Community QuestionSeen on 6 CBTs
A covered entity may use or disclose PHI without an authorization, or documentation of a waiver or an alteration of authorization, for all of the following EXCEPT:
Community-sourced. Answers may be wrong or out of date. Always verify with your official training portal before submitting. Not affiliated with any branch, agency, or vendor. Details.
Answer
Data that does not cross state lines when disclosed by the covered entity.
Alternate answers seen on other CBTs
The same question shows up worded slightly differently across CBT versions. Here are the other answer variants we've indexed.
An organizational IRB or Privacy Board, privacy official ("Privacy Officer"), or security official ("Security Officer"), depending on the issue.
The Hipaa Minimum Necessary Standard Applies Citi →