Guidance on Allowable Uses and Disclosures of PHI to Health Plans for Patient Care Coordination

The Department of Health and Human Services’ Office for Civil Rights publicized a new HIPAA guidance for health plans concerning the appropriate sharing of protected health information (PHI) to aid in patient care coordination and continuity of patient healthcare.

The guidance uses an FAQ format. It tackles two questions most frequently asked by health plans.

1 – Is disclosure of PHI to another health plan allowed for patient care coordination?

The HIPAA Privacy Rule allows PHI use and disclosure to facilitate healthcare treatments, hence it is permitted to share PHI to a covered entity or health plan if needed so that the entity could move forward with the healthcare treatment. PHI may similarly be shared with a health plan so that a recipient can have the needed healthcare operations so long as these conditions are met:

There is a treatment relationship between the two entities and the patient
The disclosure concerns that treatment relationship
The HIPAA allows the healthcare procedure as stipulated in 45 CFR 164.502(a)(1)(ii); 45 CFR 164.506(c)(4)

The HIPAA permits ‘healthcare operations’ such as case management and coordination of health care, thus PHI disclosure is permitted even with no prior patient authorization. Nonetheless, any disclosure should be limited to the least permitted information.

2 – Is it okay for a health plan to use and disclose PHI to inform a person about other offered health plans with no authorization? Is this permitted if PHI was obtained for another reason?

Using and disclosing PHI for the sake of marketing is generally not permitted without obtaining authorization. Using PHI to let a person know about offers of a different health plan could be regarded as marketing and hence is permitted only with proper authorization.

The only exemption to the marketing rule is to conduct face-to-face marketing communications. – 5 CFR 164.508(a)(3)(i). HIPAA furthermore permits marketing communications related to replacements to, or enhancements of, present health plans, given that there is no monetary remuneration given to the covered entity in exchange for the communications. (45 CFR 164.506(c)(1) and 45 CFR 164.501). It is moreover permitted to use PHI that was obtained for another purpose when the conditions mentioned above are achieved.

Learn about the new OCR FAQ on this page.

Elizabeth Hernandez

Elizabeth Hernandez is the editor of HIPAA News section of HIPAA Coach and an experienced journalist in the healthcare sector. She specializes in healthcare and HIPAA compliance, making her a go-to source for information on healthcare regulations. Her work focuses on the importance of patient privacy and secure information handling. Elizabeth also has a postgraduate degree in journalism. Follow on Twitter: You can follow Elizabeth on twitter at