SECTION 340:2-8-6. Uses and disclosures without authorization

  Unless prohibited or limited by federal or state laws, per Section 164.512 of Title 45 of the Code of Federal Regulations, Oklahoma Department of Human Services (DHS) staff may use or disclose protected health information (PHI) without written authorization, per (1) through (11) of this Section.

(1)   Individual access. DHS staff may disclose information to individuals who request disclosure of their own PHI, per Oklahoma Administrative Code 340:2-8-4(a)(1).

(2)   Required by law. DHS staff may use or disclose PHI without authorization when the law requires such disclosure and the use or disclosure complies with, and is limited to, the relevant requirements of such law.

(3)   Treatment, payment, or health care operations. DHS staff may use or disclose PHI without authorization:

(A)   for its own treatment, payment, or health care operations; or

(B)   to another covered entity or health care provider for the payment activities of the entity that receives the PHI

(4)   Psychotherapy notes. DHS staff may use or disclose psychotherapy notes generated by DHS:

(A)   in training programs where students, trainees, or practitioners in mental health services learn, under supervision, to practice or improve their skills;

(B)   when a health oversight agency uses or discloses in connection with oversight of the originator of the notes; or

(C)   to the extent authorized under state law to defend DHS in a legal action or other proceeding brought by an individual.

(5)   Public health activities. DHS staff may disclose an individual's PHI to appropriate entities or persons for governmental public health activities and purposes including, but not limited to, a:

(A)   governmental, public-health authority authorized by law to collect or receive the PHI for the purpose of preventing or controlling disease, injury, or disability. This includes reporting vital events, such as:

(i)   births and deaths; or

(ii)   abuse or neglect of a vulnerable adult;

(B)   governmental, public health authority or other appropriate government authority authorized by law to receive child abuse or neglect reports; or

(C)   person who may have been exposed to a communicable disease or may be at risk of contracting or spreading a disease or condition, when DHS is authorized by law to notify such person as necessary in conducting a public health intervention or investigation.

(6)   Health oversight activities. DHS staff may disclose PHI for health oversight activities authorized by law, including audits; civil, criminal, or administrative investigations, prosecutions, or actions; licensing or disciplinary actions; SoonerCare (Medicaid) fraud; or other activities necessary for oversight.

(7)   Judicial and administrative proceedings. Unless prohibited by applicable federal and state law, DHS staff may disclose PHI for judicial or administrative proceedings as required by law, in response to a court order, a subpoena, a discovery request, or other lawful process.

(8)   Law enforcement purposes. DHS staff discloses PHI only when required by federal or state laws.

(9)   Deceased persons. DHS staff discloses PHI to a coroner or medical examiner only when required by federal or state laws.

(10)   Organ or tissue donation. When a client is an organ donor, DHS staff may disclose PHI to an entity that participates in transplantation activities.

(11)   To avert a serious threat to health or safety. DHS staff discloses PHI, when:

(A)   he or she believes in good faith that the PHI is necessary to prevent or lessen a serious or imminent threat to the health or safety of a person or the public; and

(B)   the report is disclosed to a person(s) reasonably able to prevent or lessen a serious or imminent threat to the health or safety of a person or the public, including the target of the threat.

[Source: Added at 20 Ok Reg 2907, eff 8-21-03 (emergency); Added at 21 Ok Reg 784, eff 4-26-04; Amended at 36 Ok Reg 1777, eff 9-16-19]