Exam CIPP-US topic 1 question 216 discussion

The correct answer is: A. Disclosures to law enforcement. Reference: HHS HIPAA Privacy Rule Final Rule to Support Reproductive Health Care Privacy: Fact Sheet Disclosures to Law Enforcement The Privacy Rule permits uses or disclosures of PHI without an individual’s authorization only where such uses or disclosures are expressly permitted or required by the Privacy Rule. As explained in OCR guidance, the Privacy Rule permits, but does not require, certain disclosures to law enforcement and others, subject to specific conditions. Thus, covered health care providers, health plans, and health care clearinghouses (and business associates), including their workforce members, are only permitted to disclose PHI for law enforcement purposes where they suspect an individual of obtaining reproductive health care (lawful or otherwise) if the covered entity or business associate is required by law to do so and all applicable conditions are met.