[Code of Federal Regulations]
[Title 45, Volume 1]
[Revised as of October 1, 2001]
From the U.S. Government Printing Office via GPO Access
[CITE: 45CFR164.532]

[Page 728-729]
 
                        TITLE 45--PUBLIC WELFARE
 
                    SUBTITLE A--DEPARTMENT OF HEALTH
                           AND HUMAN SERVICES
 
PART 164--SECURITY AND PRIVACY--Table of Contents
 
   Subpart E--Privacy of Individually Identifiable Health Information
 
Sec. 164.532  Transition provisions.

    (a) Standard: Effect of prior consents and authorizations. 
Notwithstanding other sections of this subpart, a covered entity may 
continue to use or disclose protected health information pursuant to a 
consent, authorization, or other express legal permission obtained from 
an individual permitting the use or disclosure of protected health 
information that does not comply with Secs. 164.506 or 164.508 of this 
subpart consistent with paragraph (b) of this section.
    (b) Implementation specification: Requirements for retaining 
effectiveness of prior consents and authorizations. Notwithstanding 
other sections of this subpart, the following provisions apply to use or 
disclosure by a covered entity of protected health information pursuant 
to a consent, authorization, or other express legal permission obtained 
from an individual permitting the use or disclosure of protected health 
information, if the consent, authorization, or other express legal 
permission was obtained from an individual before the applicable 
compliance date of this subpart and does not comply with Secs. 164.506 
or 164.508 of this subpart.
    (1) If the consent, authorization, or other express legal permission 
obtained from an individual permits a use or disclosure for purposes of 
carrying out treatment, payment, or health care operations, the covered 
entity may, with respect to protected health information that it created 
or received before the applicable compliance date of this subpart and to 
which the consent, authorization, or other express legal permission 
obtained from an individual

[[Page 729]]

applies, use or disclose such information for purposes of carrying out 
treatment, payment, or health care operations, provided that:
    (i) The covered entity does not make any use or disclosure that is 
expressly excluded from the a consent, authorization, or other express 
legal permission obtained from an individual; and
    (ii) The covered entity complies with all limitations placed by the 
consent, authorization, or other express legal permission obtained from 
an individual.
    (2) If the consent, authorization, or other express legal permission 
obtained from an individual specifically permits a use or disclosure for 
a purpose other than to carry out treatment, payment, or health care 
operations, the covered entity may, with respect to protected health 
information that it created or received before the applicable compliance 
date of this subpart and to which the consent, authorization, or other 
express legal permission obtained from an individual applies, make such 
use or disclosure, provided that:
    (i) The covered entity does not make any use or disclosure that is 
expressly excluded from the consent, authorization, or other express 
legal permission obtained from an individual; and
    (ii) The covered entity complies with all limitations placed by the 
consent, authorization, or other express legal permission obtained from 
an individual.
    (3) In the case of a consent, authorization, or other express legal 
permission obtained from an individual that identifies a specific 
research project that includes treatment of individuals:
    (i) If the consent, authorization, or other express legal permission 
obtained from an individual specifically permits a use or disclosure for 
purposes of the project, the covered entity may, with respect to 
protected health information that it created or received either before 
or after the applicable compliance date of this subpart and to which the 
consent or authorization applies, make such use or disclosure for 
purposes of that project, provided that the covered entity complies with 
all limitations placed by the consent, authorization, or other express 
legal permission obtained from an individual.
    (ii) If the consent, authorization, or other express legal 
permission obtained from an individual is a general consent to 
participate in the project, and a covered entity is conducting or 
participating in the research, such covered entity may, with respect to 
protected health information that it created or received as part of the 
project before or after the applicable compliance date of this subpart, 
make a use or disclosure for purposes of that project, provided that the 
covered entity complies with all limitations placed by the consent, 
authorization, or other express legal permission obtained from an 
individual.
    (4) If, after the applicable compliance date of this subpart, a 
covered entity agrees to a restriction requested by an individual under 
Sec. 164.522(a), a subsequent use or disclosure of protected health 
information that is subject to the restriction based on a consent, 
authorization, or other express legal permission obtained from an 
individual as given effect by paragraph (b) of this section, must comply 
with such restriction.