Iowa Admin. Code r. 441-9.10 - Use and disclosure without consent of the subject
Open records are routinely disclosed without the consent of the subject. To the extent allowed by law, the department may also use and disclose confidential information without the consent of the subject or the subject's representative.
(1)
Internal use. Confidential information may be disclosed to
employees and agents of the department as needed for the performance of their
duties. The custodian of the record shall determine what constitutes legitimate
need to use confidential records.
(2)
Audits and health oversight
activities.
a.
Audits. Information concerning program expenditures and client
eligibility is released to staff of the state executive and legislative
branches who are responsible for ensuring that public funds have been managed
correctly. Information is also released to auditors from federal agencies when
those agencies provide program funds.
b.
Health oversight
activities. The department will follow the uses and disclosures
standards for health oversight activities as outlined in
45 CFR §
164.512 as amended to January 6,
2016.
(3)
Program
review. Information concerning client eligibility and benefits is
released to state or federal officials responsible for determining whether the
department is operating a program lawfully. These officials include the
ombudsman office under Iowa Code section
2C.9, the auditor of state under
Iowa Code section 11.2, the Office of Inspector General in the federal
Department of Health and Human Services, and the Centers for Medicare and
Medicaid Services.
(4)
Contracts and agreements with agencies and persons.
a. The department may enter into contracts or
agreements with public or private agencies to carry out the department's
official duties or as necessary to administer a program within the other
agency. Information necessary to carry out these duties may be shared with
these agencies. The department may disclose protected health information to a
business associate and may allow a business associate to create or receive
protected health information on its behalf if the department obtains
satisfactory assurance that the business associate will appropriately safeguard
the information.
b. The department
may enter into agreements to share information with agencies administering
federal or federally assisted programs which provide assistance or services
directly to persons on the basis of need. Only information collected in the
family investment program, the child care assistance program, the food
assistance program, the refugee resettlement program, or the child support
recovery program may be shared under these agreements.
c. To meet federal income and eligibility
verification requirements, the department has entered into agreements with the
department of workforce development, the United States Internal Revenue
Service, and the United States Social Security Administration. The department
obtains information regarding persons whose income or resources are considered
in determining eligibility and the amount of benefits for the family investment
program, refugee cash assistance, child care assistance, food assistance,
Medicaid, state supplementary assistance and foster care. Identifying
information regarding clients of these programs is released to these agencies.
The information received may be used for eligibility and benefit
determinations.
d. To meet federal
requirements under the Immigration Reform and Control Act of 1986 (IRCA)
relating to the Systematic Alien Verification for Entitlements (SAVE) program,
the department has entered into an agreement with the Bureau of Citizenship and
Immigration Service (BCIS). Under the agreement, the department exchanges
information necessary to verify alien status for the purpose of determining
eligibility and the amount of benefits for the family investment program,
refugee cash assistance, food assistance, Medicaid, state supplementary
assistance and foster care assistance. Identifying information regarding these
subjects is released to the BCIS. The information received may be used for
eligibility and benefit determinations.
e. The department has entered into an
agreement with the department of workforce development to provide services to
family investment program clients participating in the PROMISE JOBS program as
described at 441-Chapter 93. Information necessary to carry out these duties
shall be shared with the department of workforce development, as well as with
its subcontractors.
f. The
department has entered into an agreement with the department of education,
vocational rehabilitation, disability determination services, to assist with
Medicaid disability determinations.
g. The department has entered into an
agreement with the department of education to share information that assists
both schools and department clients in carrying out the annual verification
process required by the United States Department of Agriculture, Food and
Nutrition Service. That federal agency requires the department of education and
local schools to verify eligibility of a percentage of the households approved
for free-meal benefits under the school lunch program. When a department office
receives a written request from the local school, the department office
responds in writing with the current family investment program and food
assistance program status of each recipient of free meals listed in the
request. Other client-specific information is made available only with written
authorization from the client.
(5)
Release for judicial and
administrative proceedings. Information is released to the court as
required in Iowa Code sections
125.80,
125.84,
125.86,
229.8,
229.10,
229.13, 229.14,
229.15,
229.22,
232.48,
232.49,
232.52,
232.71B,
232.81,
232.97, 232.98,
232.102,
232.111,
232.117 and
235B.3.
a. The department may disclose protected
health information in the course of any judicial or administrative proceeding
in response to an order of a court or administrative tribunal, provided that
the department discloses only the protected health information expressly
authorized by the order and the court makes the order knowing that the
information is confidential.
b.
When a court subpoenas information that the department is prohibited from
releasing, the department shall advise the court of the statutory and
regulatory provisions against disclosure of the information and shall disclose
the information only on order of the court.
(6)
Fraud. Information
concerning suspected fraud or misrepresentation to obtain department services
or assistance is disclosed to the department of inspections, appeals, and
licensing and to law enforcement authorities.
(7)
Service referrals.
Information concerning clients may be shared with purchase of service providers
under contract to the department.
a.
Information concerning the client's circumstances and need for service is
shared with prospective providers to obtain placement for the client. If the
client is not accepted for service, all written information released to the
provider shall be returned to the department.
b. When the information needed by the
provider is mental health information or substance abuse information, the
subject's specific consent is required.
(8)
Medicaid billing. Only
the following information shall be released to bona fide providers of medical
services in the event that the provider is unable to obtain it from the subject
and is unable to complete the Medicaid claim form without it:
a. Patient identification number.
b. Health coverage code as reflected on the
subject's medical card.
c. The
subject's date of birth.
d. The
subject's eligibility status for the month that the service was
provided.
e. The amount of
spenddown.
f. The bills used to
meet spenddown.
(9)
Reserved.
(10)
Child support
recovery. The child support recovery unit has access to information
from most department records for the purpose of establishing and enforcing
support obligations. Information about absent parents and recipients of child
support services is released according to the provisions of Iowa Code chapters
234, 252A, 252B, 252C, 252D, 252E, 252F, 252G, 252H, 252I, 252J, 252K, 598, and
600B and any other support chapter. Information is also released to consumer
reporting agencies as specified in rule
441-98.116 (252B).
(11)
Refugee resettlement
program. Contacts with both sponsor and resettlement agencies are made
as a part of the verification process to determine eligibility or the amount of
assistance. When a refugee applies for cash or Medicaid, the refugee's name,
address, and telephone number are given to the refugee's local resettlement
agency.
(12)
Abuse
investigation. The central abuse registry disseminates child abuse
information and dependent adult abuse information as provided in Iowa Code
sections 235A.15 and
235B.7, respectively. Reports of
child abuse and dependent adult abuse investigations are submitted to the
county attorney as required in Iowa Code sections
232.71B and
235B.3. Results of the
investigation of a report by a mandatory reporter are communicated to the
reporter as required in Iowa Code sections
235A.17(2) and
235A.15(2)
"b" (5).
(13)
Foster care. Information concerning a child's need for foster
care is shared with foster care review committees or foster care review boards
and persons named in the case permanency plan.
(14)
Adoption. Adoptive home
studies completed on families who wish to adopt a child are released to
licensed child-placing agencies, to the United States Immigration and
Naturalization Service, and to adoption exchanges. Information is released from
adoption records as provided in Iowa Code sections 600.16 and
600.24.
(15)
Disclosures to law
enforcement.
a.
Disclosures
by workforce members who are crime victims. The department is not
considered to have violated the requirements of this chapter if a member of its
workforce who is the victim of a criminal act discloses confidential
information to a law enforcement official, provided that:
(1) The confidential information disclosed is
about the suspected perpetrator of the criminal act and intended for
identification and location purposes; and
(2) The confidential information disclosed is
limited to the following information:
1. Name
and address.
2. Date and place of
birth.
3. Social security
number.
4. ABO blood type and Rh
factor.
5. Type of
injury.
6. Date and time of
treatment.
7. Date and time of
death, if applicable.
8. A
description of distinguishing physical characteristics, including height,
weight, gender, race, hair and eye color, presence or absence of facial hair
(beard or moustache), scars, and tattoos.
b.
Crime on premises. The
department may disclose to a law enforcement official protected health
information that the department believes in good faith constitutes evidence of
criminal conduct that occurred on the premises of the department.
c.
Decedents. The department
may disclose protected health information to a law enforcement official about a
subject who has died when the death resulted from child abuse or neglect or the
death occurred in a department facility.
d.
Other. The department may
disclose confidential information to a law enforcement official when otherwise
required or allowed by this chapter, such as disclosures about victims of child
abuse or neglect; disclosures to avert a threat to health or safety, or to
report suspected fraud; disclosures required by due process of law, such as
disclosures for judicial and administrative proceedings; or other disclosures
required by law.
(16)
Response to law enforcement. The address of a current
recipient of family investment program benefits may be released upon request to
a federal, state or local law enforcement officer if the officer provides the
name of the recipient, and the officer demonstrates that:
a. The recipient is a fugitive felon who is
fleeing prosecution, custody or confinement after conviction under state or
federal law, or who is a probation or parole violator under state or federal
law, or
b. The recipient has
information that is necessary for the officer to conduct the officer's official
duties, and
c. The location or
apprehension of the recipient is within the officer's official
duties.
(17)
Research. Disclosure is made to employees of federal, state
and local agencies and other researchers for purposes of bona fide research.
The department shall not release data or information pursuant to this paragraph
unless the department and the researcher have executed an agreement that
includes the conditions under which the confidential data or information may be
used and restrictions on further disclosure of the data or information.
a. Mental health information may be disclosed
for purposes of scientific research as provided in Iowa Code sections
228.5 and 229.25. Requests to do
research involving records of a department facility shall be approved by the
designated authority.
b. Abuse
registry information may be disclosed for research purposes as provided in
rules 441-175.42 (235A) and
441-176.12(235B) and authorized by Iowa Code sections
235A.15(2)"e"(1) and 235B.6(2)"e"(1).
c. For research relating to
protected health information, the researcher shall provide the department with
information about the nature of the research, the protocol, the type of
information being requested, and any other relevant information that is
available concerning the request. If the researcher feels that contact with the
subject is needed, the researcher shall demonstrate to the department that the
research cannot be conducted without contact with the subject. The researcher
shall pay for the costs of obtaining authorizations needed to contact the
subjects and for the cost of files and preparation needed for the research.
(18)
Threat to
health or safety.
a. All programs. A
client's name, identification, location, and details of a client's threatened
or actual harm to department staff or property may be reported to law
enforcement officials. Other information regarding the client's relationship to
the department shall not be released. When a department staff person believes a
client intends to harm someone, the staff person may warn the intended victim
or police or both. Only the name, identification, and location of the client
and the details of the client's plan of harm shall be disclosed.
b. Protected health information. The
department will follow the disclosure standards in
45 CFR §
164.512 as amended to January 6,
2016.
(19)
Required by law.
a.
Information is shared with other agencies without a contract or written
agreement when federal law or regulations require it.
b. The department may use or disclose
protected health information to the extent that use or disclosure is required
by law and the use or disclosure complies with and is limited to the relevant
requirements of the law.
c. State
law shall preempt rules in this chapter about protected health information when
any one of the following conditions exists:
(1) Exception granted by Secretary of Health
and Human Services under 45
CFR §
160.204 as amended to March 26,
2013.
(2) State law more stringent.
The provision of state law relates to the privacy of protected health
information and is more stringent than a requirement of this chapter, within
the meaning of "more stringent" found at
45 CFR §
160.202 as amended to March 26,
2013.
(3) Reporting requirements.
The provision of state law, including state procedures established under the
law, as applicable, provides for the reporting of disease or injury, child
abuse, birth, or death, or for the conduct of public health surveillance,
investigation, or intervention.
(4)
Requirements related to audits, monitoring, evaluation, licensing, and
certification. The provision of state law requires a health plan to report, or
to provide access to, information for the purpose of management audits,
financial audits, program monitoring and evaluation, or the licensure or
certification of facilities and persons.
(20)
Treatment, payment, or health
care operations.
a. The department
may use or disclose protected health information for treatment, payment, or
health care operations, as permitted by
45 CFR §
164.506 as amended to January 25, 2013,
except for psychotherapy notes, which are subject to the limits described in
paragraph 9.10(21)"b." The use or disclosure shall be
consistent with other applicable requirements of this chapter.
b. The department may use or disclose
psychotherapy notes without an authorization for any one of the following
reasons:
(1) To carry out the following
treatment, payment, or health care operations:
1. Use by the originator of the psychotherapy
notes for treatment.
2. Use or
disclosure by the department for its own training programs in which students,
trainees, or practitioners in mental health learn under supervision to practice
or improve their skills in group, joint, family, or individual
counseling.
3. Use or disclosure by
the department to defend itself in a legal action or other proceeding brought
by the subject.
(2) When
required by the Secretary of Health and Human Services to investigate or
determine the department's compliance with federal HIPAA regulations.
(3) For health oversight activities with
respect to the oversight of the originator of the psychotherapy
notes.
(4) When necessary to
prevent or lessen a serious and imminent threat to the health or safety of a
person or the public as described in this chapter.
(5) When required by law as described in this
chapter.
(6) To disclose protected
health information in the designated record set to a coroner or medical
examiner as described in this chapter.
(21)
Other uses and disclosures for
which an authorization or opportunity to agree or object is not
required. The department may use or disclose protected health
information for which an authorization or opportunity to agree or object is not
required, as permitted by 45
CFR §
164.512 as amended to January 25,
2013.
(22)
Victims of
domestic violence. The department shall disclose confidential
information about an individual whom the department reasonably believes to be a
victim of domestic violence when required by state law.
(23)
Whistle blowers. The
department is not considered to have violated the requirements of this chapter
when a member of its workforce or a business associate discloses protected
health information, provided that:
a. The
workforce member or business associate has a good-faith belief that the
department or a business associate has engaged in conduct that is unlawful or
otherwise violates professional or clinical standards, or has provided care,
services, or conditions that potentially endanger one or more patients,
workers, or the public; and
b. The
disclosure is made to one of the following:
(1) A health oversight agency or public
health authority authorized by law to investigate or oversee conduct or
conditions for the purpose of reporting the allegation of failure to meet
professional standards or misconduct.
(2) An appropriate health care accreditation
organization.
(3) An attorney
retained by or on behalf of the workforce member or business associate for the
purpose of determining the legal options of the workforce member or business
associate.
(24)
Secondary to a use or disclosure of protected health
information. The department may use or disclose protected health
information that is secondary to a use or disclosure otherwise permitted or
required by these rules, such as when a visitor in a facility overhears a
doctor speaking to a subject about the subject's health.
(25)
De-identified data or a limited
data set. The department may use or disclose protected health
information to create information that is de-identified or a limited data set
under the conditions specified in
45 CFR §
164.514 as amended to August 14,
2002.
Notes
State regulations are updated quarterly; we currently have two versions available. Below is a comparison between our most recent version and the prior quarterly release. More comparison features will be added as we have more versions to compare.
Open records are routinely disclosed without the consent of the subject. To the extent allowed by law, the department may also use and disclose confidential information without the consent of the subject or the subject's representative.
(1) Internal use. Confidential information may be disclosed to employees and agents of the department as needed for the performance of their duties. The custodian of the record shall determine what constitutes legitimate need to use confidential records.
(2) Audits and health oversight activities.
a. Audits. Information concerning program expenditures and client eligibility is released to staff of the state executive and legislative branches who are responsible for ensuring that public funds have been managed correctly. Information is also released to auditors from federal agencies when those agencies provide program funds.
b. Health oversight activities. The department will follow the uses and disclosures standards for health oversight activities as outlined in 45 CFR § 164.512 as amended to January 6, 2016.
(3) Program review. Information concerning client eligibility and benefits is released to state or federal officials responsible for determining whether the department is operating a program lawfully. These officials include the ombudsman office under Iowa Code section 2C.9, the auditor of state under Iowa Code section 11.2, the Office of Inspector General in the federal Department of Health and Human Services, and the Centers for Medicare and Medicaid Services.
(4) Contracts and agreements with agencies and persons.
a. The department may enter into contracts or agreements with public or private agencies to carry out the department's official duties or as necessary to administer a program within the other agency. Information necessary to carry out these duties may be shared with these agencies. The department may disclose protected health information to a business associate and may allow a business associate to create or receive protected health information on its behalf if the department obtains satisfactory assurance that the business associate will appropriately safeguard the information.
b. The department may enter into agreements to share information with agencies administering federal or federally assisted programs which provide assistance or services directly to persons on the basis of need. Only information collected in the family investment program, the child care assistance program, the food assistance program, the refugee resettlement program, or the child support recovery program may be shared under these agreements.
c. To meet federal income and eligibility verification requirements, the department has entered into agreements with the department of workforce development, the United States Internal Revenue Service, and the United States Social Security Administration. The department obtains information regarding persons whose income or resources are considered in determining eligibility and the amount of benefits for the family investment program, refugee cash assistance, child care assistance, food assistance, Medicaid, state supplementary assistance and foster care. Identifying information regarding clients of these programs is released to these agencies. The information received may be used for eligibility and benefit determinations.
d. To meet federal requirements under the Immigration Reform and Control Act of 1986 (IRCA) relating to the Systematic Alien Verification for Entitlements (SAVE) program, the department has entered into an agreement with the Bureau of Citizenship and Immigration Service (BCIS). Under the agreement, the department exchanges information necessary to verify alien status for the purpose of determining eligibility and the amount of benefits for the family investment program, refugee cash assistance, food assistance, Medicaid, state supplementary assistance and foster care assistance. Identifying information regarding these subjects is released to the BCIS. The information received may be used for eligibility and benefit determinations.
e. The department has entered into an agreement with the department of workforce development to provide services to family investment program clients participating in the PROMISE JOBS program as described at 441-Chapter 93. Information necessary to carry out these duties shall be shared with the department of workforce development, as well as with its subcontractors.
f. The department has entered into an agreement with the department of education, vocational rehabilitation, disability determination services, to assist with Medicaid disability determinations.
g. The department has entered into an agreement with the department of education to share information that assists both schools and department clients in carrying out the annual verification process required by the United States Department of Agriculture, Food and Nutrition Service. That federal agency requires the department of education and local schools to verify eligibility of a percentage of the households approved for free-meal benefits under the school lunch program. When a department office receives a written request from the local school, the department office responds in writing with the current family investment program and food assistance program status of each recipient of free meals listed in the request. Other client-specific information is made available only with written authorization from the client.
(5) Release for judicial and administrative proceedings. Information is released to the court as required in Iowa Code sections 125.80, 125.84, 125.86, 229.8, 229.10, 229.13, 229.14, 229.15, 229.22, 232.48, 232.49, 232.52, 232.71B, 232.81, 232.97, 232.98, 232.102, 232.111, 232.117 and 235B.3.
a. The department may disclose protected health information in the course of any judicial or administrative proceeding in response to an order of a court or administrative tribunal, provided that the department discloses only the protected health information expressly authorized by the order and the court makes the order knowing that the information is confidential.
b. When a court subpoenas information that the department is prohibited from releasing, the department shall advise the court of the statutory and regulatory provisions against disclosure of the information and shall disclose the information only on order of the court.
(6) Fraud. Information concerning suspected fraud or misrepresentation to obtain department services or assistance is disclosed to the department of inspections, appeals, and licensing and to law enforcement authorities.
(7) Service referrals. Information concerning clients may be shared with purchase of service providers under contract to the department.
a. Information concerning the client's circumstances and need for service is shared with prospective providers to obtain placement for the client. If the client is not accepted for service, all written information released to the provider shall be returned to the department.
b. When the information needed by the provider is mental health information or substance abuse information, the subject's specific consent is required.
(8) Medicaid billing. Only the following information shall be released to bona fide providers of medical services in the event that the provider is unable to obtain it from the subject and is unable to complete the Medicaid claim form without it:
a. Patient identification number.
b. Health coverage code as reflected on the subject's medical card.
c. The subject's date of birth.
d. The subject's eligibility status for the month that the service was provided.
e. The amount of spenddown.
f. The bills used to meet spenddown.
(9) Reserved.
(10) Child support recovery. The child support recovery unit has access to information from most department records for the purpose of establishing and enforcing support obligations. Information about absent parents and recipients of child support services is released according to the provisions of Iowa Code chapters 234, 252A, 252B, 252C, 252D, 252E, 252F, 252G, 252H, 252I, 252J, 252K, 598, and 600B and any other support chapter. Information is also released to consumer reporting agencies as specified in rule 441-98.116 (252B).
(11) Refugee resettlement program. Contacts with both sponsor and resettlement agencies are made as a part of the verification process to determine eligibility or the amount of assistance. When a refugee applies for cash or Medicaid, the refugee's name, address, and telephone number are given to the refugee's local resettlement agency.
(12) Abuse investigation. The central abuse registry disseminates child abuse information and dependent adult abuse information as provided in Iowa Code sections 235A.15 and 235B.7, respectively. Reports of child abuse and dependent adult abuse investigations are submitted to the county attorney as required in Iowa Code sections 232.71B and 235B.3. Results of the investigation of a report by a mandatory reporter are communicated to the reporter as required in Iowa Code sections 235A.17(2) and 235A.15(2) "b" (5).
(13) Foster care. Information concerning a child's need for foster care is shared with foster care review committees or foster care review boards and persons named in the case permanency plan.
(14) Adoption. Adoptive home studies completed on families who wish to adopt a child are released to licensed child-placing agencies, to the United States Immigration and Naturalization Service, and to adoption exchanges. Information is released from adoption records as provided in Iowa Code sections 600.16 and 600.24.
(15) Disclosures to law enforcement.
a. Disclosures by workforce members who are crime victims. The department is not considered to have violated the requirements of this chapter if a member of its workforce who is the victim of a criminal act discloses confidential information to a law enforcement official, provided that:
(1) The confidential information disclosed is about the suspected perpetrator of the criminal act and intended for identification and location purposes; and
(2) The confidential information disclosed is limited to the following information:
1. Name and address.
2. Date and place of birth.
3. Social security number.
4. ABO blood type and Rh factor.
5. Type of injury.
6. Date and time of treatment.
7. Date and time of death, if applicable.
8. A description of distinguishing physical characteristics, including height, weight, gender, race, hair and eye color, presence or absence of facial hair (beard or moustache), scars, and tattoos.
b. Crime on premises. The department may disclose to a law enforcement official protected health information that the department believes in good faith constitutes evidence of criminal conduct that occurred on the premises of the department.
c. Decedents. The department may disclose protected health information to a law enforcement official about a subject who has died when the death resulted from child abuse or neglect or the death occurred in a department facility.
d. Other. The department may disclose confidential information to a law enforcement official when otherwise required or allowed by this chapter, such as disclosures about victims of child abuse or neglect; disclosures to avert a threat to health or safety, or to report suspected fraud; disclosures required by due process of law, such as disclosures for judicial and administrative proceedings; or other disclosures required by law.
(16) Response to law enforcement. The address of a current recipient of family investment program benefits may be released upon request to a federal, state or local law enforcement officer if the officer provides the name of the recipient, and the officer demonstrates that:
a. The recipient is a fugitive felon who is fleeing prosecution, custody or confinement after conviction under state or federal law, or who is a probation or parole violator under state or federal law, or
b. The recipient has information that is necessary for the officer to conduct the officer's official duties, and
c. The location or apprehension of the recipient is within the officer's official duties.
(17) Research. Disclosure is made to employees of federal, state and local agencies and other researchers for purposes of bona fide research. The department shall not release data or information pursuant to this paragraph unless the department and the researcher have executed an agreement that includes the conditions under which the confidential data or information may be used and restrictions on further disclosure of the data or information.
a. Mental health information may be disclosed for purposes of scientific research as provided in Iowa Code sections 228.5 and 229.25. Requests to do research involving records of a department facility shall be approved by the designated authority.
b. Abuse registry information may be disclosed for research purposes as provided in rules 441-175.42 (235A) and 441-176.12(235B) and authorized by Iowa Code sections 235A.15(2)"e"(1) and 235B.6(2)"e"(1).
c. For research relating to protected health information, the researcher shall provide the department with information about the nature of the research, the protocol, the type of information being requested, and any other relevant information that is available concerning the request. If the researcher feels that contact with the subject is needed, the researcher shall demonstrate to the department that the research cannot be conducted without contact with the subject. The researcher shall pay for the costs of obtaining authorizations needed to contact the subjects and for the cost of files and preparation needed for the research.
(18) Threat to health or safety.
a. All programs. A client's name, identification, location, and details of a client's threatened or actual harm to department staff or property may be reported to law enforcement officials. Other information regarding the client's relationship to the department shall not be released. When a department staff person believes a client intends to harm someone, the staff person may warn the intended victim or police or both. Only the name, identification, and location of the client and the details of the client's plan of harm shall be disclosed.
b. Protected health information. The department will follow the disclosure standards in 45 CFR § 164.512 as amended to January 6, 2016.
(19) Required by law.
a. Information is shared with other agencies without a contract or written agreement when federal law or regulations require it.
b. The department may use or disclose protected health information to the extent that use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of the law.
c. State law shall preempt rules in this chapter about protected health information when any one of the following conditions exists:
(1) Exception granted by Secretary of Health and Human Services under 45 CFR § 160.204 as amended to March 26, 2013.
(2) State law more stringent. The provision of state law relates to the privacy of protected health information and is more stringent than a requirement of this chapter, within the meaning of "more stringent" found at 45 CFR § 160.202 as amended to March 26, 2013.
(3) Reporting requirements. The provision of state law, including state procedures established under the law, as applicable, provides for the reporting of disease or injury, child abuse, birth, or death, or for the conduct of public health surveillance, investigation, or intervention.
(4) Requirements related to audits, monitoring, evaluation, licensing, and certification. The provision of state law requires a health plan to report, or to provide access to, information for the purpose of management audits, financial audits, program monitoring and evaluation, or the licensure or certification of facilities and persons.
(20) Treatment, payment, or health care operations.
a. The department may use or disclose protected health information for treatment, payment, or health care operations, as permitted by 45 CFR § 164.506 as amended to January 25, 2013, except for psychotherapy notes, which are subject to the limits described in paragraph 9.10(21)"b." The use or disclosure shall be consistent with other applicable requirements of this chapter.
b. The department may use or disclose psychotherapy notes without an authorization for any one of the following reasons:
(1) To carry out the following treatment, payment, or health care operations:
1. Use by the originator of the psychotherapy notes for treatment.
2. Use or disclosure by the department for its own training programs in which students, trainees, or practitioners in mental health learn under supervision to practice or improve their skills in group, joint, family, or individual counseling.
3. Use or disclosure by the department to defend itself in a legal action or other proceeding brought by the subject.
(2) When required by the Secretary of Health and Human Services to investigate or determine the department's compliance with federal HIPAA regulations.
(3) For health oversight activities with respect to the oversight of the originator of the psychotherapy notes.
(4) When necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public as described in this chapter.
(5) When required by law as described in this chapter.
(6) To disclose protected health information in the designated record set to a coroner or medical examiner as described in this chapter.
(21) Other uses and disclosures for which an authorization or opportunity to agree or object is not required. The department may use or disclose protected health information for which an authorization or opportunity to agree or object is not required, as permitted by 45 CFR § 164.512 as amended to January 25, 2013.
(22) Victims of domestic violence. The department shall disclose confidential information about an individual whom the department reasonably believes to be a victim of domestic violence when required by state law.
(23) Whistle blowers. The department is not considered to have violated the requirements of this chapter when a member of its workforce or a business associate discloses protected health information, provided that:
a. The workforce member or business associate has a good-faith belief that the department or a business associate has engaged in conduct that is unlawful or otherwise violates professional or clinical standards, or has provided care, services, or conditions that potentially endanger one or more patients, workers, or the public; and
b. The disclosure is made to one of the following:
(1) A health oversight agency or public health authority authorized by law to investigate or oversee conduct or conditions for the purpose of reporting the allegation of failure to meet professional standards or misconduct.
(2) An appropriate health care accreditation organization.
(3) An attorney retained by or on behalf of the workforce member or business associate for the purpose of determining the legal options of the workforce member or business associate.
(24) Secondary to a use or disclosure of protected health information. The department may use or disclose protected health information that is secondary to a use or disclosure otherwise permitted or required by these rules, such as when a visitor in a facility overhears a doctor speaking to a subject about the subject's health.
(25) De-identified data or a limited data set. The department may use or disclose protected health information to create information that is de-identified or a limited data set under the conditions specified in 45 CFR § 164.514 as amended to August 14, 2002.