Appeals for money, sponsorship of events, etc. for the benefit of a covered entity. HIPAA allows the disclosure of protected health information for this purpose without an individual’s authorization.

The use of an algorithmic process to transform data into a form in which there is a low probability of assigning meaning without use of a confidential process or key.

FAQs Archive

Q: Does the HIPAA Privacy Rule limit an individual’s ability to gather and share family medical history information?

No. The HIPAA Privacy Rule may limit how a covered entity (for example, a health plan or most health care providers) uses or discloses individually identifiable health information, but does not prevent individuals, themselves, from gathering medical information about their family members or from deciding to share this information with family members or others, including their health care providers. Thus, individuals are free to provide their doctors with a complete family medical history or communicate with their doctors about conditions that run in the family.

Q: Does the HIPAA Privacy Rule require covered entities to keep patients’ medical records for any period of time?

No, the HIPAA Privacy Rule does not include medical record retention requirements. Rather, State laws generally govern how long medical records are to be retained. However, the HIPAA Privacy Rule does require that covered entities apply appropriate administrative, technical, and physical safeguards to protect the privacy of medical records and other protected health information ( PHI ) for whatever period such information is maintained by a covered entity, including through disposal. See 45 CFR 164.530(c) .