public Health, or Health Care Operations, as long as a DUA is obtained. Specific details shall be provided on the last page. Recipient shall not attempt to identify the individuals to whom the PHI pertains, or attempt to contact such individuals. A Limited Data Set excludes the following identifiers: 1) Names; 2) Postal address information, other than town or city, State, and zip code; 3) Telephone numbers; 4) Fax numbers; 5) Electronic mail addresses; 6) Social security numbers; 7) Medical record numbers; 8) Health plan beneficiary numbers; 9) Account numbers; 10) Certificate/license numbers; 11) Vehicle identifiers and ser...