What HIPAA Provides

A covered entity may not use or disclose protected health information, except as permitted or required …
- pursuant to … a consent … to carry out treatment, payment, or health care operations
- pursuant to … an authorization
- pursuant to … an agreement (opt-in)
- [other provisions] 45 CFR §164.502
Health information that meets … specifications for de-identification … is considered not to be individually identifiable health information 45 CFR §164.502(d)

A covered entity may not use or disclose protected health information, except as permitted or required …