--- title: "45 CFR 164.506 HIPAA: Uses and disclosures to carry out treatment, payment, or health care operations" canonical: "https://dposchool.com/hipaa/section/164.506" source: "https://www.ecfr.gov/current/title-45/section-164.506" source_note: "Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR." text_as_of: "2026-10-29" language: "en" publisher: "DPO School" --- 45 CFR 164.506 HIPAA · Part 164: SECURITY AND PRIVACY · Subpart E: Privacy of Individually Identifiable Health Information # 45 CFR 164.506 HIPAA: Uses and disclosures to carry out treatment, payment, or health care operations eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. ## Official text ### 45 CFR 164.506(a) **(a)** Standard: Permitted uses and disclosures. Except with respect to uses or disclosures that require an authorization under § 164.508(a)(2) through (4) or that are prohibited under § 164.502(a)(5)(i), a covered entity may use or disclose protected health information for treatment, payment, or health care operations as set forth in paragraph (c) of this section, provided that such use or disclosure is consistent with other applicable requirements of this subpart. ### 45 CFR 164.506(b) **(b)** Standard: Consent for uses and disclosures permitted. (1) A covered entity may obtain consent of the individual to use or disclose protected health information to carry out treatment, payment, or health care operations. #### 45 CFR 164.506(b)(2) **(2)** Consent, under paragraph (b) of this section, shall not be effective to permit a use or disclosure of protected health information when an authorization, under § 164.508, is required or when another condition must be met for such use or disclosure to be permissible under this subpart. ### 45 CFR 164.506(c) **(c)** Implementation specifications: Treatment, payment, or health care operations. (1) A covered entity may use or disclose protected health information for its own treatment, payment, or health care operations. #### 45 CFR 164.506(c)(2) **(2)** A covered entity may disclose protected health information for treatment activities of a health care provider. #### 45 CFR 164.506(c)(3) **(3)** A covered entity may disclose protected health information to another covered entity or a health care provider for the payment activities of the entity that receives the information. #### 45 CFR 164.506(c)(4) **(4)** A covered entity may disclose protected health information to another covered entity for health care operations activities of the entity that receives the information, if each entity either has or had a relationship with the individual who is the subject of the protected health information being requested, the protected health information pertains to such relationship, and the disclosure is: ##### 45 CFR 164.506(c)(4)(i) **(i)** For a purpose listed in paragraph (1) or (2) of the definition of health care operations; or ##### 45 CFR 164.506(c)(4)(ii) **(ii)** For the purpose of health care fraud and abuse detection or compliance. #### 45 CFR 164.506(c)(5) **(5)** A covered entity that participates in an organized health care arrangement may disclose protected health information about an individual to other participants in the organized health care arrangement for any health care operations activities of the organized health care arrangement. ## Source Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR. Source credit: \[67 FR 53268, Aug. 14, 2002, as amended at 78 FR 5698, Jan. 25, 2013\] [45 CFR 164.506 on eCFR](https://www.ecfr.gov/current/title-45/section-164.506) eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. This is reference material, not legal advice. ## Navigation [HIPAA Navigator](https://dposchool.com/hipaa) / 45 CFR 164.506 Previous: [45 CFR 164.504 HIPAA: Uses and disclosures: Organizational requirements](https://dposchool.com/hipaa/section/164.504) Next: [45 CFR 164.508 HIPAA: Uses and disclosures for which an authorization is required](https://dposchool.com/hipaa/section/164.508) ## For AI agents - Machine-readable index: https://dposchool.com/hipaa/llms.txt - JSON API: https://dposchool.com/hipaa/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents