Under HIPAA, a covered entity may disclose PHI without authorization for all of the following EXCEPT:

Under HIPAA, a covered entity may disclose PHI without authorization for all of the following EXCEPT:

• A. Data that does not cross state lines when disclosed by the covered entity.
• B. Data disclosed for treatment, payment, or health care operations.
• C. Data disclosed for research with a data use agreement.
• D. Data disclosed when required by law.

Answer: (A)

The main idea here is that HIPAA allows certain PHI disclosures without patient authorization, but only for specific purposes. Those include sharing information to support the patient’s treatment, to handle payment and health care operations, disclosures for research when there’s a data use agreement (or if the data are adequately de-identified), and disclosures when a law requires it. Data sharing simply because the information does not cross state lines isn’t a recognized basis for a permitted disclosure under HIPAA. The ability to disclose without authorization depends on the purpose and the applicable HIPAA provisions, not on geographic crossing. Therefore, the option stating data that does not cross state lines can be disclosed without authorization is the one that does not fit the HIPAA allowances, making it the exception.

The main idea here is that HIPAA allows certain PHI disclosures without patient authorization, but only for specific purposes. Those include sharing information to support the patient’s treatment, to handle payment and health care operations, disclosures for research when there’s a data use agreement (or if the data are adequately de-identified), and disclosures when a law requires it.

Data sharing simply because the information does not cross state lines isn’t a recognized basis for a permitted disclosure under HIPAA. The ability to disclose without authorization depends on the purpose and the applicable HIPAA provisions, not on geographic crossing. Therefore, the option stating data that does not cross state lines can be disclosed without authorization is the one that does not fit the HIPAA allowances, making it the exception.