Yes, protected health information can be shared, but it requires proper authorization. The Alliant Authorization To Release To Share Protected Health Information (PHI) ensures that individuals consent to the release of their health information. This process protects patient privacy and promotes transparency. Using our platform, you can easily manage and facilitate these authorizations.

An inadvertent disclosure is an event where a health professional unintentionally reveals protected health information (PHI) to an unauthorized person by mistake. Inadvertent disclosures and breach notifications. Generally, if PHI is disclosed to unauthorized personnel, a breach of PHI is presumed to have occurred.

A covered entity is permitted, but not required, to use and disclose protected health information, without an individual's authorization, for the following purposes or situations: (1) To the Individual (unless required for access or accounting of disclosures); (2) Treatment, Payment, and Health Care Operations; (3) ...

Generally, under the HIPAA Privacy Rule, covered entities and business associates may not engage in a sale of an individual's protected health information (PHI) without the individual's prior written authorization to do so.

A HIPAA authorization is consent obtained from an individual that permits a covered entity or business associate to use or disclose that individual's protected health information to someone else for a purpose that would otherwise not be permitted by the HIPAA Privacy Rule.

More generally, HIPAA allows the release of information without the patient's authorization when, in the medical care providers' best judgment, it is in the patient's interest. Despite this language, medical care providers are very reluctant to release information unless it is clearly allowed by HIPAA.

A covered entity must obtain the individual's written authorization for any other use or disclosure of PHI, including the marketing and sale of PHI. Individual authorization must be received before using PHI for marketing communications that encourage recipients to purchase or use a product or service.

If you do decide to obtain consent, you have complete discretion to design a process that best suits your needs. By contrast, the Privacy Rule requires an "authorization" for uses and disclosure of protected health information not otherwise allowed by the rule.

Waiver of the HIPAA authorization requirement from the IRB. A waiver is a request to forgo the authorization requirement based on the fact that the disclosure of PHI involves minimal risk to the participant and the research cannot practically be done without access to/use of PHI.