| (a) Unless the law requires otherwise, DHS will disclose only the individually identifiable health information needed to accomplish the purpose for which the information is sought. (b) DHS will not disclose individually identifiable health information when the purpose of the disclosure can be accomplished with de-identified health information, unless the law says otherwise. (c) DHS will not disclose an entire medical record unless the entire medical record is justified as the amount of information needed for the purpose of the disclosure or the law says otherwise. (d) When a disclosure is not routine and recurring, DHS will use the following criteria to decide how much individually identifiable health information to disclose: (1) the purpose of the disclosure; (2) how much the disclosure threatens privacy, including: (A) the amount of individually identifiable health information to be disclosed; (B) the amount of identifying information to be disclosed; (C) how much the disclosure would increase the number of individuals or entities that have the individually identifiable health information; and (D) the chance that more uses or disclosures of the individually identifiable health information could happen; (3) DHS's ability to limit the disclosure, including: (A) whether the information is in electronic or paper form; and (B) the ease with which certain fields or data elements can be removed from the information released; (4) the cost of limiting the disclosure; and (5) the importance of the disclosure. |
