§164.510(a) Standard: Use and disclosure for facility directories. (1) Permitted uses and disclosure. Except when an objection is expressed in accordance with paragraph (a)(2) or (3) of this section, a covered health care provider may:
(i) Use the following protected health information to maintain a directory of individuals in its facility:
(A) The individual’s name;
(B) The individual’s location in the covered health care provider’s facility;
(C) The individual’s condition described in general terms that does not communicate specific medical information about the individual; and
(D) The individual’s religious affiliation; and
(ii) Use or disclose for directory purposes such information:
(A) To member of the clergy; or
(B) Except for religious affiliation, to other persons who ask for the individual by name.
(2) Opportunity to object. A covered health care provider must inform an individual of the protected health information that it may include in a directory and the persons to whom it may disclose such information (including disclosures to clergy of information regarding religious affiliation) and provide the individual with the opportunity to restrict or prohibit some or all of the uses or disclosures permitted by paragraph (a)(1) of this section.
Audit Inquiry
Does the entity maintain a directory of individuals in its facility?
Obtain and review policies and procedures that address determining if the individual has objected to uses and disclosures for facility directories and for documenting such determination.
Obtain and review a sample of the directory of individuals in the entity’s facility that exists on the specified date and related documentation of individual objections. Evaluate the content against documentation of individual objections and against the listed content criteria.