What is the requirement for the return or destruction of protected health information (PHI)?
The Privacy Rule requires the return or destruction of all PHI at the termination of a contract only where feasible or permitted by law. When return or destruction is not feasible, the contract must state that the information will remain protected as long as maintained and any further use of this information will be limited to those purposes that make return or destruction infeasible.
Related Questions
- We occasionally need to courier protected health information (PHI) such as original x-rays to another location. Do we need a business associate agreement with each courier service?
- Who determines the minimum necessary when I receive a request for protected health information (PHI)?
- How will National Jewish Health use my protected health information (PHI)?
