HITECH § Prohibition on covered entity or business associate “A 13405(d)(1) Sale of Electronic shall not directly or indirectly receive Health Records remuneration in exchange for any or Protected protected health information of an Health individual unless the covered entity Information obtained from the individual . . . a valid authorization that includes . . . a specification of whether the PHI can be further exchanged for remuneration by the entity receiving PHI of that individual” HITECH § Exception for Not applicable if purpose of the “the 13405(d)(2)(B) Research exchange is for research [as defined under HIPAA] and the price charged reflects the costs of preparation and transmittal of the data for such purpose” HITECH § Exception for Not applicable if purpose of the “the Treatment exchange is for the treatment of the individual, subject to any regulation that [OCR] may promulgate to prevent protected health information from inappropriate access, use, or disclosure”
HITECH § 13405(d)(1) Prohibition on Sale of Electronic Health Records or Protected Health Information “A covered entity or business associate shall not directly or indirectly receive remuneration in exchange for any protected health information of an individual unless the covered entity obtained from the individual . . . a valid authorization that includes . . . a specification of whether the PHI can be further exchanged for remuneration by the entity receiving PHI of that individual” HITECH § 13405(d)(2)(B) Exception for Research Not applicable if “the purpose of the exchange is for research [as defined under HIPAA] and the price charged reflects the costs of preparation and transmittal of the data for such purpose” HITECH § Exception for Treatment Not applicable if “the purpose of the exchange is for the treatment of the individual, subject to any regulation that [OCR] may promulgate to prevent protected health information from inappropriate access, use, or disclosure”
CITL-HITECH-HIPAA-Gap-Analysis.docx