Excerpts from 45 CFR § 164.502
Regulation Text (December 28, 2000) as amended May 31, 2002 and August 14, 2002
§ 164.502 Uses and disclosures of protected health information: general rules.
(a) Standard. A covered entity may not use or disclose protected health information, except as permitted or required by this subpart or by subpart C of part 160 of this subchapter.
(1) Permitted uses and disclosures. A covered entity is permitted to use or disclose protected health information as follows:
* * *
(vi) As permitted by and in compliance with this section, § 164.512 , or § 164.514(e), (f), or (g).
* * *
(b) Standard: minimum necessary.
(1) Minimum necessary applies. When using or disclosing protected health information or when requesting protected health information from another covered entity, a covered entity must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request.
(2) Minimum necessary does not apply.
This requirement does not apply to:
* * *
(v) Uses or disclosures that are required by law, as described by § 164.512(a) ; and
* * *