Privacy Notice Required Content - No Limitation to Avert Serious Threat, v1.0

Specifies requirements for part of the contents of the privacy notice for individuals. If the organization limits uses or disclosures more than provided by the privacy notice requirements, the organization may not include in its notice a limitation affecting its right to make a use or disclosure to avert a serious threat to health or safety.
This assessment is only applicable if the covered entity describes more limited uses or disclosures in its privacy notice than provided by the privacy notice requirements in Section 164.520(b)(1).

Assessment Step

1
Content of Notice (ContentofNotice)
Does the covered entity's privacy notice NOT include in its notice a limitation affecting its right to make a use or disclosure to prevent or lessen a serious and imminent threat to the health or safety of a person or the public and the use or disclosure is to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat?
Artifact
PrivacyNotice
Provide evidence (e.g. organizational policies, procedures, compliance/assessment reports, etc.), including the actual notice of privacy practices, that support the assessor's response to this assessment step.
The criteria apply to descriptions of uses and disclosures of protected health information in the privacy notice provided to individuals by the covered entity.


The following are exceptions to an individual's right to adequate notice of the uses and disclosures of PHI that may be made by the covered entity, and of the individual's rights and the covered entity's legal duties with respect to PHI:

  1. Group health plans that do not create or receive PHI other than summary health information (see Section 164.520(a)(2) for additional details); and
  2. An inmate does not have a right to notice under this section, and the requirements of this section do not apply to a correctional institution that is a covered entity.

Conformance Criteria (1)

Include Required Content
If the covered entity describes more limited uses or disclosures in its privacy notice than provided by the privacy notice requirements (section 164.520(b)(1)), the covered entity may not include in its notice a limitation affecting its right to make a use or disclosure that is permitted by Section 164.512(j)(1)(i) to prevent or lessen a serious and imminent threat to the health or safety of a person or the public and use or disclosure is to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat.
Citation
HIPAA-Privacy-Rule
45 CFR Section 164.520(b)(2) and Section 164.512(j)(1)(i)