Unattributed Code Systems

• http://snomed.info/sct
• http://unstats.un.org/unsd/methods/m49/m49.htm
• urn:iso:std:iso:3166

Copyright Fragment

This fragment is not visible to the reader

Copyright and Registered Trademark Uses

• IG © 2020+ HL7 International - Vocabulary Work Group. Package hl7.terminology#7.4.0 based on FHIR 5.0.0. Generated 2026-09-20 Links: Table of Contents | QA Report | Version History external | external | Propose a change external ( src )
• CMS Certification Numbers - HL7 Terminology (THO) v7.4.0 h2{--heading-prefix:"10.3509"} h3,h4,h5,h6{--heading-prefix:"10.3509"} Visit the HL7 website HL7 Terminology (THO) 7.4.0 - Publication International flag FHIR * Home * HL7 Code Systems * Value Sets * Concept Maps * External Content * Documentation * Change History * Downloads * Table of Contents * Artifacts Summary * CMS Certification Numbers HL7 Terminology (THO), published by HL7 International - Vocabulary Work Group. This guide is not an authorized publication; it is the continuous build for version 7.4.0 built by the FHIR (HL7® FHIR® Standard) CI Build. This version is based on the current content of https://github.com/HL7/UTG/ and changes regularly. See the Directory of published versions * Narrative Content * XML * JSON * TTL * History NamingSystem: CMS Certification Numbers Official URL: http://terminology.hl7.org/NamingSystem/CCN Version: 1.0.0 Highlight text changes? Active as of 2021-11-01 Responsible: Centers for Medicare & Medicaid Services (CMS) /td> Computable Name: CCN Per CMS Transmittal 29 dated OCTOBER 12, 2007: "The National Provider Identifier (NPI) will replace the Medicare/Medicaid Provider Number on Medicare claims. The NPI will assume the Medicare/Medicaid Provider Number's role as a primary identifier. However, the Medicare/Medicaid Provider Number will continue to be issued to providers and used to verify Medicare/Medicaid certification on all survey and certification, and resident/patient assessment transactions. In order to avoid confusion with the NPI, the Medicare/Medicaid Provider Number (also known as the OSCAR Provider Number, Medicare Identification Number or Provider Number) has been renamed the CMS Certification Number (CCN). The CCN continues to serve a critical role in verifying that a provider has been Medicare certified and for what type of services." See https://www.cms.gov/regulations-and-guidance/guidance/transmittals/downloads/r29soma.pdf Language: en Summary Defining URL http://terminology.hl7.org/NamingSystem/CCN Version 1.0.0 Name CCN Title CMS Certification Numbers Status active Definition Per CMS Transmittal 29 dated OCTOBER 12, 2007: "The National Provider Identifier (NPI) will replace the Medicare/Medicaid Provider Number on Medicare claims. The NPI will assume the Medicare/Medicaid Provider Number's role as a primary identifier. However, the Medicare/Medicaid Provider Number will continue to be issued to providers and used to verify Medicare/Medicaid certification on all survey and certification, and resident/patient assessment transactions. In order to avoid confusion with the NPI, the Medicare/Medicaid Provider Number (also known as the OSCAR Provider Number, Medicare Identification Number or Provider Number) has been renamed the CMS Certification Number (CCN). The CCN continues to serve a critical role in verifying that a provider has been Medicare certified and for what type of services." See https://www.cms.gov/regulations-and-guidance/guidance/transmittals/downloads/r29soma.pdf Publisher Centers for Medicare & Medicaid Services (CMS) Identifiers Type Value Preferred Period Comment OID 2.16.840.1.113883.4.336 true URI http://terminology.hl7.org/NamingSystem/CMSCertificationNumber true 2021-11-01 --> (ongoing) Official canonical URL going forward. History Date Action Author Custodian Comment 2022-01-25 create Jessica Bota HTA Add CMS Certification Numbers (CCN) per HTA; UP-253 IG © 2020+ HL7 International - Vocabulary Work Group. Package hl7.terminology#7.4.0 based on FHIR 5.0.0. Generated 2026-09-20 | external | Propose a change external Links: Table of Contents | QA Report | Version History external ( src )
• CMS Hierarchical Condition Categories - HL7 Terminology (THO) v7.4.0 h2{--heading-prefix:"10.3517"} h3,h4,h5,h6{--heading-prefix:"10.3517"} Visit the HL7 website HL7 Terminology (THO) 7.4.0 - Publication International flag FHIR * Home * HL7 Code Systems * Value Sets * Concept Maps * External Content * Documentation * Change History * Downloads * Table of Contents * Artifacts Summary * CMS Hierarchical Condition Categories HL7 Terminology (THO), published by HL7 International - Vocabulary Work Group. This guide is not an authorized publication; it is the continuous build for version 7.4.0 built by the FHIR (HL7® FHIR® Standard) CI Build. This version is based on the current content of https://github.com/HL7/UTG/ and changes regularly. See the Directory of published versions * Narrative Content * XML * JSON * TTL * History NamingSystem: CMS Hierarchical Condition Categories Official URL: http://terminology.hl7.org/NamingSystem/cmshcc Version: 1.1.0 Highlight text changes? Active as of 2024-01-26 Responsible: Centers for Medicare & Medicaid Services /td> Computable Name: CMSHCC The CMS-HCC model uses more than 9,000 ICD-10-CM codes, which are mapped to condition categories that predict costs well. The condition categories are based on diagnoses clinically related to one another and with similar predicted cost implications. Hierarchies are imposed on the condition categories to capture the most costly diagnoses. Hierarchy logic is imposed on certain condition categories to account for different hierarchical costs, thus, the term Hierarchical Condition Category, or HCC. For more information, see https://www.cms.gov/Medicare/Health-Plans/MedicareAdvtgSpecRateStats/Risk-Adjustors. The CMS HCCs are in the public domain and are free to use without restriction. Language: en Summary Defining URL http://terminology.hl7.org/NamingSystem/cmshcc Version 1.1.0 Name CMSHCC Title CMS Hierarchical Condition Categories Status active Definition The CMS-HCC model uses more than 9,000 ICD-10-CM codes, which are mapped to condition categories that predict costs well. The condition categories are based on diagnoses clinically related to one another and with similar predicted cost implications. Hierarchies are imposed on the condition categories to capture the most costly diagnoses. Hierarchy logic is imposed on certain condition categories to account for different hierarchical costs, thus, the term Hierarchical Condition Category, or HCC. For more information, see https://www.cms.gov/Medicare/Health-Plans/MedicareAdvtgSpecRateStats/Risk-Adjustors. The CMS HCCs are in the public domain and are free to use without restriction. Publisher Centers for Medicare & Medicaid Services Identifiers Type Value Preferred Period URI http://terminology.hl7.org/CodeSystem/cmshcc true 2021-12-02 --> (ongoing) OID 2.16.840.1.113883.6.349 true History Date Action Author Custodian Comment 2024-03-02 revise Jessica Bota HTA Add OID for CMS Hierarchical Condition Categories; up-515 2022-01-28 create Jessica Bota HTA Add CMS Hierarchical Condition Categories per HTA; UP-268 IG © 2020+ HL7 International - Vocabulary Work Group. Package hl7.terminology#7.4.0 based on FHIR 5.0.0. Generated 2026-09-20 | external | Propose a change external Links: Table of Contents | QA Report | Version History external ( src )
• CMS Place of Service Codes (POS) - HL7 Terminology (THO) v7.4.0 h2{--heading-prefix:"10.2548"} h3,h4,h5,h6{--heading-prefix:"10.2548"} Visit the HL7 website HL7 Terminology (THO) 7.4.0 - Publication International flag FHIR * Home * HL7 Code Systems * Value Sets * Concept Maps * External Content * Documentation * Change History * Downloads * Table of Contents * Artifacts Summary * CMS Place of Service Codes (POS) HL7 Terminology (THO), published by HL7 International - Vocabulary Work Group. This guide is not an authorized publication; it is the continuous build for version 7.4.0 built by the FHIR (HL7® FHIR® Standard) CI Build. This version is based on the current content of https://github.com/HL7/UTG/ and changes regularly. See the Directory of published versions * Narrative Content * XML * JSON * TTL * History CodeSystem: CMS Place of Service Codes (POS) Official URL: https://www.cms.gov/Medicare/Coding/place-of-service-codes/Place_of_Service_Code_Set Version: 20240502 Highlight text changes? Active as of 2025-04-26 Responsible: Centers for Medicare & Medicaid Services /td> Computable Name: CMSPlaceofServiceCodes Other Identifiers: OID:2.16.840.1.113883.15.5 Place of Service Codes are two-digit codes placed on health care professional claims to indicate the setting in which a service was provided. The Centers for Medicare & Medicaid Services (CMS) maintain POS codes used throughout the health care industry. This code set is required for use in the implementation guide adopted as the national standard for electronic transmission of professional health care claims under the provisions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). HIPAA directed the Secretary of HHS to adopt national standards for electronic transactions. These standard transactions require all health plans and providers to use standard code sets to populate data elements in each transaction. The Transaction and Code Set Rule adopted the ASC X12N-837 Health Care Claim: Professional, volumes 1 and 2, as the standard for electronic submission of professional claims. This standard names the POS code set currently maintained by CMS as the code set to be used for describing sites of service in such claims. POS information is often needed to determine the acceptability of direct billing of Medicare, Medicaid and private insurance services provided by a given provider. This Code system is referenced in the definition of the following value sets: * CMS Place of Service Codes (POS) * HealthcareServiceLocation This case-sensitive code system https://www.cms.gov/Medicare/Coding/place-of-service-codes/Place_of_Service_Code_Set defines the following codes: Code Display Definition 01 Pharmacy A facility or location where drugs and other medically related items and services are sold, dispensed, or otherwise provided directly to patients. (Effective October 1, 2003) (Revised, effective October 1, 2005) 02 Telehealth Provided Other than in Patient’s Home The location where health services and health related services are provided or received, through telecommunication technology. Patient is not located in their home when receiving health services or health related services through telecommunication technology.  (Effective January 1, 2017) (Description change effective January 1, 2022, and applicable for Medicare April 1, 2022.) 03 School A facility whose primary purpose is education. (Effective January 1, 2003) 04 Homeless Shelter A facility or location whose primary purpose is to provide temporary housing to homeless individuals (e.g., emergency shelters, individual or family shelters).  (Effective January 1, 2003) 05 Indian Health Service Free-standing Facility A facility or location, owned and operated by the Indian Health Service, which provides diagnostic, therapeutic (surgical and non-surgical), and rehabilitation services to American Indians and Alaska Natives who do not require hospitalization. (Effective January 1, 2003) 06 Indian Health ServiceProvider-based Facility A facility or location, owned and operated by the Indian Health Service, which provides diagnostic, therapeutic (surgical and non-surgical), and rehabilitation services rendered by, or under the supervision of, physicians to American Indians and Alaska Natives admitted as inpatients or outpatients. (Effective January 1, 2003) 07 Tribal 638 Free-standing Facility A facility or location owned and operated by a federally recognized American Indian or Alaska Native tribe or tribal organization under a 638 agreement, which provides diagnostic, therapeutic (surgical and non-surgical), and rehabilitation services to tribal members who do not require hospitalization.  (Effective January 1, 2003) 08 Tribal 638 Provider-based Facility A facility or location owned and operated by a federally recognized American Indian or Alaska Native tribe or tribal organization under a 638 agreement, which provides diagnostic, therapeutic (surgical and non-surgical), and rehabilitation services to tribal members admitted as inpatients or outpatients. (Effective January 1, 2003) 09 Prison/ Correctional Facility A prison, jail, reformatory, work farm, detention center, or any other similar facility maintained by either Federal, State or local authorities for the purpose of confinement or rehabilitation of adult or juvenile criminal offenders. (Effective July 1, 2006) 10 Telehealth Provided in Patient’s Home The location where health services and health related services are provided or received, through telecommunication technology. Patient is located in their home (which is a location other than a hospital or other facility where the patient receives care in a private residence) when receiving health services or health related services through telecommunication technology. (This code is effective January 1, 2022, and available to Medicare April 1, 2022.) 11 Office Location, other than a hospital, skilled nursing facility (SNF), military treatment facility, community health center, State or local public health clinic, or intermediate care facility (ICF), where the health professional routinely provides health examinations, diagnosis, and treatment of illness or injury on an ambulatory basis. 12 Home Location, other than a hospital or other facility, where the patient receives care in a private residence. 13 Assisted Living Facility Congregate residential facility with self-contained living units providing assessment of each resident's needs and on-site support 24 hours a day, 7 days a week, with the capacity to deliver or arrange for services including some health care and other services.  (Effective October 1, 2003) 14 Group Home A residence, with shared living areas, where clients receive supervision and other services such as social and/or behavioral services, custodial service, and minimal services (e.g., medication administration).  (Effective October 1, 2003) (Revised, effective April 1, 2004) 15 Mobile Unit A facility/unit that moves from place-to-place equipped to provide preventive, screening, diagnostic, and/or treatment services. (Effective January 1, 2003) 16 Temporary Lodging A short term accommodation such as a hotel, camp ground, hostel, cruise ship or resort where the patient receives care, and which is not identified by any other POS code. (Effective January 1, 2008) 17 Walk-in Retail Health Clinic A walk-in health clinic, other than an office, urgent care facility, pharmacy or independent clinic and not described by any other Place of Service code, that is located within a retail operation and provides, on an ambulatory basis, preventive and primary care services.  (This code is available for use immediately with a final effective date of May 1, 2010) 18 Worksite A location, not described by any other POS code, owned or operated by a public or private entity where the patient is employed, and where a health professional provides on-going or episodic occupational medical, therapeutic or rehabilitative services to the individual. (This code is available for use effective January 1, 2013 but no later than May 1, 2013) 19 Off Campus-Outpatient Hospital A portion of an off-campus hospital provider based department which provides diagnostic, therapeutic (both surgical and nonsurgical), and rehabilitation services to sick or injured persons who do not require hospitalization or institutionalization. (Effective January 1, 2016) 20 Urgent Care Facility Location, distinct from a hospital emergency room, an office, or a clinic, whose purpose is to diagnose and treat illness or injury for unscheduled, ambulatory patients seeking immediate medical attention.  (Effective January 1, 2003) 21 Inpatient Hospital A facility, other than psychiatric, which primarily provides diagnostic, therapeutic (both surgical and nonsurgical), and rehabilitation services by, or under, the supervision of physicians to patients admitted for a variety of medical conditions. 22 On Campus-Outpatient Hospital A portion of a hospital’s main campus which provides diagnostic, therapeutic (both surgical and nonsurgical), and rehabilitation services to sick or injured persons who do not require hospitalization or institutionalization.  (Description change effective January 1, 2016) 23 Emergency Room – Hospital A portion of a hospital where emergency diagnosis and treatment of illness or injury is provided. 24 Ambulatory Surgical Center A freestanding facility, other than a physician's office, where surgical and diagnostic services are provided on an ambulatory basis. 25 Birthing Center A facility, other than a hospital's maternity facilities or a physician's office, which provides a setting for labor, delivery, and immediate post-partum care as well as immediate care of new born infants. 26 Military Treatment Facility A medical facility operated by one or more of the Uniformed Services. Military Treatment Facility (MTF) also refers to certain former U.S. Public Health Service (USPHS) facilities now designated as Uniformed Service Treatment Facilities (USTF). 27 Outreach Site/ Street A non-permanent location on the street or found environment, not described by any other POS code, where health professionals provide preventive, screening, diagnostic, and/or treatment services to unsheltered homeless individuals. (Effective October 1, 2023) 31 Skilled Nursing Facility A facility which primarily provides inpatient skilled nursing care and related services to patients who require medical, nursing, or rehabilitative services but does not provide the level of care or treatment available in a hospital. 32 Nursing Facility A facility which primarily provides to residents skilled nursing care and related services for the rehabilitation of injured, disabled, or sick persons, or, on a regular basis, health-related care services above the level of custodial care to other than individuals with intellectual disabilities. 33 Custodial Care Facility A facility which provides room, board and other personal assistance services, generally on a long-term basis, and which does not include a medical component. 34 Hospice A facility, other than a patient's home, in which palliative and supportive care for terminally ill patients and their families are provided. 41 Ambulance - Land A land vehicle specifically designed, equipped and staffed for lifesaving and transporting the sick or injured. 42 Ambulance – Air or Water An air or water vehicle specifically designed, equipped and staffed for lifesaving and transporting the sick or injured. 49 Independent Clinic A location, not part of a hospital and not described by any other Place of Service code, that is organized and operated to provide preventive, diagnostic, therapeutic, rehabilitative, or palliative services to outpatients only. (Effective October 1, 2023) 50 Federally Qualified Health Center A facility located in a medically underserved area that provides Medicare beneficiaries preventive primary medical care under the general direction of a physician. 51 Inpatient Psychiatric Facility A facility that provides inpatient psychiatric services for the diagnosis and treatment of mental illness on a 24-hour basis, by or under the supervision of a physician. 52 Psychiatric Facility-Partial Hospitalization A facility for the diagnosis and treatment of mental illness that provides a planned therapeutic program for patients who do not require full time hospitalization, but who need broader programs than are possible from outpatient visits to a hospital-based or hospital-affiliated facility. 53 Community Mental Health Center A facility that provides the following services: outpatient services, including specialized outpatient services for children, the elderly, individuals who are chronically ill, and residents of the CMHC's mental health services area who have been discharged from inpatient treatment at a mental health facility; 24 hour a day emergency care services; day treatment, other partial hospitalization services, or psychosocial rehabilitation services; screening for patients being considered for admission to State mental health facilities to determine the appropriateness of such admission; and consultation and education services. 54 Intermediate Care Facility/ Individuals with Intellectual Disabilities A facility which primarily provides health-related care and services above the level of custodial care to individuals but does not provide the level of care or treatment available in a hospital or SNF. 55 Residential Substance Abuse Treatment Facility A facility which provides treatment for substance (alcohol and drug) abuse to live-in residents who do not require acute medical care. Services include individual and group therapy and counseling, family counseling, laboratory tests, drugs and supplies, psychological testing, and room and board. 56 Psychiatric Residential Treatment Center A facility or distinct part of a facility for psychiatric care which provides a total 24-hour therapeutically planned and professionally staffed group living and learning environment. 57 Non-residential Substance Abuse Treatment Facility A location which provides treatment for substance (alcohol and drug) abuse on an ambulatory basis.  Services include individual and group therapy and counseling, family counseling, laboratory tests, drugs and supplies, and psychological testing. (Effective October 1, 2023) 58 Non-residential Opioid Treatment Facility A location that provides treatment for opioid use disorder on an ambulatory basis. Services include methadone and other forms of Medication Assisted Treatment (MAT) (Effective January 1, 2020) 60 Mass Immunization Center A location where providers administer pneumococcal pneumonia and influenza virus vaccinations and submit these services as electronic media claims, paper claims, or using the roster billing method. This generally takes place in a mass immunization setting, such as, a public health center, pharmacy, or mall but may include a physician office setting. 61 Comprehensive Inpatient Rehabilitation Facility A facility that provides comprehensive rehabilitation services under the supervision of a physician to inpatients with physical disabilities. Services include physical therapy, occupational therapy, speech pathology, social or psychological services, and orthotics and prosthetics services. 62 Comprehensive Outpatient Rehabilitation Facility A facility that provides comprehensive rehabilitation services under the supervision of a physician to outpatients with physical disabilities. Services include physical therapy, occupational therapy, and speech pathology services. 65 End-Stage Renal Disease Treatment Facility A facility other than a hospital, which provides dialysis treatment, maintenance, and/or training to patients or caregivers on an ambulatory or home-care basis. 66 Programs of All-Inclusive Care for the Elderly (PACE) Center* A facility or location providing comprehensive medical and social services as part of the Programs of All-Inclusive Care for the Elderly (PACE).  This includes, but is not limited to, primary care; social work services; restorative therapies, including physical and occupational therapy; personal care and supportive services; nutritional counseling; recreational therapy; and meals when the individual is enrolled in PACE. (Effective August 1, 2024) 71 Public Health Clinic A facility maintained by either State or local health departments that provides ambulatory primary medical care under the general direction of a physician. 72 Rural Health Clinic A certified facility which is located in a rural medically underserved area that provides ambulatory primary medical care under the general direction of a physician. 81 Independent Laboratory A laboratory certified to perform diagnostic and/or clinical tests independent of an institution or a physician's office. 99 Other Place of Service Other place of service not identified above. Description of the above table(s). History Date Action Author Custodian Comment 2025-04-26 revise Marc Duteau SD Create a convenience copy of the CMS POS code system; up-590 2022-04-28 revise Jessica Bota HTA Remove Version Specific Information from CMS Place of Service Description; UP-307 2021-03-24 create Jessica Bota Structured Docs New CS/NS: CMS-PlaceofServiceCodes;UP-61 IG © 2020+ HL7 International - Vocabulary Work Group. Package hl7.terminology#7.4.0 based on FHIR 5.0.0. Generated 2026-09-20 | external | Propose a change external Links: Table of Contents | QA Report | Version History external ( src )
• CMS Place of Service Codes (POS) - HL7 Terminology (THO) v7.4.0 h2{--heading-prefix:"10.3516"} h3,h4,h5,h6{--heading-prefix:"10.3516"} Visit the HL7 website HL7 Terminology (THO) 7.4.0 - Publication International flag FHIR * Home * HL7 Code Systems * Value Sets * Concept Maps * External Content * Documentation * Change History * Downloads * Table of Contents * Artifacts Summary * CMS Place of Service Codes (POS) HL7 Terminology (THO), published by HL7 International - Vocabulary Work Group. This guide is not an authorized publication; it is the continuous build for version 7.4.0 built by the FHIR (HL7® FHIR® Standard) CI Build. This version is based on the current content of https://github.com/HL7/UTG/ and changes regularly. See the Directory of published versions * Narrative Content * XML * JSON * TTL * History NamingSystem: CMS Place of Service Codes (POS) Official URL: http://terminology.hl7.org/NamingSystem/CMSPlaceofServiceCodes Version: 1.1.0 Highlight text changes? Active as of 2022-04-07 Responsible: Centers for Medicare & Medicaid Services /td> Computable Name: CMSPlaceofServiceCodes Place of Service Codes are two-digit codes placed on health care professional claims to indicate the setting in which a service was provided. The Centers for Medicare & Medicaid Services (CMS) maintain POS codes used throughout the health care industry. This code set is required for use in the implementation guide adopted as the national standard for electronic transmission of professional health care claims under the provisions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). HIPAA directed the Secretary of HHS to adopt national standards for electronic transactions. These standard transactions require all health plans and providers to use standard code sets to populate data elements in each transaction. The Transaction and Code Set Rule adopted the ASC X12N-837 Health Care Claim: Professional, volumes 1 and 2, as the standard for electronic submission of professional claims. This standard names the POS code set currently maintained by CMS as the code set to be used for describing sites of service in such claims. POS information is often needed to determine the acceptability of direct billing of Medicare, Medicaid and private insurance services provided by a given provider. Language: en Summary Defining URL http://terminology.hl7.org/NamingSystem/CMSPlaceofServiceCodes Version 1.1.0 Name CMSPlaceofServiceCodes Title CMS Place of Service Codes (POS) Status active Definition Place of Service Codes are two-digit codes placed on health care professional claims to indicate the setting in which a service was provided. The Centers for Medicare & Medicaid Services (CMS) maintain POS codes used throughout the health care industry. This code set is required for use in the implementation guide adopted as the national standard for electronic transmission of professional health care claims under the provisions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). HIPAA directed the Secretary of HHS to adopt national standards for electronic transactions. These standard transactions require all health plans and providers to use standard code sets to populate data elements in each transaction. The Transaction and Code Set Rule adopted the ASC X12N-837 Health Care Claim: Professional, volumes 1 and 2, as the standard for electronic submission of professional claims. This standard names the POS code set currently maintained by CMS as the code set to be used for describing sites of service in such claims. POS information is often needed to determine the acceptability of direct billing of Medicare, Medicaid and private insurance services provided by a given provider. Publisher Centers for Medicare & Medicaid Services Identifiers Type Value Preferred OID 2.16.840.1.113883.15.5 true URI https://www.cms.gov/Medicare/Coding/place-of-service-codes/Place_of_Service_Code_Set true History Date Action Custodian Author Comment 2022-04-28 revise HTA Jessica Bota Remove Version Specific Information from CMS Place of Service Description; UP-307 2021-03-24 create Structured Docs Jessica Bota New CS/NS: CMS-PlaceofServiceCodes;UP-61 IG © 2020+ HL7 International - Vocabulary Work Group. Package hl7.terminology#7.4.0 based on FHIR 5.0.0. Generated 2026-09-20 | external | Propose a change external Links: Table of Contents | QA Report | Version History external ( src )
• CMS Prescription Drug Hierarchical Condition Categories - HL7 Terminology (THO) v7.4.0 h2{--heading-prefix:"10.3518"} h3,h4,h5,h6{--heading-prefix:"10.3518"} Visit the HL7 website HL7 Terminology (THO) 7.4.0 - Publication International flag FHIR * Home * HL7 Code Systems * Value Sets * Concept Maps * External Content * Documentation * Change History * Downloads * Table of Contents * Artifacts Summary * CMS Prescription Drug Hierarchical Condition Categories HL7 Terminology (THO), published by HL7 International - Vocabulary Work Group. This guide is not an authorized publication; it is the continuous build for version 7.4.0 built by the FHIR (HL7® FHIR® Standard) CI Build. This version is based on the current content of https://github.com/HL7/UTG/ and changes regularly. See the Directory of published versions * Narrative Content * XML * JSON * TTL * History NamingSystem: CMS Prescription Drug Hierarchical Condition Categories Official URL: http://terminology.hl7.org/NamingSystem/CMSRxHCC Version: 1.0.0 Highlight text changes? Active as of 2021-12-02 Responsible: Centers for Medicare & Medicaid Services /td> Computable Name: CMSRxHCC Starting in 2006, with the implementation of the Part D program, CMS introduced a second major HCC-based risk adjustment model. Created with the passage of the Medicare Modernization Act (MMA) of 2003, the Medicare Part D Prescription Drug benefit became the second major Medicare capitated payment system. CMS developed the Part D RxHCC risk adjustment model to apply to monthly capitated payments to both Medicare Advantage (MA-PDs) and standalone prescription drug plans (PDPs). The Part D RxHCC risk adjustment model implemented in 2006 was developed using a structure similar to the CMS-HCC model, in that it included demographic and diagnosis information clustered into hierarchical condition categories. CMS obtains diagnoses for all Medicare beneficiaries from either fee-for-service claims or Medicare Advantage reporting. In 2011, CMS implemented an updated Part D RxHCC risk adjustment model, incorporating program data derived from prescription drug event (PDE) data. The data used to calibrate this updated model was more recent cost and utilization data, resulting in a model that reflects more recent drug cost and utilization patterns. For more information, see: https://www.cms.gov/Medicare/Health-Plans/MedicareAdvtgSpecRateStats/Risk-Adjustors The CMS RxHCCs are in the public domain and are free to use without restriction. Language: en Summary Defining URL http://terminology.hl7.org/NamingSystem/CMSRxHCC Version 1.0.0 Name CMSRxHCC Title CMS Prescription Drug Hierarchical Condition Categories Status active Definition Starting in 2006, with the implementation of the Part D program, CMS introduced a second major HCC-based risk adjustment model. Created with the passage of the Medicare Modernization Act (MMA) of 2003, the Medicare Part D Prescription Drug benefit became the second major Medicare capitated payment system. CMS developed the Part D RxHCC risk adjustment model to apply to monthly capitated payments to both Medicare Advantage (MA-PDs) and standalone prescription drug plans (PDPs). The Part D RxHCC risk adjustment model implemented in 2006 was developed using a structure similar to the CMS-HCC model, in that it included demographic and diagnosis information clustered into hierarchical condition categories. CMS obtains diagnoses for all Medicare beneficiaries from either fee-for-service claims or Medicare Advantage reporting. In 2011, CMS implemented an updated Part D RxHCC risk adjustment model, incorporating program data derived from prescription drug event (PDE) data. The data used to calibrate this updated model was more recent cost and utilization data, resulting in a model that reflects more recent drug cost and utilization patterns. For more information, see: https://www.cms.gov/Medicare/Health-Plans/MedicareAdvtgSpecRateStats/Risk-Adjustors The CMS RxHCCs are in the public domain and are free to use without restriction. Publisher Centers for Medicare & Medicaid Services Identifiers Type Value Preferred Period URI http://terminology.hl7.org/CodeSystem/cmsrxhcc true 2021-12-02 --> (ongoing) History Date Action Author Custodian Comment 2022-01-29 create Jessica Bota HTA Add CMS Prescription Drug Hierarchical Condition Categories per HTA; up-269 IG © 2020+ HL7 International - Vocabulary Work Group. Package hl7.terminology#7.4.0 based on FHIR 5.0.0. Generated 2026-09-20 | external | Propose a change external Links: Table of Contents | QA Report | Version History external ( src )
• CMS Present on Admission (POA) Indicator - HL7 Terminology (THO) v7.4.0 h2{--heading-prefix:"10.2551"} h3,h4,h5,h6{--heading-prefix:"10.2551"} Visit the HL7 website HL7 Terminology (THO) 7.4.0 - Publication International flag FHIR * Home * HL7 Code Systems * Value Sets * Concept Maps * External Content * Documentation * Change History * Downloads * Table of Contents * Artifacts Summary * CMS Present on Admission (POA) Indicator HL7 Terminology (THO), published by HL7 International - Vocabulary Work Group. This guide is not an authorized publication; it is the continuous build for version 7.4.0 built by the FHIR (HL7® FHIR® Standard) CI Build. This version is based on the current content of https://github.com/HL7/UTG/ and changes regularly. See the Directory of published versions * Narrative Content * XML * JSON * TTL * History CodeSystem: CMS Present on Admission (POA) Indicator Official URL: https://www.cms.gov/Medicare/Medicare-Fee-for-Service-Payment/HospitalAcqCond/Coding Version: 07/14/2020 Highlight text changes? Active as of 2024-08-21 Responsible: Centers for Medicare & Medicaid Services /td> ​ Realm: United States of America flag Computable Name: PresentOnAdmission Other Identifiers: OID:2.16.840.1.113883.6.301.11 Copyright/Legal: The POA Indicator Codes are in the public domain and are free to use without restriction. This code system consists of Present on Admission (POA) indicators which are assigned to the principal and secondary diagnoses (as defined in Section II of the Official Guidelines for Coding and Reporting) and the external cause of injury codes to indicate the presence or absence of the diagnosis at the time of inpatient admission. This Code system is referenced in the definition of the following value sets: * Present on Admission Indicators This case-sensitive code system https://www.cms.gov/Medicare/Medicare-Fee-for-Service-Payment/HospitalAcqCond/Coding defines the following codes: Code Definition Y Diagnosis was present at time of inpatient admission. N Diagnosis was not present at time of inpatient admission. U Documentation insufficient to determine if the condition was present at the time of inpatient admission. W Clinically undetermined. Provider unable to clinically determine whether the condition was present at the time of inpatient admission. 1 Unreported/Not used. Exempt from POA reporting. This code is equivalent to a blank on the UB-04, however; it was determined that blanks are undesirable when submitting this data via the 4010A. Description of the above table(s). History Date Action Author Custodian Comment 2024-11-15 revise Jessica Bota TSMG Remove CMS notes from POA Indicator Definitions; up-596 2021-09-17 revise Marc Duteau CQI Adding codes the CMS Present on Admission (POA) Indicator code system stub; UP-214 2021-03-08 create Marc Duteau TSMG Create new CodeSystem and NamingSystem for CMS POA;UP-160 IG © 2020+ HL7 International - Vocabulary Work Group. Package hl7.terminology#7.4.0 based on FHIR 5.0.0. Generated 2026-09-20 | external | Propose a change external Links: Table of Contents | QA Report | Version History external ( src )
• CMS Present on Admission (POA) Indicator - HL7 Terminology (THO) v7.4.0 h2{--heading-prefix:"10.3931"} h3,h4,h5,h6{--heading-prefix:"10.3931"} Visit the HL7 website HL7 Terminology (THO) 7.4.0 - Publication International flag FHIR * Home * HL7 Code Systems * Value Sets * Concept Maps * External Content * Documentation * Change History * Downloads * Table of Contents * Artifacts Summary * CMS Present on Admission (POA) Indicator HL7 Terminology (THO), published by HL7 International - Vocabulary Work Group. This guide is not an authorized publication; it is the continuous build for version 7.4.0 built by the FHIR (HL7® FHIR® Standard) CI Build. This version is based on the current content of https://github.com/HL7/UTG/ and changes regularly. See the Directory of published versions * Narrative Content * XML * JSON * TTL * History NamingSystem: CMS Present on Admission (POA) Indicator Official URL: http://terminology.hl7.org/NamingSystem/presentOnAdmission Version: 1.0.0 Highlight text changes? Active as of 2021-01-07 Responsible: Centers for Medicare & Medicaid Services /td> ​ Realm: United States of America flag Computable Name: PresentOnAdmission Copyright/Legal: The POA Indicator Codes are in the public domain and are free to use without restriction. This code system consists of Present on Admission (POA) indicators which are assigned to the principal and secondary diagnoses (as defined in Section II of the Official Guidelines for Coding and Reporting) and the external cause of injury codes to indicate the presence or absence of the diagnosis at the time of inpatient admission. Language: en Summary Defining URL http://terminology.hl7.org/NamingSystem/presentOnAdmission Version 1.0.0 Name PresentOnAdmission Title CMS Present on Admission (POA) Indicator Status active Definition This code system consists of Present on Admission (POA) indicators which are assigned to the principal and secondary diagnoses (as defined in Section II of the Official Guidelines for Coding and Reporting) and the external cause of injury codes to indicate the presence or absence of the diagnosis at the time of inpatient admission. Publisher Centers for Medicare & Medicaid Services Copyright The POA Indicator Codes are in the public domain and are free to use without restriction. Identifiers Type Value Preferred Comment URI https://www.cms.gov/Medicare/Medicare-Fee-for-Service-Payment/HospitalAcqCond/Coding true OID 2.16.840.1.113883.6.301.11 true URI https://www.nubc.org/CodeSystem/PresentOnAdmissionIndicator The uri created for this code system by the CARIN project URI http://terminology.hl7.org/CodeSystem/v2-0895 The v2 table of present on admission indicators. History Date Action Custodian Author Comment 2021-03-08 create TSMG Marc Duteau Create new CodeSystem and NamingSystem for CMS POA;UP-160 IG © 2020+ HL7 International - Vocabulary Work Group. Package hl7.terminology#7.4.0 based on FHIR 5.0.0. Generated 2026-09-20 | external | Propose a change external Links: Table of Contents | QA Report | Version History external ( src )
• Clinical Laboratory Improvement Amendments - HL7 Terminology (THO) v7.4.0 h2{--heading-prefix:"10.3515"} h3,h4,h5,h6{--heading-prefix:"10.3515"} Visit the HL7 website HL7 Terminology (THO) 7.4.0 - Publication International flag FHIR * Home * HL7 Code Systems * Value Sets * Concept Maps * External Content * Documentation * Change History * Downloads * Table of Contents * Artifacts Summary * Clinical Laboratory Improvement Amendments HL7 Terminology (THO), published by HL7 International - Vocabulary Work Group. This guide is not an authorized publication; it is the continuous build for version 7.4.0 built by the FHIR (HL7® FHIR® Standard) CI Build. This version is based on the current content of https://github.com/HL7/UTG/ and changes regularly. See the Directory of published versions * Narrative Content * XML * JSON * TTL * History NamingSystem: Clinical Laboratory Improvement Amendments Official URL: http://terminology.hl7.org/NamingSystem/CLIA Version: 1.0.0 Highlight text changes? Active as of 2022-08-25 Responsible: Centers for Medicare & Medicaid Services (CMS)/a> Computable Name: CLIA "The Centers for Medicare & Medicaid Services (CMS) regulates all laboratory testing (except research) performed on humans in the U.S. through the Clinical Laboratory Improvement Amendments (CLIA). In total, CLIA covers approximately 330,000 laboratory entities. The Division of Clinical Laboratory Improvement & Quality, within the Quality, Safety & Oversight Group, under the Center for Clinical Standards and Quality (CCSQ) has the responsibility for implementing the CLIA Program. The objective of the CLIA program is to ensure quality laboratory testing. Although all clinical laboratories must be properly certified to receive Medicare or Medicaid payments, CLIA has no direct Medicare or Medicaid program responsibilities." CMS CLIA certified laboratories will be assigned a10-digit alphanumeric CLIA identification number, with the "D" in the third position identifying the provider/supplier as a laboratory certified under CLIA." CLIA is maintained by CMS. It is in the public domain and free to use without restriction. See http://cms.gov/regulations-and-guidance/legislation/clia. Language: en Summary Defining URL http://terminology.hl7.org/NamingSystem/CLIA Version 1.0.0 Name CLIA Title Clinical Laboratory Improvement Amendments Status active Definition "The Centers for Medicare & Medicaid Services (CMS) regulates all laboratory testing (except research) performed on humans in the U.S. through the Clinical Laboratory Improvement Amendments (CLIA). In total, CLIA covers approximately 330,000 laboratory entities. The Division of Clinical Laboratory Improvement & Quality, within the Quality, Safety & Oversight Group, under the Center for Clinical Standards and Quality (CCSQ) has the responsibility for implementing the CLIA Program. The objective of the CLIA program is to ensure quality laboratory testing. Although all clinical laboratories must be properly certified to receive Medicare or Medicaid payments, CLIA has no direct Medicare or Medicaid program responsibilities." CMS CLIA certified laboratories will be assigned a10-digit alphanumeric CLIA identification number, with the "D" in the third position identifying the provider/supplier as a laboratory certified under CLIA." CLIA is maintained by CMS. It is in the public domain and free to use without restriction. See http://cms.gov/regulations-and-guidance/legislation/clia. Publisher Centers for Medicare & Medicaid Services (CMS) Identifiers Type Value Preferred Period OID 2.16.840.1.113883.4.7 true URI urn:oid:2.16.840.1.113883.4.7 true 2022-08-25 --> (ongoing) History Date Action Author Custodian Comment 2022-09-02 create Jessica Bota TSMG Add CLIA Identifier System per HTA; up-342 IG © 2020+ HL7 International - Vocabulary Work Group. Package hl7.terminology#7.4.0 based on FHIR 5.0.0. Generated 2026-09-20 | external | Propose a change external Links: Table of Contents | QA Report | Version History external ( src )
• Data Universal Numbering System (DUNS) Number - HL7 Terminology (THO) v7.4.0 h2{--heading-prefix:"10.3533"} h3,h4,h5,h6{--heading-prefix:"10.3533"} Visit the HL7 website HL7 Terminology (THO) 7.4.0 - Publication International flag FHIR * Home * HL7 Code Systems * Value Sets * Concept Maps * External Content * Documentation * Change History * Downloads * Table of Contents * Artifacts Summary * Data Universal Numbering System (DUNS) Number HL7 Terminology (THO), published by HL7 International - Vocabulary Work Group. This guide is not an authorized publication; it is the continuous build for version 7.4.0 built by the FHIR (HL7® FHIR® Standard) CI Build. This version is based on the current content of https://github.com/HL7/UTG/ and changes regularly. See the Directory of published versions * Narrative Content * XML * JSON * TTL * History NamingSystem: Data Universal Numbering System (DUNS) Number Official URL: http://terminology.hl7.org/NamingSystem/DUNSNumber Version: 1.0.0 Highlight text changes? Active as of 2024-10-21 Responsible: Dun & Bradstreet/a> Computable Name: DUNSNumber Copyright/Legal: Dun & Bradstreet DUNS® Numbers are proprietary to and controlled by Dun & Bradstreet. Dun & Bradstreet grants you a non-exclusive, perpetual, limited license to use DUNS® Numbers (excluding linkage DUNS® Numbers) solely for identification purposes and only for your internal business use. Where practicable, you will refer to the number as a “DUNS® Number” and state that DUNS® is a registered trademark of Dun & Bradstreet. For more information, see https://www.dnb.com/utility-pages/terms-of-use.html "The Dun & Bradstreet D-U-N-S® Number (short for Data Universal Numbering System) is a nine-digit unique identifier for businesses. Hundreds of millions of D-U-N-S Numbers exist for companies across the globe. A D-U-N-S Number is assigned through our patented identity resolution process, (part of our DUNSRight™ data governance, which includes thousands of separate automated checks.) The D-U-N-S Number identifies a company as being unique from any other in the Dun & Bradstreet Data Cloud. It is used as the starting point for any company's Live Business Identity, which helps ensure you have the most accurate and up-to-date view of organizations." For more information, see https://www.dnb.com/duns.html. Language: en Summary Defining URL http://terminology.hl7.org/NamingSystem/DUNSNumber Version 1.0.0 Name DUNSNumber Title Data Universal Numbering System (DUNS) Number Status active Definition "The Dun & Bradstreet D-U-N-S® Number (short for Data Universal Numbering System) is a nine-digit unique identifier for businesses. Hundreds of millions of D-U-N-S Numbers exist for companies across the globe. A D-U-N-S Number is assigned through our patented identity resolution process, (part of our DUNSRight™ data governance, which includes thousands of separate automated checks.) The D-U-N-S Number identifies a company as being unique from any other in the Dun & Bradstreet Data Cloud. It is used as the starting point for any company's Live Business Identity, which helps ensure you have the most accurate and up-to-date view of organizations." For more information, see https://www.dnb.com/duns.html. Publisher Dun & Bradstreet Copyright Dun & Bradstreet DUNS® Numbers are proprietary to and controlled by Dun & Bradstreet. Dun & Bradstreet grants you a non-exclusive, perpetual, limited license to use DUNS® Numbers (excluding linkage DUNS® Numbers) solely for identification purposes and only for your internal business use. Where practicable, you will refer to the number as a “DUNS® Number” and state that DUNS® is a registered trademark of Dun & Bradstreet. For more information, see https://www.dnb.com/utility-pages/terms-of-use.html Identifiers Type Value Preferred Period OID 1.3.6.1.4.1.519.1 true URI http://terminology.hl7.org/NamingSystem/DUNSNumber true 2024-10-21 --> (ongoing) History Date Action Custodian Author Comment 2024-11-15 create TSMG Jessica Bota Add Identifier System records for FDA Establishment Identifier (FEI) and Data Universal Numbering System (DUNS) Number per TSMG; up-614 IG © 2020+ HL7 International - Vocabulary Work Group. Package hl7.terminology#7.4.0 based on FHIR 5.0.0. Generated 2026-09-20 | external | Propose a change external Links: Table of Contents | QA Report | Version History external ( src )
• Health Insurance Prospective Payment System (HIPPS) - HL7 Terminology (THO) v7.4.0 h2{--heading-prefix:"10.3551"} h3,h4,h5,h6{--heading-prefix:"10.3551"} Visit the HL7 website HL7 Terminology (THO) 7.4.0 - Publication International flag FHIR * Home * HL7 Code Systems * Value Sets * Concept Maps * External Content * Documentation * Change History * Downloads * Table of Contents * Artifacts Summary * Health Insurance Prospective Payment System (HIPPS) HL7 Terminology (THO), published by HL7 International - Vocabulary Work Group. This guide is not an authorized publication; it is the continuous build for version 7.4.0 built by the FHIR (HL7® FHIR® Standard) CI Build. This version is based on the current content of https://github.com/HL7/UTG/ and changes regularly. See the Directory of published versions * Narrative Content * XML * JSON * TTL * History NamingSystem: Health Insurance Prospective Payment System (HIPPS) Official URL: http://terminology.hl7.org/NamingSystem/HIPPS Version: 1.0.0 Highlight text changes? Active as of 2022-05-25 Responsible: U.S. Centers for Medicare & Medicaid Services (CMS)/a> Computable Name: HIPPS Copyright/Legal: CMS maintains HIPPS. There are no known constraints on the use of HIPPS. "Health Insurance Prospective Payment System (HIPPS) rate codes represent specific sets of patient characteristics (or case-mix groups) health insurers use to make payment determinations under several prospective payment systems. Case-mix groups are developed based on research into utilization patterns among various provider types. For the payment systems that use HIPPS codes, clinical assessment data is the basic input. A standard patient assessment instrument is interpreted by case-mix grouping software algorithms, which assign the case mix group. For payment purposes, at least one HIPPS code is defined to represent each case-mix group. These HIPPS codes are reported on claims to insurers. Institutional providers use HIPPS codes on claims in association with special revenue codes. One revenue code is defined for each prospective payment system that requires HIPPS codes. HIPPS codes are placed in data element SV202 on the electronic 837 institutional claims transaction, using an HP qualifier, or in Form Locator (FL) 44 ("HCPCS/rate") on a paper UB-04 claims form. The associated revenue code is placed in data element SV201 or in FL 42. In certain circumstances, multiple HIPPS codes may appear on separate lines of a single claim." "HIPPS codes are alpha-numeric codes of five digits. Each code contains intelligence, with certain positions of the code indicating the case mix group itself, and other positions providing additional information. The additional information varies among HIPPS codes pertaining to different payment systems, but often provides information about the clinical assessment used to arrive at the code. Which positions of the code carry the case mix group information may also vary by payment systems." "Under the Health Insurance Portability and Accountability Act (HIPAA) rules for transactions and code sets, HIPPS codes are defined as a non-medical code set. Therefore, these codes are effective by transaction date. Effective From Dates: HIPPS codes are valid under HIPAA on transactions on or after this date. Since all HIPPS codes to date have been initially created for Original Medicare payment systems, this is also date of service the codes begin to be payable by Medicare. While it is valid under HIPAA rules that a claim for dates of service before this date could be submitted on a transaction after this date, CMS is not aware of a business need for a provider to do so. The code would not be payable by any insurer and no Grouper software would be available to produce a code for those dates. Effective Through Dates: HIPPS codes are no longer valid under HIPAA on transactions on or after this date. This date may vary from the date a code ceases to be payable by Medicare, since other payers may continue to use older HIPPS codes after Medicare transitions to a new payment system. Since CMS, as the HIPPS code set maintainer, may not have complete information about other payers’ uses of these codes, codes may remain effective under HIPAA long after they cease to be payable on Medicare claims. To reflect this, a separate column on the HIPPS Code Master List indicates the Medicare Payment Though Date." Language: en Summary Defining URL http://terminology.hl7.org/NamingSystem/HIPPS Version 1.0.0 Name HIPPS Title Health Insurance Prospective Payment System (HIPPS) Status active Definition "Health Insurance Prospective Payment System (HIPPS) rate codes represent specific sets of patient characteristics (or case-mix groups) health insurers use to make payment determinations under several prospective payment systems. Case-mix groups are developed based on research into utilization patterns among various provider types. For the payment systems that use HIPPS codes, clinical assessment data is the basic input. A standard patient assessment instrument is interpreted by case-mix grouping software algorithms, which assign the case mix group. For payment purposes, at least one HIPPS code is defined to represent each case-mix group. These HIPPS codes are reported on claims to insurers. Institutional providers use HIPPS codes on claims in association with special revenue codes. One revenue code is defined for each prospective payment system that requires HIPPS codes. HIPPS codes are placed in data element SV202 on the electronic 837 institutional claims transaction, using an HP qualifier, or in Form Locator (FL) 44 ("HCPCS/rate") on a paper UB-04 claims form. The associated revenue code is placed in data element SV201 or in FL 42. In certain circumstances, multiple HIPPS codes may appear on separate lines of a single claim." "HIPPS codes are alpha-numeric codes of five digits. Each code contains intelligence, with certain positions of the code indicating the case mix group itself, and other positions providing additional information. The additional information varies among HIPPS codes pertaining to different payment systems, but often provides information about the clinical assessment used to arrive at the code. Which positions of the code carry the case mix group information may also vary by payment systems." "Under the Health Insurance Portability and Accountability Act (HIPAA) rules for transactions and code sets, HIPPS codes are defined as a non-medical code set. Therefore, these codes are effective by transaction date. Effective From Dates: HIPPS codes are valid under HIPAA on transactions on or after this date. Since all HIPPS codes to date have been initially created for Original Medicare payment systems, this is also date of service the codes begin to be payable by Medicare. While it is valid under HIPAA rules that a claim for dates of service before this date could be submitted on a transaction after this date, CMS is not aware of a business need for a provider to do so. The code would not be payable by any insurer and no Grouper software would be available to produce a code for those dates. Effective Through Dates: HIPPS codes are no longer valid under HIPAA on transactions on or after this date. This date may vary from the date a code ceases to be payable by Medicare, since other payers may continue to use older HIPPS codes after Medicare transitions to a new payment system. Since CMS, as the HIPPS code set maintainer, may not have complete information about other payers’ uses of these codes, codes may remain effective under HIPAA long after they cease to be payable on Medicare claims. To reflect this, a separate column on the HIPPS Code Master List indicates the Medicare Payment Though Date." Publisher U.S. Centers for Medicare & Medicaid Services (CMS) Copyright CMS maintains HIPPS. There are no known constraints on the use of HIPPS. Identifiers Type Value Preferred Period Comment URI https://www.cms.gov/Medicare/Medicare-Fee-for-Service-Payment/ProspMedicareFeeSvcPmtGen/HIPPSCodes true 2020-02-08 --> (ongoing) This is the URL endorsed by the HTA and is considered authoritative. History Date Action Author Custodian Comment 2022-09-01 create Jessica Bota HTA Add CMS HIPPS per HTA; up-327 IG © 2020+ HL7 International - Vocabulary Work Group. Package hl7.terminology#7.4.0 based on FHIR 5.0.0. Generated 2026-09-20 | external | Propose a change external Links: Table of Contents | QA Report | Version History external ( src )
• Healthcare Common Procedure Coding System (HCPCS) level II alphanumeric codes - HL7 Terminology (THO) v7.4.0 h2{--heading-prefix:"10.3678"} h3,h4,h5,h6{--heading-prefix:"10.3678"} Visit the HL7 website HL7 Terminology (THO) 7.4.0 - Publication International flag FHIR * Home * HL7 Code Systems * Value Sets * Concept Maps * External Content * Documentation * Change History * Downloads * Table of Contents * Artifacts Summary * Healthcare Common Procedure Coding System (HCPCS) level II alphanumeric codes HL7 Terminology (THO), published by HL7 International - Vocabulary Work Group. This guide is not an authorized publication; it is the continuous build for version 7.4.0 built by the FHIR (HL7® FHIR® Standard) CI Build. This version is based on the current content of https://github.com/HL7/UTG/ and changes regularly. See the Directory of published versions * Narrative Content * XML * JSON * TTL * History NamingSystem: Healthcare Common Procedure Coding System (HCPCS) level II alphanumeric codes Official URL: http://terminology.hl7.org/NamingSystem/hcpcs-Level-II Version: 1.0.2 Highlight text changes? Active as of 2024-10-08 Responsible: U.S. Centers for Medicare & Medicaid Services (CMS)/a> Computable Name: HCPCSLevelII The Level II HCPCS codes, which are established by CMS's Alpha-Numeric Editorial Panel, primarily represent items and supplies and non-physician services not covered by the American Medical Association's Current Procedural Terminology-4 (CPT-4) codes; Medicare, Medicaid, and private health insurers use HCPCS procedure and modifier codes for claims processing. Level II alphanumeric procedure and modifier codes comprise the A to V range. Language: en Summary Defining URL http://terminology.hl7.org/NamingSystem/hcpcs-Level-II Version 1.0.2 Name HCPCSLevelII Title Healthcare Common Procedure Coding System (HCPCS) level II alphanumeric codes Status active Definition The Level II HCPCS codes, which are established by CMS's Alpha-Numeric Editorial Panel, primarily represent items and supplies and non-physician services not covered by the American Medical Association's Current Procedural Terminology-4 (CPT-4) codes; Medicare, Medicaid, and private health insurers use HCPCS procedure and modifier codes for claims processing. Level II alphanumeric procedure and modifier codes comprise the A to V range. Publisher U.S. Centers for Medicare & Medicaid Services (CMS) Identifiers Type Value Preferred Period OID 2.16.840.1.113883.6.285 true URI http://www.cms.gov/Medicare/Coding/HCPCSReleaseCodeSets true 2020-08-11 00:00:00-0400 --> (ongoing) URI https://www.cms.gov/Medicare/Coding/HCPCSReleaseCodeSets false History Date Action Custodian Author Comment 2024-11-15 revise TSMG Jessica Bota Add Alternate Identifier for HCPCS; up-608 2023-11-13 revise TSMG Jessica Bota Fix technical error with HCPCS uri; up-472 2021-02-24 create HTA Jessica Bota New naming system for the corrected OID entry for HCPCS; proposal UP-91 IG © 2020+ HL7 International - Vocabulary Work Group. Package hl7.terminology#7.4.0 based on FHIR 5.0.0. Generated 2026-09-20 | external | Propose a change external Links: Table of Contents | QA Report | Version History external ( src )
• Medicare Severity Diagnosis Related Groups (MS-DRGs) - HL7 Terminology (THO) v7.4.0 h2{--heading-prefix:"10.3600"} h3,h4,h5,h6{--heading-prefix:"10.3600"} Visit the HL7 website HL7 Terminology (THO) 7.4.0 - Publication International flag FHIR * Home * HL7 Code Systems * Value Sets * Concept Maps * External Content * Documentation * Change History * Downloads * Table of Contents * Artifacts Summary * Medicare Severity Diagnosis Related Groups (MS-DRGs) HL7 Terminology (THO), published by HL7 International - Vocabulary Work Group. This guide is not an authorized publication; it is the continuous build for version 7.4.0 built by the FHIR (HL7® FHIR® Standard) CI Build. This version is based on the current content of https://github.com/HL7/UTG/ and changes regularly. See the Directory of published versions * Narrative Content * XML * JSON * TTL * History NamingSystem: Medicare Severity Diagnosis Related Groups (MS-DRGs) Official URL: http://terminology.hl7.org/NamingSystem/MSDRG Version: 1.0.0 Highlight text changes? Active as of 2022-04-07 Responsible: Centers for Medicare & Medicaid Services /td> Computable Name: MSDRG Copyright/Legal: The Centers for Medicare & Medicaid Services (CMS) maintain MS-DRGs used throughout the US health care industry. The CMS MS-DRGs are free to use without restriction. Section 1886(d) of the Act specifies that the Secretary shall establish a classification system (referred to as DRGs) for inpatient discharges and adjust payments under the IPPS based on appropriate weighting factors assigned to each DRG. Therefore, under the IPPS, we[CMS] pay for inpatient hospital services on a rate per discharge basis that varies according to the DRG to which a beneficiary's stay is assigned. The formula used to calculate payment for a specific case multiplies an individual hospital's payment rate per case by the weight of the DRG to which the case is assigned. Each DRG weight represents the average resources required to care for cases in that particular DRG, relative to the average resources used to treat cases in all DRGs. Congress recognized that it would be necessary to recalculate the DRG relative weights periodically to account for changes in resource consumption. Accordingly, section 1886(d)(4)(C) of the Act requires that the Secretary adjust the DRG classifications and relative weights at least annually. These adjustments are made to reflect changes in treatment patterns, technology, and any other factors that may change the relative use of hospital resources. Currently, cases are classified into Medicare Severity Diagnosis Related Groups (MS-DRGs) for payment under the IPPS based on the following information reported by the hospital: the principal diagnosis, up to 25 additional diagnoses, and up to 25 procedures performed during the stay. In a small number of MS-DRGs, classification is also based on the age, sex, and discharge status of the patient. Effective October 1, 2015, the diagnosis and procedure information is reported by the hospital using codes from the International Classification of Diseases, Tenth Revision, Clinical Modification (ICD-10-CM) and the International Classification of Diseases, Tenth Revision, Procedure Coding System (ICD-10-PCS). Content can be obtained on the CMS hosted page located at https://www.cms.gov/Medicare/Medicare-Fee-for-Service-Payment/AcuteInpatientPPS/MS-DRG-Classifications-and-Software The DRGs are released annually with errata published infrequently. The fiscal year and release version should be noted (e.g., 2021.38.R1). Requests for annual MS-DRG classification changes and any MS-DRG related inquiries should be sent to the MSDRGClassificationChange@cms.hhs.gov mailbox. For additional information on the MS-DRG system, including yearly reviews and changes to the MS-DRGs, please view prior Inpatient Prospective Payment System (IPPS) proposed and final rules located in the left navigational area of https://www.cms.gov/Medicare/Medicare-Fee-for-Service-Payment/AcuteInpatientPPS/MS-DRG-Classifications-and-Software Language: en Summary Defining URL http://terminology.hl7.org/NamingSystem/MSDRG Version 1.0.0 Name MSDRG Title Medicare Severity Diagnosis Related Groups (MS-DRGs) Status active Definition Section 1886(d) of the Act specifies that the Secretary shall establish a classification system (referred to as DRGs) for inpatient discharges and adjust payments under the IPPS based on appropriate weighting factors assigned to each DRG. Therefore, under the IPPS, we[CMS] pay for inpatient hospital services on a rate per discharge basis that varies according to the DRG to which a beneficiary's stay is assigned. The formula used to calculate payment for a specific case multiplies an individual hospital's payment rate per case by the weight of the DRG to which the case is assigned. Each DRG weight represents the average resources required to care for cases in that particular DRG, relative to the average resources used to treat cases in all DRGs. Congress recognized that it would be necessary to recalculate the DRG relative weights periodically to account for changes in resource consumption. Accordingly, section 1886(d)(4)(C) of the Act requires that the Secretary adjust the DRG classifications and relative weights at least annually. These adjustments are made to reflect changes in treatment patterns, technology, and any other factors that may change the relative use of hospital resources. Currently, cases are classified into Medicare Severity Diagnosis Related Groups (MS-DRGs) for payment under the IPPS based on the following information reported by the hospital: the principal diagnosis, up to 25 additional diagnoses, and up to 25 procedures performed during the stay. In a small number of MS-DRGs, classification is also based on the age, sex, and discharge status of the patient. Effective October 1, 2015, the diagnosis and procedure information is reported by the hospital using codes from the International Classification of Diseases, Tenth Revision, Clinical Modification (ICD-10-CM) and the International Classification of Diseases, Tenth Revision, Procedure Coding System (ICD-10-PCS). Content can be obtained on the CMS hosted page located at https://www.cms.gov/Medicare/Medicare-Fee-for-Service-Payment/AcuteInpatientPPS/MS-DRG-Classifications-and-Software The DRGs are released annually with errata published infrequently. The fiscal year and release version should be noted (e.g., 2021.38.R1). Requests for annual MS-DRG classification changes and any MS-DRG related inquiries should be sent to the MSDRGClassificationChange@cms.hhs.gov mailbox. For additional information on the MS-DRG system, including yearly reviews and changes to the MS-DRGs, please view prior Inpatient Prospective Payment System (IPPS) proposed and final rules located in the left navigational area of https://www.cms.gov/Medicare/Medicare-Fee-for-Service-Payment/AcuteInpatientPPS/MS-DRG-Classifications-and-Software Publisher Centers for Medicare & Medicaid Services Copyright The Centers for Medicare & Medicaid Services (CMS) maintain MS-DRGs used throughout the US health care industry. The CMS MS-DRGs are free to use without restriction. Identifiers Type Value Preferred Period Comment URI https://www.cms.gov/Medicare/Medicare-Fee-for-Service-Payment/AcuteInpatientPPS/MS-DRG-Classifications-and-Software true 2022-04-07 --> (ongoing) This is the URL endorsed by the HTA and is considered authoritative. History Date Action Author Custodian Comment 2022-05-18 create Jessica Bota HTA Add CMS MS-DRG per HTA; UP-308 IG © 2020+ HL7 International - Vocabulary Work Group. Package hl7.terminology#7.4.0 based on FHIR 5.0.0. Generated 2026-09-20 | external | Propose a change external Links: Table of Contents | QA Report | Version History external ( src )
• HL7 Terminology (THO) ®© HL7 | CC0 ( src )
• ICNP(r) is a combinatorial terminology, using a multi-axial structure. ICNP(r) provides standardized terms and codes for terms in two classifications that can be used to compose or create pre-coordinated concepts to represent observations and procedures, specifically, patient problems/nursing diagnoses, nursing interventions including those focused on assessment and actual or expected (goal) outcomes. The ICNP(r) Classification for Nursing Phenomena is used to compose concepts or statements to represent observations (nursing diagnoses, patient problems, patient status, patient outcomes). The ICNP(r) Nursing Actions Classification is used to compose concepts or statements to represent procedures (nursing interventions) ( src )
• RadLex is a comprehensive set of radiology terms for use in radiology reporting, decision support, data mining, data registries, education and research. RadLex Playbook is a project of the Radiological Society of North America (RSNA), and constitutes a portion of the RadLex ontology. Playbook aims to provide a standard system for naming radiology procedures, based on the elements which define an imaging exam such as modality and body part. By providing standard names and codes for radiologic studies, Playbook is intended to facilitate a variety of operational and quality improvement efforts, including workflow optimization, chargemaster management, radiation dose tracking, enterprise integration and image exchange. As of RadLex Playbook version 2.5, a four-year project to harmonize RadLex Playbook with the radiology portion of the LOINC standard has been concluded, leading to the LOINC-RSNA Radiology Playbook which is jointly managed by the Regenstrief Institute (publisher of LOINC) and RSNA. This harmonized Playbook defines a new information model for describing imaging procedures, and identifies correspondences between RadLex Playbook codes and LOINC codes. (See https://loinc.org/download/loinc-users-guide and http://pubs.rsna.org/doi/pdf/10.1148/rg.2017160188 for details.) Note that RadLex Playbook codes start with "RPID" followed by a numerical value. LOINC codes consist of a numerical code, followed by a hyphen and a single additional digit (called the check digit). Note that in the future, new codes will be created in the LOINC format only, not the RPID format. New adopters are encouraged to use LOINC-format codes. LOINC-format codes may be accessed at http://search.loinc.org. New code requests may be submitted to the joint Regenstrief-RSNA governance committee at https://loinc.org/submissions/. From the RSNA website: "We (RSNA) recognize the benefits that come from radiologists using common language to communicate diagnostic results. For this reason, RSNA produced RadLex®, a comprehensive set of radiology terms for use in radiology reporting, decision support, data mining, data registries, education and research. RadLex provides the foundation for vital data resources used in radiology: * The LOINC/RSNA Radiology Playbook (http://playbook.radlex.org/playbook/SearchRadlexAction) * RadElement Common Data Elements (http://www.radelement.org/) * RadReport Radiology Reporting Templates (http://radreport.org/) The development of RadLex has been supported by the National Institute of Biomedical Imaging and Bioengineering (NIBIB) and the cancer Biomedical Informatics Grid (caBIG) project.;" ( src )
• Section 1886(d) of the Act specifies that the Secretary shall establish a classification system (referred to as DRGs) for inpatient discharges and adjust payments under the IPPS based on appropriate weighting factors assigned to each DRG. Therefore, under the IPPS, we[CMS] pay for inpatient hospital services on a rate per discharge basis that varies according to the DRG to which a beneficiary's stay is assigned. The formula used to calculate payment for a specific case multiplies an individual hospital's payment rate per case by the weight of the DRG to which the case is assigned. Each DRG weight represents the average resources required to care for cases in that particular DRG, relative to the average resources used to treat cases in all DRGs. Congress recognized that it would be necessary to recalculate the DRG relative weights periodically to account for changes in resource consumption. Accordingly, section 1886(d)(4)(C) of the Act requires that the Secretary adjust the DRG classifications and relative weights at least annually. These adjustments are made to reflect changes in treatment patterns, technology, and any other factors that may change the relative use of hospital resources. Currently, cases are classified into Medicare Severity Diagnosis Related Groups (MS-DRGs) for payment under the IPPS based on the following information reported by the hospital: the principal diagnosis, up to 25 additional diagnoses, and up to 25 procedures performed during the stay. In a small number of MS-DRGs, classification is also based on the age, sex, and discharge status of the patient. Effective October 1, 2015, the diagnosis and procedure information is reported by the hospital using codes from the International Classification of Diseases, Tenth Revision, Clinical Modification (ICD-10-CM) and the International Classification of Diseases, Tenth Revision, Procedure Coding System (ICD-10-PCS). Content can be obtained on the CMS hosted page located at https://www.cms.gov/Medicare/Medicare-Fee-for-Service-Payment/AcuteInpatientPPS/MS-DRG-Classifications-and-Software The DRGs are released annually with errata published infrequently. The fiscal year and release version should be noted (e.g., 2021.38.R1). Requests for annual MS-DRG classification changes and any MS-DRG related inquiries should be sent to the MSDRGClassificationChange@cms.hhs.gov mailbox. For additional information on the MS-DRG system, including yearly reviews and changes to the MS-DRGs, please view prior Inpatient Prospective Payment System (IPPS) proposed and final rules located in the left navigational area of https://www.cms.gov/Medicare/Medicare-Fee-for-Service-Payment/AcuteInpatientPPS/MS-DRG-Classifications-and-Software ( src )
• The pan Canadian LOINC Observation Code Database (pCLOCD) is the Canadian version of the LOINC(tm) database. It was created using the LOINC(tm) records and attributes that were constrained for Canadian use and supplemented to specifically meet Canadian requirements. It contains the core LOINC(tm) attributes as required by Regenstrief copyright rules. The LOINC(tm) Component has been customized to meet Canadian requirements and is displayed as the pan Canadian Component Name. This component name is the basis for the pan Canadian Display Name. Core attributes are include both English and Canadian French. This code system contains supplemental "X" codes defined in the pCLOCD that do not yet exist in the LOINC code system. ( src )
• "Material on this site is the copyrighted property of the United States Postal Service® (Postal Service™). All rights reserved. The information and images presented here may not under any circumstances be reproduced or used without prior written permission. Users may view and download material from this site only for the following purposes: (a) for personal, non-commercial home use; (b) where the materials clearly state that these materials may be copied and reproduced according to the terms stated in those particular pages; or (c) with the express written permission of the Postal Service. In all other cases, you will need written permission from the Postal Service to reproduce, republish, upload, post, transmit, distribute or publicly display material from this Web site. Users agree not to use the site for sale, trade or other commercial purposes. Users may not use language that is threatening, abusive, vulgar, discourteous or criminal. Users also may not post or transmit information or materials that would violate rights of any third party or which contains a virus or other harmful component. The Postal Service reserves the right to remove or edit any messages or material submitted by users." For more information, see [https://about.usps.com/who/legal/terms-of-use.htm](https://about.usps.com/who/legal/terms-of-use.htm). ( src )
• (c) The OMOP Standardized Vocabularies Copyright Observational Health Data Sciences and Informatics, Columbia University, New York, NY. Licensed under Apache 2.0 Copyright pertains to the OHDSI Standardized Vocabularies content, excluding source vocabulary codes, descriptions and related content originating from content developers other than OHDSI. The OMOP Vocabulary is a key component of the Observational Medical Outcomes Partnership (OMOP) Common Data Model (CDM) and the OHDSI Community mission. As such the OMOP Vocabulary content is managed under Open Science Principles, freely available under the terms of Apache 2.0 License, described below. The OMOP CDM format forces a different representation of each source vocabulary when compared to its native form. Therefore, the OHDSI Standardized Vocabularies are explicitly meant to be used for building an OMOP CDM and in some cases (such as for SNOMED) specific license restrictions limit its use within an OMOP CDM. The Vocabularies purpose are to support analytics and should not be used for purposes of individual patient healthcare. Unless otherwise specified for a few commercial vocabularies, vocabularies and their concepts are Open Source. [Apache License V2.0](https://www.apache.org/licenses/LICENSE-2.0) is followed for open source terms and conditions for use. Contributors provide an express grant of patent rights. Licensed works, modifications, and larger works may be distributed under different terms and without source code. A number of license restricted vocabularies that have been derived from commercially available content can only be accessed after requesting access and providing proof that the requesting user does hold a license for the vocabulary in question. Users of Commercial and other proprietary Source Vocabularies are required to provide EULA documentation or proof of licensure to OHDSI to access target OMOP Vocabulary components, including (OMOP Vocabulary short name in parentheses): * Current Procedural Terminology version 4 (CPT4) * Medi-Span Generic Product Identifier (GPI) * Medical Dictionary for Regulatory Activities (MedDR) * First Data Bank Indications and Contraindications (Indication) * First Data Bank Enhanced Therapeutic Classification (ETC) * First Data Bank Multilex (Multilex) * Resip Gemscript (Gemscript) * IQVIA Disease Analyzer France (DA_France) * IQVIA Longitudinal Patient Data Australia (LPD_Austrailia) * IQVIA Global Reference Repository (GRR) * ADA Current Dental Terminology (CDT) * ICCBBA Information Standard for Blood and Transplant 128 Product (ISBT) * ICCBBA Information Standard for Blood and Transplant 128 Product Attribute (ISBT Attribute) * Brazilian Unified Health System Table of Procedures, Drugs, Orthoses, Protheses and Special Materials (SUS) * CAP electronic Cancer Checklists (CAP) * IQVIA CO-CONNECT (CO-CONNECT) * IQVIA CO-CONNECT MIABIS (CO-CONNECT MIABIS) * IQVIA CO-CONNECT TWINS (CO-CONNECT TWINS) The license request process is manual. When registering for Athena, acknowledgment is required for individual vocabularies requiring a license to access. The requester will receive an email follow-up acknowledgement and instructions for accessing licensed OMOP Vocabulary content. ( src )
• CPT © Copyright 2026 American Medical Association. All rights reserved. AMA and CPT are registered trademarks of the American Medical Association. ( src )
• Copyright © ICAO 2021. All rights reserved. None of the materials provided on this web site may be used, reproduced or transmitted, in whole or in part, in any form or by any means, electronic or mechanical, including photocopying, recording or the use of any information storage and retrieval system, except as provided for in the site [Terms and Conditions](https://www.icao.int/pages/Disclaimer.aspx) without permission in writing from ICAO. ICAO grants permission to Users to visit the Site [https://www.icao.int/Pages/default.aspx] and to download, preprint and copy the information, documents and materials (collectively, "Materials") from the Site for the User’s personal, non-commercial use, without any right to resell or redistribute them or to compile or create derivative works therefrom, subject to the terms and conditions outlined [https://www.icao.int/pages/Disclaimer.aspx], and also subject to more specific restrictions that may apply to specific Material within the Site. ( src )
• Copyright ©2026 World Wide Web Consortium. W3C® liability, trademark and permissive document license rules apply. ( src )
• HL7 Australia© 2018+; Licensed Under Creative Commons No Rights Reserved. ( src )
• Some content from IHE® Copyright © 2015. IHE International, Inc. ( src )
• The Direct Standard® data element labels and mappings to content from HL7 Version 2 are incorporated from ANSI/DS2020-03-101-2024 - Event Notifications via the Direct Standard® Release Version 1.1 - US Realm, which is licensed under Creative Commons "No Rights Reserved" (CC0) by DirectTrust.org, Inc. The Direct Standard™ is a trademark owned by DirectTrust.org, Inc. ( src )
• The copyright for the DICOM® Standard is held by the National Electrical Manufacturers Association. See http://dicomstandard.org/about-home/trademark ( src )
• This material derives from the HL7 Terminology THO. THO is copyright ©1989+ Health Level Seven International and is made available under the CC0 designation. For more licensing information see: https://terminology.hl7.org/license.html ( src )
• © Canadian Association of Emergency Physicians (CAEP). Used with permission of the CTAS National Working Group. Reuse of CTAS materials (including educational content) requires express permission from CAEP/CTAS. ( src )
• "compose" : { "include" : [{ // only modifiers "system" : "http://www.ama-assn.org/go/cpt", "copyright" : "CPT © Copyright 2023 American Medical Association. All rights reserved. AMA and CPT are registered trademarks of the American Medical Association.", "filter" : [{ "property" : "modifier", "op" : "=", "value" : "true" }] }] } ( src )
• "compose" : { "include" : [{ // plain codes (no modifiers) "system" : "http://www.ama-assn.org/go/cpt", "copyright" : "CPT © Copyright 2023 American Medical Association. All rights reserved. AMA and CPT are registered trademarks of the American Medical Association.", "filter" : [{ "property" : "modified", "op" : "=", "value" : "false" },{ "property" : "modifier", "op" : "=", "value" : "false" }] },{ // codes with modifiers (grammar enforces rules) "system" : "http://www.ama-assn.org/go/cpt", "filter" : [{ "property" : "modified", "op" : "=", "value" : "true" }] }] } ( src )
• "compose" : { "include" : [{ // plain codes (no modifiers) "system" : "http://www.ama-assn.org/go/cpt", "copyright" : "CPT © Copyright 2023 American Medical Association. All rights reserved. AMA and CPT are registered trademarks of the American Medical Association.", "filter" : [{ "property" : "modified", "op" : "=", "value" : "false" },{ "property" : "modifier", "op" : "=", "value" : "false" }] }] } ( src )
• "compose" : { "include" : [{ "system" : "http://www.ama-assn.org/go/cpt", "copyright" : "CPT © Copyright 2023 American Medical Association. All rights reserved. AMA and CPT are registered trademarks of the American Medical Association." }] } ( src )
• <copyright value="This material contains content from LOINC (http://loinc.org). Refer to terminology.hl7.org for copyright information. LOINC® is available at no cost under the license at http://loinc.org/license. LOINC® is a registered United States trademark of Regenstrief Institute, Inc."/> ( src )
• 10.3519 Current Procedural Terminology (CPT®) ( src )
• 164.506 Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-506.pdf, assign the HL7 Confidentiality code &quot;R&quot; (restricted)."/> <property> <code value="status"/> <valueCode value="active"/> </property> <property> <code value="subsumedBy"/> <valueCode value="_ActUSPrivacyConsentDirective"/> </property> </concept> <concept> <code value="CompoundResearchCD"/> <display value="Compound HIPAA Research Authorization and Informed Consent for Research"/> <definition value="A code representing an individual's consent directive that complies with HIPAA Privacy rule 45 CFR Section 164.508 Uses and disclosures for which an authorization is required https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf, which is a US Federal law stipulating the policy elements of a valid authorization under this Section specific to disclosures for purposes of research when combined with a Common Rule or Federal Drug Administration consent to participate in research also known as a compound authorization. *Usage Note:* The Agency for Healthcare Research and Quality (AHRQ) has developed the Informed Consent and Authorization Toolkit for Minimal Risk Research to facilitate the process of obtaining informed consent and Health Insurance Portability and Accountability Act (HIPAA) authorization from potential research subjects. This toolkit contains information for people responsible for ensuring that potential research subjects are informed in a manner that is consistent with medical ethics and regulatory guidelines. From https://www.ahrq.gov/sites/default/files/publications/files/ictoolkit.pdf. Used to indicate the legal authority for assigning security labels to governed information. In this case, where collection, access, use, or disclosure of healthcare information is governed by an individual's right of access directive under 45 CFR Section 164.508 use &quot;CompoundResearchCD&quot; as the security label policy code. Information or biospecimen disclosed under the Common Rule are not protected by the HIPAA Privacy Rule. If protected under other laws such as confidentiality provisions under the Common Rule, assign the HL7 Confidentiality code &quot;M&quot; (moderate). See ActCode.\_ActPolicyType.\_ActPrivacyPolicy.\_ActPrivacyLaw.\_ActUSPrivacyLaw.HIPAAAuth (HIPAA Authorization for Disclosure). See: HIPAAAuth and NIH Sample Authorization Language for Research Uses and Disclosures of Individually Identifiable Health Information by a Covered Health Care Provider https://privacyruleandresearch.nih.gov/authorization.asp"/> <property> <code value="status"/> <valueCode value="active"/> </property> <property> <code value="subsumedBy"/> <valueCode value="_ActUSPrivacyConsentDirective"/> </property> </concept> <concept> <code value="HIPAAAuthCD"/> <display value="HIPAA Authorization Consent Directive"/> <definition value="A code representing an individual's consent directive that complies with HIPAA Privacy rule 45 CFR Section 164.508 Uses and disclosures for which an authorization is required https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf, which is a US Federal law stipulating the policy elements of a valid authorization under this Section. An &quot;authorization&quot; is required by the Privacy Rule for uses and disclosures of protected health information not otherwise allowed by the Rule. Where the Privacy Rule requires patient authorization, voluntary consent is not sufficient to permit a use or disclosure of protected health information unless it also satisfies the requirements of a valid authorization. An authorization is a detailed document that gives covered entities permission to use protected health information for specified purposes, which are generally other than treatment, payment, or health care operations, or to disclose protected health information to a third party specified by the individual. An authorization must specify a number of elements, including a description of the protected health information to be used and disclosed, the person authorized to make the use or disclosure, the person to whom the covered entity may make the disclosure, an expiration date, and, in some cases, the purpose for which the information may be used or disclosed. With limited exceptions, covered entities may not condition treatment or coverage on the individual providing an authorization. https://www.hhs.gov/hipaa/for-professionals/faq/264/what-is-the-difference-between-consent-and-authorization/index.html A HIPAA Authorization must comply with 45 CFR Section164.508(c) Implementation specifications: Core elements and requirements - (1) Core elements. A valid authorization under this Section must contain at least the following elements: (i) A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion. (ii) The name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure. (iii) The name or other specific identification of the person(s), or class of persons, to whom the covered entity may make the requested use or disclosure. (iv) A description of each purpose of the requested use or disclosure. The statement &quot;at the request of the individual&quot; is a sufficient description of the purpose when an individual initiates the authorization and does not, or elects not to, provide a statement of the purpose. (v) An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure. The statement &quot;end of the research study,&quot; &quot;none,&quot; or similar language is sufficient if the authorization is for a use or disclosure of protected health information for research, including for the creation and maintenance of a research database or research repository. (vi) Signature of the individual and date. If the authorization is signed by a personal representative of the individual, a description of such representative's authority to act for the individual must also be provided. (2)Required statements. In addition to the core elements, the authorization must contain statements adequate to place the individual on notice of all of the following: (i) The individual's right to revoke the authorization in writing, and either: (A) The exceptions to the right to revoke and a description of how the individual may revoke the authorization; or (B) To the extent that the information in paragraph (c)(2)(i)(A) of this section is included in the notice required by Section 164.520, a reference to the covered entity's notice. https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf *Usage Note:* Used to indicate the legal authority for assigning security labels to HIPAA governed information. In this case, where collection, access, use, or disclosure of healthcare information is governed by a an individual's HIPAA Authorization for Disclosure, use &quot;HIPAAAuthCD&quot; as the security label policy code. Information governed under a HIPAA Authorization for Disclosure has the level of confidentiality protection afforded under the 45 CFR Section 164.506 - Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-506.pdf, which is considered the &quot;norm&quot;, assign the HL7 Confidentiality code &quot;N&quot; (normal)."/> <property> <code value="status"/> <valueCode value="active"/> </property> <property> <code value="subsumedBy"/> <valueCode value="_ActUSPrivacyConsentDirective"/> </property> </concept> <concept> <code value="HIPAAConsentCD"/> <display value="HIPAA Consent Directive"/> <definition value="A code representing U.S. Public Law 104-191 Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule 45 CFR Section 164.522 Rights to request privacy protection for protected health information https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-522.pdf, which stipulates the process by which a covered entity seeks agreement from an individual regarding how it will use and disclose the individual's protected health information for treatment, payment, and health care operations is termed a &quot;consent.&quot; *Usage Note:* Used to indicate the legal authority for assigning security labels to governed information. In this case, where collection, access, use, or disclosure of healthcare information is governed by an individual's consent directive under 45 CFR Section 164.522 use &quot;HIPAAConsentCD&quot; as the security label policy code. Since information governed by a 45 CFR Section 164.522 has a level of confidentiality protection that is more stringent than the normal level of protection under HIPAA 45 CFR Section 164.506 Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-506.pdf, assign the HL7 Confidentiality code &quot;R&quot; (restricted)."/> <property> <code value="status"/> <valueCode value="active"/> </property> <property> <code value="subsumedBy"/> <valueCode value="_ActUSPrivacyConsentDirective"/> </property> </concept> <concept> <code value="HIPAAResearchAuthCD"/> <display value="HIPAA Authorization for Disclosure for Research Consent Directive"/> <definition value="A code representing an individual's consent directive that complies with HIPAA Privacy rule 45 CFR Section 164.508 Uses and disclosures for which an authorization is required https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf, which is a US Federal law stipulating the policy elements of a valid authorization under this Section specific to disclosures for purposes of research. *Usage Note:* Used to indicate the legal authority for assigning security labels to governed information. In this case, where collection, access, use, or disclosure of healthcare information is governed by an individual's HIPAA Authorization for Disclosure for Research under 45 CFR Section 164.508 use &quot;HIPAAResearchAuthCD&quot; as the security label policy code. Information disclosed under an individual's HIPAA Authorization for Disclosure for Research are not protected by the HIPAA Privacy Rule. If protected under other laws such as confidentiality provisions under the Common Rule, assign the HL7 Confidentiality code &quot;M&quot; (moderate). See ActCode.\_ActPolicyType.\_ActPrivacyPolicy.\_ActPrivacyLaw.\_ActUSPrivacyLaw.HIPAAAuth (HIPAA Authorization for Disclosure). See: HIPAAAuth and NIH Sample Authorization Language for Research Uses and Disclosures of Individually Identifiable Health Information by a Covered Health Care Provider https://privacyruleandresearch.nih.gov/authorization.asp"/> <property> <code value="status"/> <valueCode value="active"/> </property> <property> <code value="subsumedBy"/> <valueCode value="_ActUSPrivacyConsentDirective"/> </property> </concept> <concept> <code value="HIPAAROAD"/> <display value="HIPAA Right of Access Directive"/> <definition value="A code representing U.S. Public Law 104-191 Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule 45 CFR Section 164.524 Access of individuals to protected health information https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-524.pdf, stipulating the policy elements of an individual's written and signed right of access directive requesting that a covered entity send the individual's protected health information (PHI) to a third party. See 45 CFR 164.524(c)(3)(ii) If an individual's request for access directs the covered entity to transmit the copy of protected health information directly to another person designated by the individual, the covered entity must provide the copy to the person designated by the individual. The individual's request must be in writing, signed by the individual, and clearly identify the designated person and where to send the copy of protected health information. https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-524.pdf This right applies to PHI in a designated record set, which is defined as &quot;Designated record set means: (1) A group of records maintained by or for a covered entity that is: (i) The medical records and billing records about individuals maintained by or for a covered health care provider; (ii) The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or (iii) Used, in whole or in part, by or for the covered entity to make decisions about individuals. \[https://www.law.cornell.edu/cfr/text/45/164.501\]. Also see HHS Individuals' Right under HIPAA to Access their Health Information 45 CFR Section 164.524 \[https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html\#maximumflatfee\]. *Usage Note:* Used to indicate the legal authority for assigning security labels to governed information. In this case, where collection, access, use, or disclosure of healthcare information is governed by an individual's right of access directive under 45 CFR Section 164.524 use &quot;HIPAAROAD&quot; as the security label policy code. Information disclosed under a HIPAA 42 CFR Section 164.524 no longer has the level of confidentiality protection afforded under the 45 CFR Section 164.506 - Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf, which is considered the &quot;norm&quot;, assign the HL7 Confidentiality code &quot;M&quot; (moderate), which may be protected under other laws such as the Federal Trade Commission privacy and security regulations."/> <property> <code value="status"/> <valueCode value="active"/> </property> <property> <code value="subsumedBy"/> <valueCode value="_ActUSPrivacyConsentDirective"/> </property> </concept> <concept> <code value="MDHHS-5515"/> <display value="Michigan Consent to Share Behavioral Health Information for Care Coordination Purposes"/> <definition value="The State of Michigan standard privacy consent form for sharing of health information specific to behavioral health and substance use treatment in accordance with Public Act 129 of 2014. In Michigan, while providers are not required to use this new standard form (MDHHS-5515), they are required to accept it. *Usage Note:* For legislative background, current MDHHS-5515 consent directive form, and provider and patient FAQs see http://www.michigan.gov/mdhhs/0,5885,7-339-71550\_2941\_58005-343686--,00.html"/> <property> <code value="status"/> <valueCode value="active"/> </property> <property> <code value="subsumedBy"/> <valueCode value="_ActUSPrivacyConsentDirective"/> </property> </concept> <concept> <code value="42CFRPart2"/> <display value="42 CFR Part2"/> <definition value="A code representing 42 CFR Part 2 Confidentiality of Substance Use Disorder Patient Records. 42 CFR Part 2 stipulates the privacy rights of an individual who has applied for or been given diagnosis or treatment for alcohol or drug abuse at a federally assisted program, which includes non-disclosure of health information relating to health care paid for by a federally assisted substance use disorder program without patient consent. https://www.gpo.gov/fdsys/pkg/CFR-2010-title42-vol1/pdf/CFR-2010-title42-vol1-part2.pdf *Usage Note:* Used to indicate the legal authority for assigning security labels to governed information. In this case, the collection, access, use, and disclosure of healthcare information is governed by 42 CFR Part 2 Confidentiality of Substance Use Disorder Patient Records https://www.gpo.gov/fdsys/pkg/CFR-2010-title42-vol1/pdf/CFR-2010-title42-vol1-part2.pdf use &quot;42CFRPart2&quot; as the security label policy code. Since information governed by a 42 CFR Part 2 has a level of confidentiality protection that is more stringent than the normal level of protection under HIPAA 45 CFR Section 164.506 Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-506.pdf assign the HL7 Confidentiality code &quot;R&quot; (restricted)."/> <property> <code value="status"/> <valueCode value="active"/> </property> <property> <code value="subsumedBy"/> <valueCode value="_ActUSPrivacyLaw"/> </property> </concept> <concept> <code value="CommonRule"/> <display value="Common Rule"/> <definition value="A code representing U.S. Federal laws governing research-related privacy policies known as the &quot;Common Rule&quot;. The Common Rule is the U.S. Federal regulations governing the protection of human subjects in research (codified at Subpart A of 45 CFR part 46), which has been adopted by 15 U.S. Federal departments and agencies in an effort to promote uniformity, understanding, and compliance with human subject protections. Existing regulations governing the protection of human subjects in Food and Drug Administration (FDA)-regulated research (21 CFR parts 50, 56, 312, and 812) are separate from the Common Rule but include similar requirements. *Usage Note:* Used to indicate the legal authority for assigning security labels to governed information. In this case, where collection, access, use, or disclosure of healthcare information or biospecimen is governed by the Common Rule use &quot;COMMONRULE&quot; as the security label policy code. Information or biospecimen disclosed under the Common Rule are not protected by the HIPAA Privacy Rule. If protected under other laws such as confidentiality provisions under the Common Rule, assign the HL7 Confidentiality code &quot;M&quot; (moderate)."/> <property> <code value="status"/> <valueCode value="active"/> </property> <property> <code value="subsumedBy"/> <valueCode value="_ActUSPrivacyLaw"/> </property> </concept> <concept> <code value="HIPAAAuth"/> <display value="HIPAA Authorization for Disclosure"/> <definition value="A code representing U.S. Public Law 104-191 Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule (45 CFR Section 164.508) Uses and disclosures for which an authorization is required https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf, which stipulates the process by which a covered entity seeks agreement from an individual to use or disclose protected health information for other purposes, or to authorize another covered entity to disclose protected health information to the requesting covered entity, are termed &quot;authorizations&quot;. An &quot;authorization&quot; is required by the Privacy Rule for uses and disclosures of protected health information not otherwise allowed by the Rule. Where the Privacy Rule requires patient authorization, voluntary consent is not sufficient to permit a use or disclosure of protected health information unless it also satisfies the requirements of a valid authorization. An authorization is a detailed document that gives covered entities permission to use protected health information for specified purposes, which are generally other than treatment, payment, or health care operations, or to disclose protected health information to a third party specified by the individual. An authorization must specify a number of elements, including a description of the protected health information to be used and disclosed, the person authorized to make the use or disclosure, the person to whom the covered entity may make the disclosure, an expiration date, and, in some cases, the purpose for which the information may be used or disclosed. With limited exceptions, covered entities may not condition treatment or coverage on the individual providing an authorization. https://www.hhs.gov/hipaa/for-professionals/faq/264/what-is-the-difference-between-consent-and-authorization/index.html *Usage Note:* Used to indicate the legal authority for assigning security labels to HIPAA governed information. In this case, where use or disclosure of healthcare information is governed by a covered entity's HIPAA Authorization for Disclosure, use &quot;HIPAAAuth&quot; as the security label policy code. Information disclosed under a HIPAA Authorization for Disclosure no longer has the level of confidentiality protection afforded under the 45 CFR Section 164.506 - Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf, which is considered the &quot;norm&quot;, assign the HL7 Confidentiality code &quot;M&quot; (moderate), which may be protected under other laws such as the Federal Trade Commission privacy and security regulations."/> <property> <code value="status"/> <valueCode value="active"/> </property> <property> <code value="subsumedBy"/> <valueCode value="_ActUSPrivacyLaw"/> </property> </concept> <concept> <code value="HIPAAConsent"/> <display value="HIPAA Consent"/> <definition value="A code representing U.S. Public Law 104-191 Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule (45 CFR Section 164.522), which stipulates the process by which a covered entity seeks agreement from an individual regarding how it will use and disclose the individual's protected health information for treatment, payment, and health care operations is termed a &quot;consent&quot;. The Privacy Rule permits, but does not require, a covered entity to voluntarily obtain patient consent for uses and disclosures of protected health information for treatment, payment, and health care operations. Covered entities that do so have complete discretion to design a process that best suits their needs. From https://www.hhs.gov/hipaa/for-professionals/faq/264/what-is-the-difference-between-consent-and-authorization/index.html. The provisions relating to consent are largely contained in Section 164.522 Rights to request privacy protection for protected health information https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-522.pdf. *Usage Note:* Used to indicate the legal authority for assigning security labels to governed information. In this case, where collection, access, use, or disclosure of healthcare information is governed by 45 CFR Section 164.522 use 'HIPAAConsent' as the security label policy code. Since information governed by a 45 CFR Section 164.522 has a level of confidentiality protection that is more stringent than the normal level of protection under HIPAA 45 CFR Section 164.506 Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-506.pdf, assign the HL7 Confidentiality code 'R' (restricted)."/> <property> <code value="status"/> <valueCode value="active"/> </property> <property> <code value="subsumedBy"/> <valueCode value="_ActUSPrivacyLaw"/> </property> </concept> <concept> <code value="HIPAANOPP"/> <display value="HIPAA notice of privacy practices"/> <definition value="A code representing U.S. Public Law 104-191 Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule (45 CFR Section 164.520), which stipulates an individual's right to adequate notice of the uses and disclosures of protected health information that may be made by the covered entity, and of the individual's rights and the covered entity's legal duties with respect to protected health information. Relevant HIPAA Privacy Rule provisions are at Section 164.520 (a) Standard: Notice of privacy practices. https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-520.pdf *Usage Note:* Used to indicate the legal authority for assigning security labels to HIPAA governed information. In this case, if collection, access, use, or disclosure of healthcare information is governed by a covered entity's HIPAA Notice of Privacy Practices, use &quot;HIPAANOPP&quot; as the security label policy code. Information governed under a HIPAA Notice of Privacy Practices has the level of confidentiality protection afforded under the 45 CFR Section 164.506 - Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-506.pdf , which is considered the &quot;norm&quot;, assign the HL7 Confidentiality code &quot;N&quot; (normal)."/> <property> <code value="status"/> <valueCode value="active"/> </property> <property> <code value="subsumedBy"/> <valueCode value="_ActUSPrivacyLaw"/> </property> </concept> <concept> <code value="HIPAAPsyNotes"/> <display value="HIPAA psychotherapy notes"/> <definition value="A code representing U.S. Public Law 104-191 Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule (45 CFR Section 164.508), which stipulates the privacy rights of an individual who is the subject of psychotherapy notes, and requires authorization for certain uses and disclosure of that information. Definition of Psychotherapy notes 45 CFR Section 164.501 https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-501.pdf: Psychotherapy notes means notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual's medical record. Psychotherapy notes excludes medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: Diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date. See Section 164.508 Uses and disclosures for which an authorization is required. (2)Authorization required: Psychotherapy notes https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf: Notwithstanding any provision of this subpart, other than the transition provisions in Section 164.532, a covered entity must obtain an authorization for any use or disclosure of psychotherapy notes, except: (i) To carry out the following treatment, payment, or health care operations: (A) Use by the originator of the psychotherapy notes for treatment; (B) Use or disclosure by the covered entity for its own training programs in which students, trainees, or practitioners in mental health learn under supervision to practice or improve their skills in group, joint, family, or individual counseling; or (C) Use or disclosure by the covered entity to defend itself in a legal action or other proceeding brought by the individual; and (ii) A use or disclosure that is required by Section 164.502(a)(2)(ii) or permitted by Section 164.512(a); Section 164.512(d) with respect to the oversight of the originator of the psychotherapy notes; Section 164.512(g)(1); Section 164.512(j)(1)(i). *Usage Note:* Used to indicate the legal authority for assigning security labels to HIPAA governed information. In this case, the collection, access, use, or disclosure of healthcare information is governed by HIPAA 45 CFR 164.508 (2) Authorization required: Psychotherapy notes https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-506.pdf , use &quot;HIPAAPsyNotes&quot; as the security label policy code. Since information governed by a HIPAA 45 CFR 164.508 (2) has a level of confidentiality protection that is more stringent than the normal level of protection under 45 CFR Section 164.506 Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-506.pdf, assign the HL7 Confidentiality code &quot;R&quot; (restricted)."/> <property> <code value="status"/> <valueCode value="active"/> </property> <property> <code value="subsumedBy"/> <valueCode value="_ActUSPrivacyLaw"/> </property> </concept> <concept> <code value="HIPAAROA"/> <display value="HIPAA Right of Access"/> <definition value="A code representing U.S. Public Law 104-191 Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule 45 CFR Section 164.524 Access of individuals to protected health information https://www.govinfo.gov/app/details/CFR-2017-title45-vol1/CFR-2017-title45-vol1-sec164-524, which stipulates that an individual has a right of access to inspect and obtain a copy of protected health information about the individual in a designated record set, for as long as the protected health information is maintained in the designated record set with exceptions stipulated in HIPAA Privacy Rule Section 164.524. Exceptions include psychotherapy notes and information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding. If an individual's request for access directs the covered entity to transmit the copy of protected health information directly to another person designated by the individual, the covered entity must provide the copy to the person designated by the individual. The individual's request must be in writing, signed by the individual, and clearly identify the designated person and where to send the copy of protected health information. For discussion on extent of right, grounds for denial, and documentation requirements see: HHS Individuals' Right under HIPAA to Access their Health Information 45 CFR Section 164.524 https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html and HHS FAQ on Right of Access vs. HIPAA Authorization https://www.hhs.gov/hipaa/for-professionals/faq/2041/why-depend-on-the-individuals-right/index.html *Usage Note:* Used to indicate the legal authority for assigning security labels to governed information. In this case, where collection, access, use, or disclosure of healthcare information is governed under 45 CFR Section 164.5224 use &quot;HIPAAROA&quot; as the security label policy code. Information disclosed under a HIPAA 42 CFR Section 164.524 no longer has the level of confidentiality protection afforded under the 45 CFR Section 164.506 - Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf, which is considered the &quot;norm&quot;, assign the HL7 Confidentiality code &quot;M&quot; (moderate), which may be protected under other laws such as the Federal Trade Commission privacy and security regulations."/> <property> <code value="status"/> <valueCode value="active"/> </property> <property> <code value="subsumedBy"/> <valueCode value="_ActUSPrivacyLaw"/> </property> </concept> <concept> <code value="HIPAASelfPay"/> <display value="HIPAA self-pay"/> <definition value="A code representing 45 CFR 164.522 Rights to request privacy protection for protected health information, which is a US Federal law stipulating the privacy rights of an individual to restrict disclosure of information related to health care items or services for which the individual pays out of pocket in full to a health plan or payer. See 45 CFR 164.522 https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-522.pdf. (vi) A covered entity must agree to the request of an individual to restrict disclosure of protected health information about the individual to a health plan if: (A) The disclosure is for the purpose of carrying out payment or health care operations and is not otherwise required by law; and (B) The protected health information pertains solely to a health care item or service for which the individual, or person other than the health plan on behalf of the individual, has paid the covered entity in full. *Usage Note:* Used to indicate the legal authority for assigning security labels to HIPAA governed information. In this case, the collection, access, use, or disclosure of healthcare information is governed by HIPAA 45 CFR 164.522 https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-522.pdf use &quot;HIPAASelfPay&quot; as the security label policy code. Since information governed by a HIPAA 45 CFR 164.522 has a level of confidentiality protection that is more stringent than the normal level of protection under 45 CFR Section 164.506 Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-506.pdf, assign the HL7 Confidentiality code &quot;R&quot; (restricted)."/> <property> <code value="status"/> <valueCode value="active"/> </property> <property> <code value="subsumedBy"/> <valueCode value="_ActUSPrivacyLaw"/> </property> </concept> <concept> <code value="Title38Section7332"/> <display value="Title 38 Section 7332"/> <definition value="A code representing Title 38 Section 7332, which is a US Federal law stipulating the privacy rights of veterans diagnosed and treated for substance use disorders, infection with the human immunodeficiency virus, or sickle cell anemia. https://www.gpo.gov/fdsys/granule/USCODE-2011-title38/USCODE-2011-title38-partV-chap73-subchapIII-sec7332/content-detail.html . (1) Records of the identity, diagnosis, prognosis, or treatment of any patient or subject which are maintained in connection with the performance of any program or activity (including education, training, treatment, rehabilitation, or research) relating to drug abuse, alcoholism or alcohol abuse, infection with the human immunodeficiency virus, or sickle cell anemia which is carried out by or for the Department under this title shall, except as provided in subsections (e) and (f), be confidential, and (section 5701 of this title to the contrary notwithstanding) such records may be disclosed only for the purposes and under the circumstances expressly authorized under subsection (b). (2) Paragraph (1) prohibits the disclosure to any person or entity other than the patient or subject concerned of the fact that a special written consent is required in order for such records to be disclosed. (b) (1) The content of any record referred to in subsection (a) may be disclosed by the Secretary in accordance with the prior written consent of the patient or subject with respect to whom such record is maintained, but only to such extent, under such circumstances, and for such purposes as may be allowed in regulations prescribed by the Secretary. (2) Whether or not any patient or subject, with respect to whom any given record referred to in subsection (a) is maintained, gives written consent, the content of such record may be disclosed by the Secretary as follows: (A) To medical personnel to the extent necessary to meet a bona fide medical emergency. (B) To qualified personnel for the purpose of conducting scientific research, management audits, financial audits, or program evaluation, but such personnel may not identify, directly or indirectly, any individual patient or subject in any report of such research, audit, or evaluation, or otherwise disclose patient or subject identities in any manner. (C) (i) In the case of any record which is maintained in connection with the performance of any program or activity relating to infection with the human immunodeficiency virus, to a Federal, State, or local public-health authority charged under Federal or State law with the protection of the public health, and to which Federal or State law requires disclosure of such record, if a qualified representative of such authority has made a written request that such record be provided as required pursuant to such law for a purpose authorized by such law. (ii) A person to whom a record is disclosed under this paragraph may not redisclose or use such record for a purpose other than that for which the disclosure was made. (D) If authorized by an appropriate order of a court of competent jurisdiction granted after application showing good cause therefor. In assessing good cause the court shall weigh the public interest and the need for disclosure against the injury to the patient or subject, to the physician-patient relationship, and to the treatment services. Upon the granting of such order, the court, in determining the extent to which any disclosure of all or any part of any record is necessary, shall impose appropriate safeguards against unauthorized disclosure. (E) To an entity described in paragraph (1)(B) of section 5701(k) of this title, but only to the extent authorized by such section. (F) (i) To a representative of a patient who lacks decision-making capacity, when a practitioner deems the content of the given record necessary for that representative to make an informed decision regarding the patient's treatment. (ii) In this subparagraph, the term &quot;representative&quot; means an individual, organization, or other body authorized under section 7331 of this title and its implementing regulations to give informed consent on behalf of a patient who lacks decision-making capacity. (G) To a State controlled substance monitoring program, including a program approved by the Secretary of Health and Human Services under section 399O of the Public Health Service Act (42 U.S.C. 280g-3), to the extent necessary to prevent misuse and diversion of prescription medicines. (H) (i) To a non-Department entity (including private entities and other Federal agencies) for purposes of providing health care, including hospital care, medical services, and extended care services, to Veterans or performing other health care-related activities or functions. (ii) An entity to which a record is disclosed under this subparagraph may not disclose or use such record for a purpose other than that for which the disclosure was made or as permitted by law. (I) To a third party in order to recover or collect reasonable charges for care furnished to, or paid on behalf of, a Veteran in connection with a non-service connected disability as permitted by section 1729 of this title or for a condition for which recovery is authorized or with respect to which the United States is deemed to be a third party beneficiary under the Act entitled 'An Act to provide for the recovery from tortiously liable third persons of the cost of hospital and medical care and treatment furnished by the United States' (Public Law 87-693; 42 U.S.C. 2651 et seq.; commonly known as the 'Federal Medical Care Recovery Act'). *Usage Note:* Used to indicate the legal authority for assigning security labels to governed information. In this case, where collection, access, use, or disclosure of healthcare information is governed by 38 U.S. Code Section 7332 - Confidentiality of certain medical records https://www.gpo.gov/fdsys/granule/USCODE-2011-title38/USCODE-2011-title38-partV-chap73-subchapIII-sec7332/content-detail.html use &quot;Title38Section7332&quot; as the security label policy code. Since information governed by a Title 38 Section 7332 has a level of confidentiality protection that is more stringent than the normal level of protection under HIPAA 45 CFR Section 164.506 Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-506.pdf, assign the HL7 Confidentiality code &quot;R&quot; (restricted)."/> <property> <code value="status"/> <valueCode value="active"/> </property> <property> <code value="subsumedBy"/> <valueCode value="_ActUSPrivacyLaw"/> </property> </concept> <concept> <code value="a) HIPAAConsent"/> <display value="HIPAA Consent"/> <definition value="Code retired in December 2019 and replaced by code HIPAAConsent. Originally entered with copy/paste error in code value. A code representing U.S. Public Law 104-191 Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule (45 CFR Section 164.522), which stipulates the process by which a covered entity seeks agreement from an individual regarding how it will use and disclose the individual's protected health information for treatment, payment, and health care operations is termed a &quot;consent.&quot; The Privacy Rule permits, but does not require, a covered entity to voluntarily obtain patient consent for uses and disclosures of protected health information for treatment, payment, and health care operations. Covered entities that do so have complete discretion to design a process that best suits their needs. From https://www.hhs.gov/hipaa/for-professionals/faq/264/what-is-the-difference-between-consent-and-authorization/index.html. The provisions relating to consent are largely contained in Section 164.522 Rights to request privacy protection for protected health information https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-522.pdf. *Usage Note:* Used to indicate the legal authority for assigning security labels to governed information. In this case, where collection, access, use, or disclosure of healthcare information is governed by 45 CFR Section 164.522 use &quot;HIPAAConsent&quot; as the security label policy code. Since information governed by a 45 CFR Section 164.522 has a level of confidentiality protection that is more stringent than the normal level of protection under HIPAA 45 CFR Section 164.506 Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-506.pdf, assign the HL7 Confidentiality code &quot;R&quot; (restricted)."/> <property> <code value="status"/> <valueCode value="retired"/> </property> <property> <code value="subsumedBy"/> <valueCode value="_ActUSPrivacyLaw"/> </property> </concept> <concept> <code value="USResearchInformedAssent"/> <display value="Informed Assent for Research"/> <definition value="An informed assertion by a minor who is a candidate research subject, of the individual's willingness to participate in research. Assent means a child's affirmative agreement to participate in a clinical investigation. Mere failure to object should not, absent affirmative agreement, be construed as assent. The minor's assent must be accompanied by parental or guardian consent that the minor participate in a specified research. The assent is not legally binding, however, the accompanying consent is legally binding. Background: In the US, informed assent is governed under 21 CFR Part 50, Subpart D - Additional Safeguards for Children in Clinical Investigations. Available at https://www.law.cornell.edu/cfr/text/21/part-50/subpart-D"/> <property> <code value="status"/> <valueCode value="active"/> </property> <property> <code value="subsumedBy"/> <valueCode value="_ActUSPrivacyConsentDirective"/> </property> </concept> <concept> <code value="USResearchInformedConsent"/> <display value="Informed Consent for Research"/> <definition value="An informed assertion by an adult, or the parent/guardian of a minor who is a candidate research subject, of the individual's willingness to participate in a specified research study. The consent is legally binding. Background: In the US, informed assent is governed under 49 CFR ( src )
• 164.506 Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-506.pdf, assign the HL7 Confidentiality code &quot;R&quot; (restricted).</p> </div></td><td/><td>active</td><td/><td/><td/><td>_ActUSPrivacyConsentDirective</td></tr><tr><td>5</td><td style="white-space:nowrap">        CompoundResearchCD<a name="v3-ActCode-CompoundResearchCD"> </a></td><td>Compound HIPAA Research Authorization and Informed Consent for Research</td><td><div><p>A code representing an individual's consent directive that complies with HIPAA Privacy rule 45 CFR Section 164.508 Uses and disclosures for which an authorization is required https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf, which is a US Federal law stipulating the policy elements of a valid authorization under this Section specific to disclosures for purposes of research when combined with a Common Rule or Federal Drug Administration consent to participate in research also known as a compound authorization.</p> <p><em>Usage Note:</em> The Agency for Healthcare Research and Quality (AHRQ) has developed the Informed Consent and Authorization Toolkit for Minimal Risk Research to facilitate the process of obtaining informed consent and Health Insurance Portability and Accountability Act (HIPAA) authorization from potential research subjects. This toolkit contains information for people responsible for ensuring that potential research subjects are informed in a manner that is consistent with medical ethics and regulatory guidelines. From https://www.ahrq.gov/sites/default/files/publications/files/ictoolkit.pdf.</p> <p>Used to indicate the legal authority for assigning security labels to governed information. In this case, where collection, access, use, or disclosure of healthcare information is governed by an individual's right of access directive under 45 CFR Section 164.508 use &quot;CompoundResearchCD&quot; as the security label policy code.</p> <p>Information or biospecimen disclosed under the Common Rule are not protected by the HIPAA Privacy Rule. If protected under other laws such as confidentiality provisions under the Common Rule, assign the HL7 Confidentiality code &quot;M&quot; (moderate).</p> <p>See ActCode._ActPolicyType._ActPrivacyPolicy._ActPrivacyLaw._ActUSPrivacyLaw.HIPAAAuth (HIPAA Authorization for Disclosure). See: HIPAAAuth and NIH Sample Authorization Language for Research Uses and Disclosures of Individually Identifiable Health Information by a Covered Health Care Provider https://privacyruleandresearch.nih.gov/authorization.asp</p> </div></td><td/><td>active</td><td/><td/><td/><td>_ActUSPrivacyConsentDirective</td></tr><tr><td>5</td><td style="white-space:nowrap">        HIPAAAuthCD<a name="v3-ActCode-HIPAAAuthCD"> </a></td><td>HIPAA Authorization Consent Directive</td><td><div><p>A code representing an individual's consent directive that complies with HIPAA Privacy rule 45 CFR Section 164.508 Uses and disclosures for which an authorization is required https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf, which is a US Federal law stipulating the policy elements of a valid authorization under this Section.</p> <p>An &quot;authorization&quot; is required by the Privacy Rule for uses and disclosures of protected health information not otherwise allowed by the Rule. Where the Privacy Rule requires patient authorization, voluntary consent is not sufficient to permit a use or disclosure of protected health information unless it also satisfies the requirements of a valid authorization. An authorization is a detailed document that gives covered entities permission to use protected health information for specified purposes, which are generally other than treatment, payment, or health care operations, or to disclose protected health information to a third party specified by the individual.</p> <p>An authorization must specify a number of elements, including a description of the protected health information to be used and disclosed, the person authorized to make the use or disclosure, the person to whom the covered entity may make the disclosure, an expiration date, and, in some cases, the purpose for which the information may be used or disclosed. With limited exceptions, covered entities may not condition treatment or coverage on the individual providing an authorization. https://www.hhs.gov/hipaa/for-professionals/faq/264/what-is-the-difference-between-consent-and-authorization/index.html</p> <p>A HIPAA Authorization must comply with 45 CFR Section164.508(c) Implementation specifications: Core elements and requirements - (1) Core elements. A valid authorization under this Section must contain at least the following elements: (i) A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion. (ii) The name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure. (iii) The name or other specific identification of the person(s), or class of persons, to whom the covered entity may make the requested use or disclosure. (iv) A description of each purpose of the requested use or disclosure. The statement &quot;at the request of the individual&quot; is a sufficient description of the purpose when an individual initiates the authorization and does not, or elects not to, provide a statement of the purpose. (v) An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure. The statement &quot;end of the research study,&quot; &quot;none,&quot; or similar language is sufficient if the authorization is for a use or disclosure of protected health information for research, including for the creation and maintenance of a research database or research repository. (vi) Signature of the individual and date. If the authorization is signed by a personal representative of the individual, a description of such representative's authority to act for the individual must also be provided. (2)Required statements. In addition to the core elements, the authorization must contain statements adequate to place the individual on notice of all of the following: (i) The individual's right to revoke the authorization in writing, and either: (A) The exceptions to the right to revoke and a description of how the individual may revoke the authorization; or (B) To the extent that the information in paragraph (c)(2)(i)(A) of this section is included in the notice required by Section 164.520, a reference to the covered entity's notice. https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf</p> <p><em>Usage Note:</em> Used to indicate the legal authority for assigning security labels to HIPAA governed information. In this case, where collection, access, use, or disclosure of healthcare information is governed by a an individual's HIPAA Authorization for Disclosure, use &quot;HIPAAAuthCD&quot; as the security label policy code.</p> <p>Information governed under a HIPAA Authorization for Disclosure has the level of confidentiality protection afforded under the 45 CFR Section 164.506 - Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-506.pdf, which is considered the &quot;norm&quot;, assign the HL7 Confidentiality code &quot;N&quot; (normal).</p> </div></td><td/><td>active</td><td/><td/><td/><td>_ActUSPrivacyConsentDirective</td></tr><tr><td>5</td><td style="white-space:nowrap">        HIPAAConsentCD<a name="v3-ActCode-HIPAAConsentCD"> </a></td><td>HIPAA Consent Directive</td><td><div><p>A code representing U.S. Public Law 104-191 Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule 45 CFR Section 164.522 Rights to request privacy protection for protected health information https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-522.pdf, which stipulates the process by which a covered entity seeks agreement from an individual regarding how it will use and disclose the individual's protected health information for treatment, payment, and health care operations is termed a &quot;consent.&quot;</p> <p><em>Usage Note:</em> Used to indicate the legal authority for assigning security labels to governed information. In this case, where collection, access, use, or disclosure of healthcare information is governed by an individual's consent directive under 45 CFR Section 164.522 use &quot;HIPAAConsentCD&quot; as the security label policy code.</p> <p>Since information governed by a 45 CFR Section 164.522 has a level of confidentiality protection that is more stringent than the normal level of protection under HIPAA 45 CFR Section 164.506 Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-506.pdf, assign the HL7 Confidentiality code &quot;R&quot; (restricted).</p> </div></td><td/><td>active</td><td/><td/><td/><td>_ActUSPrivacyConsentDirective</td></tr><tr><td>5</td><td style="white-space:nowrap">        HIPAAResearchAuthCD<a name="v3-ActCode-HIPAAResearchAuthCD"> </a></td><td>HIPAA Authorization for Disclosure for Research Consent Directive</td><td><div><p>A code representing an individual's consent directive that complies with HIPAA Privacy rule 45 CFR Section 164.508 Uses and disclosures for which an authorization is required https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf, which is a US Federal law stipulating the policy elements of a valid authorization under this Section specific to disclosures for purposes of research.</p> <p><em>Usage Note:</em> Used to indicate the legal authority for assigning security labels to governed information. In this case, where collection, access, use, or disclosure of healthcare information is governed by an individual's HIPAA Authorization for Disclosure for Research under 45 CFR Section 164.508 use &quot;HIPAAResearchAuthCD&quot; as the security label policy code.</p> <p>Information disclosed under an individual's HIPAA Authorization for Disclosure for Research are not protected by the HIPAA Privacy Rule. If protected under other laws such as confidentiality provisions under the Common Rule, assign the HL7 Confidentiality code &quot;M&quot; (moderate).</p> <p>See ActCode._ActPolicyType._ActPrivacyPolicy._ActPrivacyLaw._ActUSPrivacyLaw.HIPAAAuth (HIPAA Authorization for Disclosure). See: HIPAAAuth and NIH Sample Authorization Language for Research Uses and Disclosures of Individually Identifiable Health Information by a Covered Health Care Provider https://privacyruleandresearch.nih.gov/authorization.asp</p> </div></td><td/><td>active</td><td/><td/><td/><td>_ActUSPrivacyConsentDirective</td></tr><tr><td>5</td><td style="white-space:nowrap">        HIPAAROAD<a name="v3-ActCode-HIPAAROAD"> </a></td><td>HIPAA Right of Access Directive</td><td><div><p>A code representing U.S. Public Law 104-191 Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule 45 CFR Section 164.524 Access of individuals to protected health information https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-524.pdf, stipulating the policy elements of an individual's written and signed right of access directive requesting that a covered entity send the individual's protected health information (PHI) to a third party.</p> <p>See 45 CFR 164.524(c)(3)(ii) If an individual's request for access directs the covered entity to transmit the copy of protected health information directly to another person designated by the individual, the covered entity must provide the copy to the person designated by the individual. The individual's request must be in writing, signed by the individual, and clearly identify the designated person and where to send the copy of protected health information. https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-524.pdf</p> <p>This right applies to PHI in a designated record set, which is defined as &quot;Designated record set means: (1) A group of records maintained by or for a covered entity that is: (i) The medical records and billing records about individuals maintained by or for a covered health care provider; (ii) The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or (iii) Used, in whole or in part, by or for the covered entity to make decisions about individuals. [https://www.law.cornell.edu/cfr/text/45/164.501]. Also see HHS Individuals' Right under HIPAA to Access their Health Information 45 CFR Section 164.524 [https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html#maximumflatfee].</p> <p><em>Usage Note:</em> Used to indicate the legal authority for assigning security labels to governed information. In this case, where collection, access, use, or disclosure of healthcare information is governed by an individual's right of access directive under 45 CFR Section 164.524 use &quot;HIPAAROAD&quot; as the security label policy code.</p> <p>Information disclosed under a HIPAA 42 CFR Section 164.524 no longer has the level of confidentiality protection afforded under the 45 CFR Section 164.506 - Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf, which is considered the &quot;norm&quot;, assign the HL7 Confidentiality code &quot;M&quot; (moderate), which may be protected under other laws such as the Federal Trade Commission privacy and security regulations.</p> </div></td><td/><td>active</td><td/><td/><td/><td>_ActUSPrivacyConsentDirective</td></tr><tr><td>5</td><td style="white-space:nowrap">        MDHHS-5515<a name="v3-ActCode-MDHHS-5515"> </a></td><td>Michigan Consent to Share Behavioral Health Information for Care Coordination Purposes</td><td><div><p>The State of Michigan standard privacy consent form for sharing of health information specific to behavioral health and substance use treatment in accordance with Public Act 129 of 2014. In Michigan, while providers are not required to use this new standard form (MDHHS-5515), they are required to accept it.</p> <p><em>Usage Note:</em> For legislative background, current MDHHS-5515 consent directive form, and provider and patient FAQs see http://www.michigan.gov/mdhhs/0,5885,7-339-71550_2941_58005-343686--,00.html</p> </div></td><td/><td>active</td><td/><td/><td/><td>_ActUSPrivacyConsentDirective</td></tr><tr><td>6</td><td style="white-space:nowrap">          MDHHS-5515MMHC<a name="v3-ActCode-MDHHS-5515MMHC"> </a></td><td>Michigan Consent to Share Behavioral Health Information for Care Coordination Purposes-Michigan Mental Health Code</td><td><div><p>The State of Michigan standard privacy consent form for sharing of health information specific to behavioral health governed by the Michigan Mental Health Code Act 258 of 1974, which require patient authorization for purposes other than treatment, payment, and coordination of care, in accordance with Public Act 129 of 2014.</p> <p><em>Usage Note:</em> For legislative background, current MDHHS-5515 consent directive form, and provider and patient FAQs see http://www.michigan.gov/mdhhs/0,5885,7-339-71550_2941_58005-343686--,00.html</p> </div></td><td/><td>active</td><td/><td/><td/><td>MDHHS-5515</td></tr><tr><td>6</td><td style="white-space:nowrap">          MDHHS-5515Part2<a name="v3-ActCode-MDHHS-5515Part2"> </a></td><td>Michigan Consent to Share Behavioral Health Information for Care Coordination Purposes-US 42 CFR Part 2</td><td><div><p>The State of Michigan standard privacy consent form for sharing of health information specific to substance use information governed under US 42 CFR Part 2 in accordance with Public Act 129 of 2014.</p> <p><em>Usage Note:</em> For legislative background, current MDHHS-5515 consent directive form, and provider and patient FAQs see http://www.michigan.gov/mdhhs/0,5885,7-339-71550_2941_58005-343686--,00.html</p> </div></td><td/><td>active</td><td/><td/><td/><td>MDHHS-5515</td></tr><tr><td>5</td><td style="white-space:nowrap">        USResearchInformedAssent<a name="v3-ActCode-USResearchInformedAssent"> </a></td><td>Informed Assent for Research</td><td><div><p>An informed assertion by a minor who is a candidate research subject, of the individual's willingness to participate in research. Assent means a child's affirmative agreement to participate in a clinical investigation. Mere failure to object should not, absent affirmative agreement, be construed as assent. The minor's assent must be accompanied by parental or guardian consent that the minor participate in a specified research. The assent is not legally binding, however, the accompanying consent is legally binding. Background: In the US, informed assent is governed under 21 CFR Part 50, Subpart D - Additional Safeguards for Children in Clinical Investigations. Available at https://www.law.cornell.edu/cfr/text/21/part-50/subpart-D</p> </div></td><td/><td>active</td><td/><td/><td/><td>_ActUSPrivacyConsentDirective</td></tr><tr><td>5</td><td style="white-space:nowrap">        USResearchInformedConsent<a name="v3-ActCode-USResearchInformedConsent"> </a></td><td>Informed Consent for Research</td><td><div><p>An informed assertion by an adult, or the parent/guardian of a minor who is a candidate research subject, of the individual's willingness to participate in a specified research study. The consent is legally binding. Background: In the US, informed assent is governed under 49 CFR ( src )
• 164.506 Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-506.pdf, assign the HL7 Confidentiality code &quot;R&quot; (restricted).</p>\n</div></td><td/><td>active</td><td/><td/><td/><td>_ActUSPrivacyConsentDirective</td></tr><tr><td>5</td><td style=\"white-space:nowrap\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0CompoundResearchCD<a name=\"v3-ActCode-CompoundResearchCD\"> </a></td><td>Compound HIPAA Research Authorization and Informed Consent for Research</td><td><div><p>A code representing an individual's consent directive that complies with HIPAA Privacy rule 45 CFR Section 164.508 Uses and disclosures for which an authorization is required https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf, which is a US Federal law stipulating the policy elements of a valid authorization under this Section specific to disclosures for purposes of research when combined with a Common Rule or Federal Drug Administration consent to participate in research also known as a compound authorization.</p>\n<p><em>Usage Note:</em> The Agency for Healthcare Research and Quality (AHRQ) has developed the Informed Consent and Authorization Toolkit for Minimal Risk Research to facilitate the process of obtaining informed consent and Health Insurance Portability and Accountability Act (HIPAA) authorization from potential research subjects. This toolkit contains information for people responsible for ensuring that potential research subjects are informed in a manner that is consistent with medical ethics and regulatory guidelines. From https://www.ahrq.gov/sites/default/files/publications/files/ictoolkit.pdf.</p>\n<p>Used to indicate the legal authority for assigning security labels to governed information. In this case, where collection, access, use, or disclosure of healthcare information is governed by an individual's right of access directive under 45 CFR Section 164.508 use &quot;CompoundResearchCD&quot; as the security label policy code.</p>\n<p>Information or biospecimen disclosed under the Common Rule are not protected by the HIPAA Privacy Rule. If protected under other laws such as confidentiality provisions under the Common Rule, assign the HL7 Confidentiality code &quot;M&quot; (moderate).</p>\n<p>See ActCode._ActPolicyType._ActPrivacyPolicy._ActPrivacyLaw._ActUSPrivacyLaw.HIPAAAuth (HIPAA Authorization for Disclosure). See: HIPAAAuth and NIH Sample Authorization Language for Research Uses and Disclosures of Individually Identifiable Health Information by a Covered Health Care Provider https://privacyruleandresearch.nih.gov/authorization.asp</p>\n</div></td><td/><td>active</td><td/><td/><td/><td>_ActUSPrivacyConsentDirective</td></tr><tr><td>5</td><td style=\"white-space:nowrap\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0HIPAAAuthCD<a name=\"v3-ActCode-HIPAAAuthCD\"> </a></td><td>HIPAA Authorization Consent Directive</td><td><div><p>A code representing an individual's consent directive that complies with HIPAA Privacy rule 45 CFR Section 164.508 Uses and disclosures for which an authorization is required https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf, which is a US Federal law stipulating the policy elements of a valid authorization under this Section.</p>\n<p>An &quot;authorization&quot; is required by the Privacy Rule for uses and disclosures of protected health information not otherwise allowed by the Rule. Where the Privacy Rule requires patient authorization, voluntary consent is not sufficient to permit a use or disclosure of protected health information unless it also satisfies the requirements of a valid authorization. An authorization is a detailed document that gives covered entities permission to use protected health information for specified purposes, which are generally other than treatment, payment, or health care operations, or to disclose protected health information to a third party specified by the individual.</p>\n<p>An authorization must specify a number of elements, including a description of the protected health information to be used and disclosed, the person authorized to make the use or disclosure, the person to whom the covered entity may make the disclosure, an expiration date, and, in some cases, the purpose for which the information may be used or disclosed. With limited exceptions, covered entities may not condition treatment or coverage on the individual providing an authorization. https://www.hhs.gov/hipaa/for-professionals/faq/264/what-is-the-difference-between-consent-and-authorization/index.html</p>\n<p>A HIPAA Authorization must comply with 45 CFR Section164.508(c) Implementation specifications: Core elements and requirements - (1) Core elements. A valid authorization under this Section must contain at least the following elements: (i) A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion. (ii) The name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure. (iii) The name or other specific identification of the person(s), or class of persons, to whom the covered entity may make the requested use or disclosure. (iv) A description of each purpose of the requested use or disclosure. The statement &quot;at the request of the individual&quot; is a sufficient description of the purpose when an individual initiates the authorization and does not, or elects not to, provide a statement of the purpose. (v) An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure. The statement &quot;end of the research study,&quot; &quot;none,&quot; or similar language is sufficient if the authorization is for a use or disclosure of protected health information for research, including for the creation and maintenance of a research database or research repository. (vi) Signature of the individual and date. If the authorization is signed by a personal representative of the individual, a description of such representative's authority to act for the individual must also be provided. (2)Required statements. In addition to the core elements, the authorization must contain statements adequate to place the individual on notice of all of the following: (i) The individual's right to revoke the authorization in writing, and either: (A) The exceptions to the right to revoke and a description of how the individual may revoke the authorization; or (B) To the extent that the information in paragraph (c)(2)(i)(A) of this section is included in the notice required by Section 164.520, a reference to the covered entity's notice. https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf</p>\n<p><em>Usage Note:</em> Used to indicate the legal authority for assigning security labels to HIPAA governed information. In this case, where collection, access, use, or disclosure of healthcare information is governed by a an individual's HIPAA Authorization for Disclosure, use &quot;HIPAAAuthCD&quot; as the security label policy code.</p>\n<p>Information governed under a HIPAA Authorization for Disclosure has the level of confidentiality protection afforded under the 45 CFR Section 164.506 - Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-506.pdf, which is considered the &quot;norm&quot;, assign the HL7 Confidentiality code &quot;N&quot; (normal).</p>\n</div></td><td/><td>active</td><td/><td/><td/><td>_ActUSPrivacyConsentDirective</td></tr><tr><td>5</td><td style=\"white-space:nowrap\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0HIPAAConsentCD<a name=\"v3-ActCode-HIPAAConsentCD\"> </a></td><td>HIPAA Consent Directive</td><td><div><p>A code representing U.S. Public Law 104-191 Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule 45 CFR Section 164.522 Rights to request privacy protection for protected health information https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-522.pdf, which stipulates the process by which a covered entity seeks agreement from an individual regarding how it will use and disclose the individual's protected health information for treatment, payment, and health care operations is termed a &quot;consent.&quot;</p>\n<p><em>Usage Note:</em> Used to indicate the legal authority for assigning security labels to governed information. In this case, where collection, access, use, or disclosure of healthcare information is governed by an individual's consent directive under 45 CFR Section 164.522 use &quot;HIPAAConsentCD&quot; as the security label policy code.</p>\n<p>Since information governed by a 45 CFR Section 164.522 has a level of confidentiality protection that is more stringent than the normal level of protection under HIPAA 45 CFR Section 164.506 Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-506.pdf, assign the HL7 Confidentiality code &quot;R&quot; (restricted).</p>\n</div></td><td/><td>active</td><td/><td/><td/><td>_ActUSPrivacyConsentDirective</td></tr><tr><td>5</td><td style=\"white-space:nowrap\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0HIPAAResearchAuthCD<a name=\"v3-ActCode-HIPAAResearchAuthCD\"> </a></td><td>HIPAA Authorization for Disclosure for Research Consent Directive</td><td><div><p>A code representing an individual's consent directive that complies with HIPAA Privacy rule 45 CFR Section 164.508 Uses and disclosures for which an authorization is required https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf, which is a US Federal law stipulating the policy elements of a valid authorization under this Section specific to disclosures for purposes of research.</p>\n<p><em>Usage Note:</em> Used to indicate the legal authority for assigning security labels to governed information. In this case, where collection, access, use, or disclosure of healthcare information is governed by an individual's HIPAA Authorization for Disclosure for Research under 45 CFR Section 164.508 use &quot;HIPAAResearchAuthCD&quot; as the security label policy code.</p>\n<p>Information disclosed under an individual's HIPAA Authorization for Disclosure for Research are not protected by the HIPAA Privacy Rule. If protected under other laws such as confidentiality provisions under the Common Rule, assign the HL7 Confidentiality code &quot;M&quot; (moderate).</p>\n<p>See ActCode._ActPolicyType._ActPrivacyPolicy._ActPrivacyLaw._ActUSPrivacyLaw.HIPAAAuth (HIPAA Authorization for Disclosure). See: HIPAAAuth and NIH Sample Authorization Language for Research Uses and Disclosures of Individually Identifiable Health Information by a Covered Health Care Provider https://privacyruleandresearch.nih.gov/authorization.asp</p>\n</div></td><td/><td>active</td><td/><td/><td/><td>_ActUSPrivacyConsentDirective</td></tr><tr><td>5</td><td style=\"white-space:nowrap\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0HIPAAROAD<a name=\"v3-ActCode-HIPAAROAD\"> </a></td><td>HIPAA Right of Access Directive</td><td><div><p>A code representing U.S. Public Law 104-191 Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule 45 CFR Section 164.524 Access of individuals to protected health information https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-524.pdf, stipulating the policy elements of an individual's written and signed right of access directive requesting that a covered entity send the individual's protected health information (PHI) to a third party.</p>\n<p>See 45 CFR 164.524(c)(3)(ii) If an individual's request for access directs the covered entity to transmit the copy of protected health information directly to another person designated by the individual, the covered entity must provide the copy to the person designated by the individual. The individual's request must be in writing, signed by the individual, and clearly identify the designated person and where to send the copy of protected health information. https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-524.pdf</p>\n<p>This right applies to PHI in a designated record set, which is defined as &quot;Designated record set means: (1) A group of records maintained by or for a covered entity that is: (i) The medical records and billing records about individuals maintained by or for a covered health care provider; (ii) The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or (iii) Used, in whole or in part, by or for the covered entity to make decisions about individuals. [https://www.law.cornell.edu/cfr/text/45/164.501]. Also see HHS Individuals' Right under HIPAA to Access their Health Information 45 CFR Section 164.524 [https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html#maximumflatfee].</p>\n<p><em>Usage Note:</em> Used to indicate the legal authority for assigning security labels to governed information. In this case, where collection, access, use, or disclosure of healthcare information is governed by an individual's right of access directive under 45 CFR Section 164.524 use &quot;HIPAAROAD&quot; as the security label policy code.</p>\n<p>Information disclosed under a HIPAA 42 CFR Section 164.524 no longer has the level of confidentiality protection afforded under the 45 CFR Section 164.506 - Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf, which is considered the &quot;norm&quot;, assign the HL7 Confidentiality code &quot;M&quot; (moderate), which may be protected under other laws such as the Federal Trade Commission privacy and security regulations.</p>\n</div></td><td/><td>active</td><td/><td/><td/><td>_ActUSPrivacyConsentDirective</td></tr><tr><td>5</td><td style=\"white-space:nowrap\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0MDHHS-5515<a name=\"v3-ActCode-MDHHS-5515\"> </a></td><td>Michigan Consent to Share Behavioral Health Information for Care Coordination Purposes</td><td><div><p>The State of Michigan standard privacy consent form for sharing of health information specific to behavioral health and substance use treatment in accordance with Public Act 129 of 2014. In Michigan, while providers are not required to use this new standard form (MDHHS-5515), they are required to accept it.</p>\n<p><em>Usage Note:</em> For legislative background, current MDHHS-5515 consent directive form, and provider and patient FAQs see http://www.michigan.gov/mdhhs/0,5885,7-339-71550_2941_58005-343686--,00.html</p>\n</div></td><td/><td>active</td><td/><td/><td/><td>_ActUSPrivacyConsentDirective</td></tr><tr><td>6</td><td style=\"white-space:nowrap\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0MDHHS-5515MMHC<a name=\"v3-ActCode-MDHHS-5515MMHC\"> </a></td><td>Michigan Consent to Share Behavioral Health Information for Care Coordination Purposes-Michigan Mental Health Code</td><td><div><p>The State of Michigan standard privacy consent form for sharing of health information specific to behavioral health governed by the Michigan Mental Health Code Act 258 of 1974, which require patient authorization for purposes other than treatment, payment, and coordination of care, in accordance with Public Act 129 of 2014.</p>\n<p><em>Usage Note:</em> For legislative background, current MDHHS-5515 consent directive form, and provider and patient FAQs see http://www.michigan.gov/mdhhs/0,5885,7-339-71550_2941_58005-343686--,00.html</p>\n</div></td><td/><td>active</td><td/><td/><td/><td>MDHHS-5515</td></tr><tr><td>6</td><td style=\"white-space:nowrap\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0MDHHS-5515Part2<a name=\"v3-ActCode-MDHHS-5515Part2\"> </a></td><td>Michigan Consent to Share Behavioral Health Information for Care Coordination Purposes-US 42 CFR Part 2</td><td><div><p>The State of Michigan standard privacy consent form for sharing of health information specific to substance use information governed under US 42 CFR Part 2 in accordance with Public Act 129 of 2014.</p>\n<p><em>Usage Note:</em> For legislative background, current MDHHS-5515 consent directive form, and provider and patient FAQs see http://www.michigan.gov/mdhhs/0,5885,7-339-71550_2941_58005-343686--,00.html</p>\n</div></td><td/><td>active</td><td/><td/><td/><td>MDHHS-5515</td></tr><tr><td>5</td><td style=\"white-space:nowrap\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0USResearchInformedAssent<a name=\"v3-ActCode-USResearchInformedAssent\"> </a></td><td>Informed Assent for Research</td><td><div><p>An informed assertion by a minor who is a candidate research subject, of the individual's willingness to participate in research. Assent means a child's affirmative agreement to participate in a clinical investigation. Mere failure to object should not, absent affirmative agreement, be construed as assent. The minor's assent must be accompanied by parental or guardian consent that the minor participate in a specified research. The assent is not legally binding, however, the accompanying consent is legally binding. Background: In the US, informed assent is governed under 21 CFR Part 50, Subpart D - Additional Safeguards for Children in Clinical Investigations. Available at https://www.law.cornell.edu/cfr/text/21/part-50/subpart-D</p>\n</div></td><td/><td>active</td><td/><td/><td/><td>_ActUSPrivacyConsentDirective</td></tr><tr><td>5</td><td style=\"white-space:nowrap\">\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0USResearchInformedConsent<a name=\"v3-ActCode-USResearchInformedConsent\"> </a></td><td>Informed Consent for Research</td><td><div><p>An informed assertion by an adult, or the parent/guardian of a minor who is a candidate research subject, of the individual's willingness to participate in a specified research study. The consent is legally binding. Background: In the US, informed assent is governed under 49 CFR ( src )
• 164.506 Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-506.pdf, assign the HL7 Confidentiality code \"R\" (restricted)." ] ; fhir:property ( [ fhir:code [ fhir:v "status" ] ; fhir:value [ a fhir:code ; fhir:v "active" ] ] [ fhir:code [ fhir:v "subsumedBy" ] ; fhir:value [ a fhir:code ; fhir:v "_ActUSPrivacyConsentDirective" ] ] ) ] [ fhir:code [ fhir:v "CompoundResearchCD" ] ; fhir:display [ fhir:v "Compound HIPAA Research Authorization and Informed Consent for Research" ] ; fhir:definition [ fhir:v "A code representing an individual's consent directive that complies with HIPAA Privacy rule 45 CFR Section 164.508 Uses and disclosures for which an authorization is required https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf, which is a US Federal law stipulating the policy elements of a valid authorization under this Section specific to disclosures for purposes of research when combined with a Common Rule or Federal Drug Administration consent to participate in research also known as a compound authorization.\r\n\r\n*Usage Note:* The Agency for Healthcare Research and Quality (AHRQ) has developed the Informed Consent and Authorization Toolkit for Minimal Risk Research to facilitate the process of obtaining informed consent and Health Insurance Portability and Accountability Act (HIPAA) authorization from potential research subjects. This toolkit contains information for people responsible for ensuring that potential research subjects are informed in a manner that is consistent with medical ethics and regulatory guidelines. From https://www.ahrq.gov/sites/default/files/publications/files/ictoolkit.pdf.\r\n\r\nUsed to indicate the legal authority for assigning security labels to governed information. In this case, where collection, access, use, or disclosure of healthcare information is governed by an individual's right of access directive under 45 CFR Section 164.508 use \"CompoundResearchCD\" as the security label policy code.\r\n\r\nInformation or biospecimen disclosed under the Common Rule are not protected by the HIPAA Privacy Rule. If protected under other laws such as confidentiality provisions under the Common Rule, assign the HL7 Confidentiality code \"M\" (moderate).\r\n\r\nSee ActCode.\\_ActPolicyType.\\_ActPrivacyPolicy.\\_ActPrivacyLaw.\\_ActUSPrivacyLaw.HIPAAAuth (HIPAA Authorization for Disclosure). See: HIPAAAuth and NIH Sample Authorization Language for Research Uses and Disclosures of Individually Identifiable Health Information by a Covered Health Care Provider https://privacyruleandresearch.nih.gov/authorization.asp" ] ; fhir:property ( [ fhir:code [ fhir:v "status" ] ; fhir:value [ a fhir:code ; fhir:v "active" ] ] [ fhir:code [ fhir:v "subsumedBy" ] ; fhir:value [ a fhir:code ; fhir:v "_ActUSPrivacyConsentDirective" ] ] ) ] [ fhir:code [ fhir:v "HIPAAAuthCD" ] ; fhir:display [ fhir:v "HIPAA Authorization Consent Directive" ] ; fhir:definition [ fhir:v "A code representing an individual's consent directive that complies with HIPAA Privacy rule 45 CFR Section 164.508 Uses and disclosures for which an authorization is required https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf, which is a US Federal law stipulating the policy elements of a valid authorization under this Section.\r\n\r\nAn \"authorization\" is required by the Privacy Rule for uses and disclosures of protected health information not otherwise allowed by the Rule. Where the Privacy Rule requires patient authorization, voluntary consent is not sufficient to permit a use or disclosure of protected health information unless it also satisfies the requirements of a valid authorization. An authorization is a detailed document that gives covered entities permission to use protected health information for specified purposes, which are generally other than treatment, payment, or health care operations, or to disclose protected health information to a third party specified by the individual.\r\n\r\nAn authorization must specify a number of elements, including a description of the protected health information to be used and disclosed, the person authorized to make the use or disclosure, the person to whom the covered entity may make the disclosure, an expiration date, and, in some cases, the purpose for which the information may be used or disclosed. With limited exceptions, covered entities may not condition treatment or coverage on the individual providing an authorization. https://www.hhs.gov/hipaa/for-professionals/faq/264/what-is-the-difference-between-consent-and-authorization/index.html\r\n\r\nA HIPAA Authorization must comply with 45 CFR Section164.508(c) Implementation specifications: Core elements and requirements - (1) Core elements. A valid authorization under this Section must contain at least the following elements: (i) A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion. (ii) The name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure. (iii) The name or other specific identification of the person(s), or class of persons, to whom the covered entity may make the requested use or disclosure. (iv) A description of each purpose of the requested use or disclosure. The statement \"at the request of the individual\" is a sufficient description of the purpose when an individual initiates the authorization and does not, or elects not to, provide a statement of the purpose. (v) An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure. The statement \"end of the research study,\" \"none,\" or similar language is sufficient if the authorization is for a use or disclosure of protected health information for research, including for the creation and maintenance of a research database or research repository. (vi) Signature of the individual and date. If the authorization is signed by a personal representative of the individual, a description of such representative's authority to act for the individual must also be provided. (2)Required statements. In addition to the core elements, the authorization must contain statements adequate to place the individual on notice of all of the following: (i) The individual's right to revoke the authorization in writing, and either: (A) The exceptions to the right to revoke and a description of how the individual may revoke the authorization; or (B) To the extent that the information in paragraph (c)(2)(i)(A) of this section is included in the notice required by Section 164.520, a reference to the covered entity's notice. https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf\r\n\r\n*Usage Note:* Used to indicate the legal authority for assigning security labels to HIPAA governed information. In this case, where collection, access, use, or disclosure of healthcare information is governed by a an individual's HIPAA Authorization for Disclosure, use \"HIPAAAuthCD\" as the security label policy code.\r\n\r\nInformation governed under a HIPAA Authorization for Disclosure has the level of confidentiality protection afforded under the 45 CFR Section 164.506 - Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-506.pdf, which is considered the \"norm\", assign the HL7 Confidentiality code \"N\" (normal)." ] ; fhir:property ( [ fhir:code [ fhir:v "status" ] ; fhir:value [ a fhir:code ; fhir:v "active" ] ] [ fhir:code [ fhir:v "subsumedBy" ] ; fhir:value [ a fhir:code ; fhir:v "_ActUSPrivacyConsentDirective" ] ] ) ] [ fhir:code [ fhir:v "HIPAAConsentCD" ] ; fhir:display [ fhir:v "HIPAA Consent Directive" ] ; fhir:definition [ fhir:v "A code representing U.S. Public Law 104-191 Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule 45 CFR Section 164.522 Rights to request privacy protection for protected health information https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-522.pdf, which stipulates the process by which a covered entity seeks agreement from an individual regarding how it will use and disclose the individual's protected health information for treatment, payment, and health care operations is termed a \"consent.\"\r\n\r\n*Usage Note:* Used to indicate the legal authority for assigning security labels to governed information. In this case, where collection, access, use, or disclosure of healthcare information is governed by an individual's consent directive under 45 CFR Section 164.522 use \"HIPAAConsentCD\" as the security label policy code.\r\n\r\nSince information governed by a 45 CFR Section 164.522 has a level of confidentiality protection that is more stringent than the normal level of protection under HIPAA 45 CFR Section 164.506 Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-506.pdf, assign the HL7 Confidentiality code \"R\" (restricted)." ] ; fhir:property ( [ fhir:code [ fhir:v "status" ] ; fhir:value [ a fhir:code ; fhir:v "active" ] ] [ fhir:code [ fhir:v "subsumedBy" ] ; fhir:value [ a fhir:code ; fhir:v "_ActUSPrivacyConsentDirective" ] ] ) ] [ fhir:code [ fhir:v "HIPAAResearchAuthCD" ] ; fhir:display [ fhir:v "HIPAA Authorization for Disclosure for Research Consent Directive" ] ; fhir:definition [ fhir:v "A code representing an individual's consent directive that complies with HIPAA Privacy rule 45 CFR Section 164.508 Uses and disclosures for which an authorization is required https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf, which is a US Federal law stipulating the policy elements of a valid authorization under this Section specific to disclosures for purposes of research.\r\n\r\n*Usage Note:* Used to indicate the legal authority for assigning security labels to governed information. In this case, where collection, access, use, or disclosure of healthcare information is governed by an individual's HIPAA Authorization for Disclosure for Research under 45 CFR Section 164.508 use \"HIPAAResearchAuthCD\" as the security label policy code.\r\n\r\nInformation disclosed under an individual's HIPAA Authorization for Disclosure for Research are not protected by the HIPAA Privacy Rule. If protected under other laws such as confidentiality provisions under the Common Rule, assign the HL7 Confidentiality code \"M\" (moderate).\r\n\r\nSee ActCode.\\_ActPolicyType.\\_ActPrivacyPolicy.\\_ActPrivacyLaw.\\_ActUSPrivacyLaw.HIPAAAuth (HIPAA Authorization for Disclosure). See: HIPAAAuth and NIH Sample Authorization Language for Research Uses and Disclosures of Individually Identifiable Health Information by a Covered Health Care Provider https://privacyruleandresearch.nih.gov/authorization.asp" ] ; fhir:property ( [ fhir:code [ fhir:v "status" ] ; fhir:value [ a fhir:code ; fhir:v "active" ] ] [ fhir:code [ fhir:v "subsumedBy" ] ; fhir:value [ a fhir:code ; fhir:v "_ActUSPrivacyConsentDirective" ] ] ) ] [ fhir:code [ fhir:v "HIPAAROAD" ] ; fhir:display [ fhir:v "HIPAA Right of Access Directive" ] ; fhir:definition [ fhir:v "A code representing U.S. Public Law 104-191 Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule 45 CFR Section 164.524 Access of individuals to protected health information https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-524.pdf, stipulating the policy elements of an individual's written and signed right of access directive requesting that a covered entity send the individual's protected health information (PHI) to a third party.\r\n\r\nSee 45 CFR 164.524(c)(3)(ii) If an individual's request for access directs the covered entity to transmit the copy of protected health information directly to another person designated by the individual, the covered entity must provide the copy to the person designated by the individual. The individual's request must be in writing, signed by the individual, and clearly identify the designated person and where to send the copy of protected health information. https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-524.pdf\r\n\r\nThis right applies to PHI in a designated record set, which is defined as \"Designated record set means: (1) A group of records maintained by or for a covered entity that is: (i) The medical records and billing records about individuals maintained by or for a covered health care provider; (ii) The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or (iii) Used, in whole or in part, by or for the covered entity to make decisions about individuals. \\[https://www.law.cornell.edu/cfr/text/45/164.501\\]. Also see HHS Individuals' Right under HIPAA to Access their Health Information 45 CFR Section 164.524 \\[https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html\\#maximumflatfee\\].\r\n\r\n*Usage Note:* Used to indicate the legal authority for assigning security labels to governed information. In this case, where collection, access, use, or disclosure of healthcare information is governed by an individual's right of access directive under 45 CFR Section 164.524 use \"HIPAAROAD\" as the security label policy code.\r\n\r\nInformation disclosed under a HIPAA 42 CFR Section 164.524 no longer has the level of confidentiality protection afforded under the 45 CFR Section 164.506 - Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf, which is considered the \"norm\", assign the HL7 Confidentiality code \"M\" (moderate), which may be protected under other laws such as the Federal Trade Commission privacy and security regulations." ] ; fhir:property ( [ fhir:code [ fhir:v "status" ] ; fhir:value [ a fhir:code ; fhir:v "active" ] ] [ fhir:code [ fhir:v "subsumedBy" ] ; fhir:value [ a fhir:code ; fhir:v "_ActUSPrivacyConsentDirective" ] ] ) ] [ fhir:code [ fhir:v "MDHHS-5515" ] ; fhir:display [ fhir:v "Michigan Consent to Share Behavioral Health Information for Care Coordination Purposes" ] ; fhir:definition [ fhir:v "The State of Michigan standard privacy consent form for sharing of health information specific to behavioral health and substance use treatment in accordance with Public Act 129 of 2014. In Michigan, while providers are not required to use this new standard form (MDHHS-5515), they are required to accept it.\r\n\r\n*Usage Note:* For legislative background, current MDHHS-5515 consent directive form, and provider and patient FAQs see http://www.michigan.gov/mdhhs/0,5885,7-339-71550\\_2941\\_58005-343686--,00.html" ] ; fhir:property ( [ fhir:code [ fhir:v "status" ] ; fhir:value [ a fhir:code ; fhir:v "active" ] ] [ fhir:code [ fhir:v "subsumedBy" ] ; fhir:value [ a fhir:code ; fhir:v "_ActUSPrivacyConsentDirective" ] ] ) ] [ fhir:code [ fhir:v "42CFRPart2" ] ; fhir:display [ fhir:v "42 CFR Part2" ] ; fhir:definition [ fhir:v "A code representing 42 CFR Part 2 Confidentiality of Substance Use Disorder Patient Records. 42 CFR Part 2 stipulates the privacy rights of an individual who has applied for or been given diagnosis or treatment for alcohol or drug abuse at a federally assisted program, which includes non-disclosure of health information relating to health care paid for by a federally assisted substance use disorder program without patient consent. https://www.gpo.gov/fdsys/pkg/CFR-2010-title42-vol1/pdf/CFR-2010-title42-vol1-part2.pdf\r\n\r\n*Usage Note:* Used to indicate the legal authority for assigning security labels to governed information. In this case, the collection, access, use, and disclosure of healthcare information is governed by 42 CFR Part 2 Confidentiality of Substance Use Disorder Patient Records https://www.gpo.gov/fdsys/pkg/CFR-2010-title42-vol1/pdf/CFR-2010-title42-vol1-part2.pdf use \"42CFRPart2\" as the security label policy code.\r\n\r\nSince information governed by a 42 CFR Part 2 has a level of confidentiality protection that is more stringent than the normal level of protection under HIPAA 45 CFR Section 164.506 Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-506.pdf assign the HL7 Confidentiality code \"R\" (restricted)." ] ; fhir:property ( [ fhir:code [ fhir:v "status" ] ; fhir:value [ a fhir:code ; fhir:v "active" ] ] [ fhir:code [ fhir:v "subsumedBy" ] ; fhir:value [ a fhir:code ; fhir:v "_ActUSPrivacyLaw" ] ] ) ] [ fhir:code [ fhir:v "CommonRule" ] ; fhir:display [ fhir:v "Common Rule" ] ; fhir:definition [ fhir:v "A code representing U.S. Federal laws governing research-related privacy policies known as the \"Common Rule\". The Common Rule is the U.S. Federal regulations governing the protection of human subjects in research (codified at Subpart A of 45 CFR part 46), which has been adopted by 15 U.S. Federal departments and agencies in an effort to promote uniformity, understanding, and compliance with human subject protections. Existing regulations governing the protection of human subjects in Food and Drug Administration (FDA)-regulated research (21 CFR parts 50, 56, 312, and 812) are separate from the Common Rule but include similar requirements.\r\n\r\n*Usage Note:* Used to indicate the legal authority for assigning security labels to governed information. In this case, where collection, access, use, or disclosure of healthcare information or biospecimen is governed by the Common Rule use \"COMMONRULE\" as the security label policy code. Information or biospecimen disclosed under the Common Rule are not protected by the HIPAA Privacy Rule. If protected under other laws such as confidentiality provisions under the Common Rule, assign the HL7 Confidentiality code \"M\" (moderate)." ] ; fhir:property ( [ fhir:code [ fhir:v "status" ] ; fhir:value [ a fhir:code ; fhir:v "active" ] ] [ fhir:code [ fhir:v "subsumedBy" ] ; fhir:value [ a fhir:code ; fhir:v "_ActUSPrivacyLaw" ] ] ) ] [ fhir:code [ fhir:v "HIPAAAuth" ] ; fhir:display [ fhir:v "HIPAA Authorization for Disclosure" ] ; fhir:definition [ fhir:v "A code representing U.S. Public Law 104-191 Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule (45 CFR Section 164.508) Uses and disclosures for which an authorization is required https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf, which stipulates the process by which a covered entity seeks agreement from an individual to use or disclose protected health information for other purposes, or to authorize another covered entity to disclose protected health information to the requesting covered entity, are termed \"authorizations\".\r\n\r\nAn \"authorization\" is required by the Privacy Rule for uses and disclosures of protected health information not otherwise allowed by the Rule. Where the Privacy Rule requires patient authorization, voluntary consent is not sufficient to permit a use or disclosure of protected health information unless it also satisfies the requirements of a valid authorization. An authorization is a detailed document that gives covered entities permission to use protected health information for specified purposes, which are generally other than treatment, payment, or health care operations, or to disclose protected health information to a third party specified by the individual.\r\n\r\nAn authorization must specify a number of elements, including a description of the protected health information to be used and disclosed, the person authorized to make the use or disclosure, the person to whom the covered entity may make the disclosure, an expiration date, and, in some cases, the purpose for which the information may be used or disclosed. With limited exceptions, covered entities may not condition treatment or coverage on the individual providing an authorization. https://www.hhs.gov/hipaa/for-professionals/faq/264/what-is-the-difference-between-consent-and-authorization/index.html\r\n\r\n*Usage Note:* Used to indicate the legal authority for assigning security labels to HIPAA governed information. In this case, where use or disclosure of healthcare information is governed by a covered entity's HIPAA Authorization for Disclosure, use \"HIPAAAuth\" as the security label policy code.\r\n\r\nInformation disclosed under a HIPAA Authorization for Disclosure no longer has the level of confidentiality protection afforded under the 45 CFR Section 164.506 - Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf, which is considered the \"norm\", assign the HL7 Confidentiality code \"M\" (moderate), which may be protected under other laws such as the Federal Trade Commission privacy and security regulations." ] ; fhir:property ( [ fhir:code [ fhir:v "status" ] ; fhir:value [ a fhir:code ; fhir:v "active" ] ] [ fhir:code [ fhir:v "subsumedBy" ] ; fhir:value [ a fhir:code ; fhir:v "_ActUSPrivacyLaw" ] ] ) ] [ fhir:code [ fhir:v "HIPAAConsent" ] ; fhir:display [ fhir:v "HIPAA Consent" ] ; fhir:definition [ fhir:v "A code representing U.S. Public Law 104-191 Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule (45 CFR Section 164.522), which stipulates the process by which a covered entity seeks agreement from an individual regarding how it will use and disclose the individual's protected health information for treatment, payment, and health care operations is termed a \"consent\".\r\n\r\nThe Privacy Rule permits, but does not require, a covered entity to voluntarily obtain patient consent for uses and disclosures of protected health information for treatment, payment, and health care operations. Covered entities that do so have complete discretion to design a process that best suits their needs. From https://www.hhs.gov/hipaa/for-professionals/faq/264/what-is-the-difference-between-consent-and-authorization/index.html. The provisions relating to consent are largely contained in Section 164.522 Rights to request privacy protection for protected health information https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-522.pdf.\r\n\r\n*Usage Note:* Used to indicate the legal authority for assigning security labels to governed information. In this case, where collection, access, use, or disclosure of healthcare information is governed by 45 CFR Section 164.522 use 'HIPAAConsent' as the security label policy code.\r\n\r\nSince information governed by a 45 CFR Section 164.522 has a level of confidentiality protection that is more stringent than the normal level of protection under HIPAA 45 CFR Section 164.506 Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-506.pdf, assign the HL7 Confidentiality code 'R' (restricted)." ] ; fhir:property ( [ fhir:code [ fhir:v "status" ] ; fhir:value [ a fhir:code ; fhir:v "active" ] ] [ fhir:code [ fhir:v "subsumedBy" ] ; fhir:value [ a fhir:code ; fhir:v "_ActUSPrivacyLaw" ] ] ) ] [ fhir:code [ fhir:v "HIPAANOPP" ] ; fhir:display [ fhir:v "HIPAA notice of privacy practices" ] ; fhir:definition [ fhir:v "A code representing U.S. Public Law 104-191 Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule (45 CFR Section 164.520), which stipulates an individual's right to adequate notice of the uses and disclosures of protected health information that may be made by the covered entity, and of the individual's rights and the covered entity's legal duties with respect to protected health information. Relevant HIPAA Privacy Rule provisions are at Section 164.520 (a) Standard: Notice of privacy practices. https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-520.pdf\r\n\r\n*Usage Note:* Used to indicate the legal authority for assigning security labels to HIPAA governed information. In this case, if collection, access, use, or disclosure of healthcare information is governed by a covered entity's HIPAA Notice of Privacy Practices, use \"HIPAANOPP\" as the security label policy code.\r\n\r\nInformation governed under a HIPAA Notice of Privacy Practices has the level of confidentiality protection afforded under the 45 CFR Section 164.506 - Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-506.pdf , which is considered the \"norm\", assign the HL7 Confidentiality code \"N\" (normal)." ] ; fhir:property ( [ fhir:code [ fhir:v "status" ] ; fhir:value [ a fhir:code ; fhir:v "active" ] ] [ fhir:code [ fhir:v "subsumedBy" ] ; fhir:value [ a fhir:code ; fhir:v "_ActUSPrivacyLaw" ] ] ) ] [ fhir:code [ fhir:v "HIPAAPsyNotes" ] ; fhir:display [ fhir:v "HIPAA psychotherapy notes" ] ; fhir:definition [ fhir:v "A code representing U.S. Public Law 104-191 Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule (45 CFR Section 164.508), which stipulates the privacy rights of an individual who is the subject of psychotherapy notes, and requires authorization for certain uses and disclosure of that information.\r\n\r\nDefinition of Psychotherapy notes 45 CFR Section 164.501 https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-501.pdf: Psychotherapy notes means notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual's medical record. Psychotherapy notes excludes medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: Diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date.\r\n\r\nSee Section 164.508 Uses and disclosures for which an authorization is required. (2)Authorization required: Psychotherapy notes https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf: Notwithstanding any provision of this subpart, other than the transition provisions in Section 164.532, a covered entity must obtain an authorization for any use or disclosure of psychotherapy notes, except: (i) To carry out the following treatment, payment, or health care operations: (A) Use by the originator of the psychotherapy notes for treatment; (B) Use or disclosure by the covered entity for its own training programs in which students, trainees, or practitioners in mental health learn under supervision to practice or improve their skills in group, joint, family, or individual counseling; or (C) Use or disclosure by the covered entity to defend itself in a legal action or other proceeding brought by the individual; and (ii) A use or disclosure that is required by Section 164.502(a)(2)(ii) or permitted by Section 164.512(a); Section 164.512(d) with respect to the oversight of the originator of the psychotherapy notes; Section 164.512(g)(1); Section 164.512(j)(1)(i).\r\n\r\n*Usage Note:* Used to indicate the legal authority for assigning security labels to HIPAA governed information. In this case, the collection, access, use, or disclosure of healthcare information is governed by HIPAA 45 CFR 164.508 (2) Authorization required: Psychotherapy notes https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-506.pdf , use \"HIPAAPsyNotes\" as the security label policy code.\r\n\r\nSince information governed by a HIPAA 45 CFR 164.508 (2) has a level of confidentiality protection that is more stringent than the normal level of protection under 45 CFR Section 164.506 Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-506.pdf, assign the HL7 Confidentiality code \"R\" (restricted)." ] ; fhir:property ( [ fhir:code [ fhir:v "status" ] ; fhir:value [ a fhir:code ; fhir:v "active" ] ] [ fhir:code [ fhir:v "subsumedBy" ] ; fhir:value [ a fhir:code ; fhir:v "_ActUSPrivacyLaw" ] ] ) ] [ fhir:code [ fhir:v "HIPAAROA" ] ; fhir:display [ fhir:v "HIPAA Right of Access" ] ; fhir:definition [ fhir:v "A code representing U.S. Public Law 104-191 Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule 45 CFR Section 164.524 Access of individuals to protected health information https://www.govinfo.gov/app/details/CFR-2017-title45-vol1/CFR-2017-title45-vol1-sec164-524, which stipulates that an individual has a right of access to inspect and obtain a copy of protected health information about the individual in a designated record set, for as long as the protected health information is maintained in the designated record set with exceptions stipulated in HIPAA Privacy Rule Section 164.524. Exceptions include psychotherapy notes and information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding.\r\n\r\nIf an individual's request for access directs the covered entity to transmit the copy of protected health information directly to another person designated by the individual, the covered entity must provide the copy to the person designated by the individual. The individual's request must be in writing, signed by the individual, and clearly identify the designated person and where to send the copy of protected health information.\r\n\r\nFor discussion on extent of right, grounds for denial, and documentation requirements see: HHS Individuals' Right under HIPAA to Access their Health Information 45 CFR Section 164.524 https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html and HHS FAQ on Right of Access vs. HIPAA Authorization https://www.hhs.gov/hipaa/for-professionals/faq/2041/why-depend-on-the-individuals-right/index.html\r\n\r\n*Usage Note:* Used to indicate the legal authority for assigning security labels to governed information. In this case, where collection, access, use, or disclosure of healthcare information is governed under 45 CFR Section 164.5224 use \"HIPAAROA\" as the security label policy code.\r\n\r\nInformation disclosed under a HIPAA 42 CFR Section 164.524 no longer has the level of confidentiality protection afforded under the 45 CFR Section 164.506 - Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf, which is considered the \"norm\", assign the HL7 Confidentiality code \"M\" (moderate), which may be protected under other laws such as the Federal Trade Commission privacy and security regulations." ] ; fhir:property ( [ fhir:code [ fhir:v "status" ] ; fhir:value [ a fhir:code ; fhir:v "active" ] ] [ fhir:code [ fhir:v "subsumedBy" ] ; fhir:value [ a fhir:code ; fhir:v "_ActUSPrivacyLaw" ] ] ) ] [ fhir:code [ fhir:v "HIPAASelfPay" ] ; fhir:display [ fhir:v "HIPAA self-pay" ] ; fhir:definition [ fhir:v "A code representing 45 CFR 164.522 Rights to request privacy protection for protected health information, which is a US Federal law stipulating the privacy rights of an individual to restrict disclosure of information related to health care items or services for which the individual pays out of pocket in full to a health plan or payer.\r\n\r\nSee 45 CFR 164.522 https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-522.pdf. (vi) A covered entity must agree to the request of an individual to restrict disclosure of protected health information about the individual to a health plan if: (A) The disclosure is for the purpose of carrying out payment or health care operations and is not otherwise required by law; and (B) The protected health information pertains solely to a health care item or service for which the individual, or person other than the health plan on behalf of the individual, has paid the covered entity in full.\r\n\r\n*Usage Note:* Used to indicate the legal authority for assigning security labels to HIPAA governed information. In this case, the collection, access, use, or disclosure of healthcare information is governed by HIPAA 45 CFR 164.522 https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-522.pdf use \"HIPAASelfPay\" as the security label policy code.\r\n\r\nSince information governed by a HIPAA 45 CFR 164.522 has a level of confidentiality protection that is more stringent than the normal level of protection under 45 CFR Section 164.506 Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-506.pdf, assign the HL7 Confidentiality code \"R\" (restricted)." ] ; fhir:property ( [ fhir:code [ fhir:v "status" ] ; fhir:value [ a fhir:code ; fhir:v "active" ] ] [ fhir:code [ fhir:v "subsumedBy" ] ; fhir:value [ a fhir:code ; fhir:v "_ActUSPrivacyLaw" ] ] ) ] [ fhir:code [ fhir:v "Title38Section7332" ] ; fhir:display [ fhir:v "Title 38 Section 7332" ] ; fhir:definition [ fhir:v "A code representing Title 38 Section 7332, which is a US Federal law stipulating the privacy rights of veterans diagnosed and treated for substance use disorders, infection with the human immunodeficiency virus, or sickle cell anemia.\r\n\r\nhttps://www.gpo.gov/fdsys/granule/USCODE-2011-title38/USCODE-2011-title38-partV-chap73-subchapIII-sec7332/content-detail.html . (1) Records of the identity, diagnosis, prognosis, or treatment of any patient or subject which are maintained in connection with the performance of any program or activity (including education, training, treatment, rehabilitation, or research) relating to drug abuse, alcoholism or alcohol abuse, infection with the human immunodeficiency virus, or sickle cell anemia which is carried out by or for the Department under this title shall, except as provided in subsections (e) and (f), be confidential, and (section 5701 of this title to the contrary notwithstanding) such records may be disclosed only for the purposes and under the circumstances expressly authorized under subsection (b). (2) Paragraph (1) prohibits the disclosure to any person or entity other than the patient or subject concerned of the fact that a special written consent is required in order for such records to be disclosed. (b) (1) The content of any record referred to in subsection (a) may be disclosed by the Secretary in accordance with the prior written consent of the patient or subject with respect to whom such record is maintained, but only to such extent, under such circumstances, and for such purposes as may be allowed in regulations prescribed by the Secretary. (2) Whether or not any patient or subject, with respect to whom any given record referred to in subsection (a) is maintained, gives written consent, the content of such record may be disclosed by the Secretary as follows: (A) To medical personnel to the extent necessary to meet a bona fide medical emergency. (B) To qualified personnel for the purpose of conducting scientific research, management audits, financial audits, or program evaluation, but such personnel may not identify, directly or indirectly, any individual patient or subject in any report of such research, audit, or evaluation, or otherwise disclose patient or subject identities in any manner. (C) (i) In the case of any record which is maintained in connection with the performance of any program or activity relating to infection with the human immunodeficiency virus, to a Federal, State, or local public-health authority charged under Federal or State law with the protection of the public health, and to which Federal or State law requires disclosure of such record, if a qualified representative of such authority has made a written request that such record be provided as required pursuant to such law for a purpose authorized by such law. (ii) A person to whom a record is disclosed under this paragraph may not redisclose or use such record for a purpose other than that for which the disclosure was made. (D) If authorized by an appropriate order of a court of competent jurisdiction granted after application showing good cause therefor. In assessing good cause the court shall weigh the public interest and the need for disclosure against the injury to the patient or subject, to the physician-patient relationship, and to the treatment services. Upon the granting of such order, the court, in determining the extent to which any disclosure of all or any part of any record is necessary, shall impose appropriate safeguards against unauthorized disclosure. (E) To an entity described in paragraph (1)(B) of section 5701(k) of this title, but only to the extent authorized by such section. (F) (i) To a representative of a patient who lacks decision-making capacity, when a practitioner deems the content of the given record necessary for that representative to make an informed decision regarding the patient's treatment. (ii) In this subparagraph, the term \"representative\" means an individual, organization, or other body authorized under section 7331 of this title and its implementing regulations to give informed consent on behalf of a patient who lacks decision-making capacity. (G) To a State controlled substance monitoring program, including a program approved by the Secretary of Health and Human Services under section 399O of the Public Health Service Act (42 U.S.C. 280g-3), to the extent necessary to prevent misuse and diversion of prescription medicines. (H) (i) To a non-Department entity (including private entities and other Federal agencies) for purposes of providing health care, including hospital care, medical services, and extended care services, to Veterans or performing other health care-related activities or functions. (ii) An entity to which a record is disclosed under this subparagraph may not disclose or use such record for a purpose other than that for which the disclosure was made or as permitted by law. (I) To a third party in order to recover or collect reasonable charges for care furnished to, or paid on behalf of, a Veteran in connection with a non-service connected disability as permitted by section 1729 of this title or for a condition for which recovery is authorized or with respect to which the United States is deemed to be a third party beneficiary under the Act entitled 'An Act to provide for the recovery from tortiously liable third persons of the cost of hospital and medical care and treatment furnished by the United States' (Public Law 87-693; 42 U.S.C. 2651 et seq.; commonly known as the 'Federal Medical Care Recovery Act').\r\n\r\n*Usage Note:* Used to indicate the legal authority for assigning security labels to governed information. In this case, where collection, access, use, or disclosure of healthcare information is governed by 38 U.S. Code Section 7332 - Confidentiality of certain medical records https://www.gpo.gov/fdsys/granule/USCODE-2011-title38/USCODE-2011-title38-partV-chap73-subchapIII-sec7332/content-detail.html use \"Title38Section7332\" as the security label policy code.\r\n\r\nSince information governed by a Title 38 Section 7332 has a level of confidentiality protection that is more stringent than the normal level of protection under HIPAA 45 CFR Section 164.506 Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-506.pdf, assign the HL7 Confidentiality code \"R\" (restricted)." ] ; fhir:property ( [ fhir:code [ fhir:v "status" ] ; fhir:value [ a fhir:code ; fhir:v "active" ] ] [ fhir:code [ fhir:v "subsumedBy" ] ; fhir:value [ a fhir:code ; fhir:v "_ActUSPrivacyLaw" ] ] ) ] [ fhir:code [ fhir:v "a) HIPAAConsent" ] ; fhir:display [ fhir:v "HIPAA Consent" ] ; fhir:definition [ fhir:v "Code retired in December 2019 and replaced by code HIPAAConsent. Originally entered with copy/paste error in code value.\r\n\r\nA code representing U.S. Public Law 104-191 Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule (45 CFR Section 164.522), which stipulates the process by which a covered entity seeks agreement from an individual regarding how it will use and disclose the individual's protected health information for treatment, payment, and health care operations is termed a \"consent.\" The Privacy Rule permits, but does not require, a covered entity to voluntarily obtain patient consent for uses and disclosures of protected health information for treatment, payment, and health care operations. Covered entities that do so have complete discretion to design a process that best suits their needs. From https://www.hhs.gov/hipaa/for-professionals/faq/264/what-is-the-difference-between-consent-and-authorization/index.html. The provisions relating to consent are largely contained in Section 164.522 Rights to request privacy protection for protected health information https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-522.pdf.\r\n\r\n*Usage Note:* Used to indicate the legal authority for assigning security labels to governed information. In this case, where collection, access, use, or disclosure of healthcare information is governed by 45 CFR Section 164.522 use \"HIPAAConsent\" as the security label policy code.\r\n\r\nSince information governed by a 45 CFR Section 164.522 has a level of confidentiality protection that is more stringent than the normal level of protection under HIPAA 45 CFR Section 164.506 Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-506.pdf, assign the HL7 Confidentiality code \"R\" (restricted)." ] ; fhir:property ( [ fhir:code [ fhir:v "status" ] ; fhir:value [ a fhir:code ; fhir:v "retired" ] ] [ fhir:code [ fhir:v "subsumedBy" ] ; fhir:value [ a fhir:code ; fhir:v "_ActUSPrivacyLaw" ] ] ) ] [ fhir:code [ fhir:v "USResearchInformedAssent" ] ; fhir:display [ fhir:v "Informed Assent for Research" ] ; fhir:definition [ fhir:v "An informed assertion by a minor who is a candidate research subject, of the individual's willingness to participate in research. Assent means a child's affirmative agreement to participate in a clinical investigation. Mere failure to object should not, absent affirmative agreement, be construed as assent. The minor's assent must be accompanied by parental or guardian consent that the minor participate in a specified research. The assent is not legally binding, however, the accompanying consent is legally binding. Background: In the US, informed assent is governed under 21 CFR Part 50, Subpart D - Additional Safeguards for Children in Clinical Investigations. Available at https://www.law.cornell.edu/cfr/text/21/part-50/subpart-D" ] ; fhir:property ( [ fhir:code [ fhir:v "status" ] ; fhir:value [ a fhir:code ; fhir:v "active" ] ] [ fhir:code [ fhir:v "subsumedBy" ] ; fhir:value [ a fhir:code ; fhir:v "_ActUSPrivacyConsentDirective" ] ] ) ] [ fhir:code [ fhir:v "USResearchInformedConsent" ] ; fhir:display [ fhir:v "Informed Consent for Research" ] ; fhir:definition [ fhir:v "An informed assertion by an adult, or the parent/guardian of a minor who is a candidate research subject, of the individual's willingness to participate in a specified research study. The consent is legally binding. Background: In the US, informed assent is governed under 49 CFR ( src )
• 164.506 Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-506.pdf, assign the HL7 Confidentiality code \"R\" (restricted).", "property" : [ { "code" : "status", "valueCode" : "active" }, { "code" : "subsumedBy", "valueCode" : "_ActUSPrivacyConsentDirective" } ] }, { "code" : "CompoundResearchCD", "display" : "Compound HIPAA Research Authorization and Informed Consent for Research", "definition" : "A code representing an individual's consent directive that complies with HIPAA Privacy rule 45 CFR Section 164.508 Uses and disclosures for which an authorization is required https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf, which is a US Federal law stipulating the policy elements of a valid authorization under this Section specific to disclosures for purposes of research when combined with a Common Rule or Federal Drug Administration consent to participate in research also known as a compound authorization.\r\n\r\n*Usage Note:* The Agency for Healthcare Research and Quality (AHRQ) has developed the Informed Consent and Authorization Toolkit for Minimal Risk Research to facilitate the process of obtaining informed consent and Health Insurance Portability and Accountability Act (HIPAA) authorization from potential research subjects. This toolkit contains information for people responsible for ensuring that potential research subjects are informed in a manner that is consistent with medical ethics and regulatory guidelines. From https://www.ahrq.gov/sites/default/files/publications/files/ictoolkit.pdf.\r\n\r\nUsed to indicate the legal authority for assigning security labels to governed information. In this case, where collection, access, use, or disclosure of healthcare information is governed by an individual's right of access directive under 45 CFR Section 164.508 use \"CompoundResearchCD\" as the security label policy code.\r\n\r\nInformation or biospecimen disclosed under the Common Rule are not protected by the HIPAA Privacy Rule. If protected under other laws such as confidentiality provisions under the Common Rule, assign the HL7 Confidentiality code \"M\" (moderate).\r\n\r\nSee ActCode.\\_ActPolicyType.\\_ActPrivacyPolicy.\\_ActPrivacyLaw.\\_ActUSPrivacyLaw.HIPAAAuth (HIPAA Authorization for Disclosure). See: HIPAAAuth and NIH Sample Authorization Language for Research Uses and Disclosures of Individually Identifiable Health Information by a Covered Health Care Provider https://privacyruleandresearch.nih.gov/authorization.asp", "property" : [ { "code" : "status", "valueCode" : "active" }, { "code" : "subsumedBy", "valueCode" : "_ActUSPrivacyConsentDirective" } ] }, { "code" : "HIPAAAuthCD", "display" : "HIPAA Authorization Consent Directive", "definition" : "A code representing an individual's consent directive that complies with HIPAA Privacy rule 45 CFR Section 164.508 Uses and disclosures for which an authorization is required https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf, which is a US Federal law stipulating the policy elements of a valid authorization under this Section.\r\n\r\nAn \"authorization\" is required by the Privacy Rule for uses and disclosures of protected health information not otherwise allowed by the Rule. Where the Privacy Rule requires patient authorization, voluntary consent is not sufficient to permit a use or disclosure of protected health information unless it also satisfies the requirements of a valid authorization. An authorization is a detailed document that gives covered entities permission to use protected health information for specified purposes, which are generally other than treatment, payment, or health care operations, or to disclose protected health information to a third party specified by the individual.\r\n\r\nAn authorization must specify a number of elements, including a description of the protected health information to be used and disclosed, the person authorized to make the use or disclosure, the person to whom the covered entity may make the disclosure, an expiration date, and, in some cases, the purpose for which the information may be used or disclosed. With limited exceptions, covered entities may not condition treatment or coverage on the individual providing an authorization. https://www.hhs.gov/hipaa/for-professionals/faq/264/what-is-the-difference-between-consent-and-authorization/index.html\r\n\r\nA HIPAA Authorization must comply with 45 CFR Section164.508(c) Implementation specifications: Core elements and requirements - (1) Core elements. A valid authorization under this Section must contain at least the following elements: (i) A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion. (ii) The name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure. (iii) The name or other specific identification of the person(s), or class of persons, to whom the covered entity may make the requested use or disclosure. (iv) A description of each purpose of the requested use or disclosure. The statement \"at the request of the individual\" is a sufficient description of the purpose when an individual initiates the authorization and does not, or elects not to, provide a statement of the purpose. (v) An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure. The statement \"end of the research study,\" \"none,\" or similar language is sufficient if the authorization is for a use or disclosure of protected health information for research, including for the creation and maintenance of a research database or research repository. (vi) Signature of the individual and date. If the authorization is signed by a personal representative of the individual, a description of such representative's authority to act for the individual must also be provided. (2)Required statements. In addition to the core elements, the authorization must contain statements adequate to place the individual on notice of all of the following: (i) The individual's right to revoke the authorization in writing, and either: (A) The exceptions to the right to revoke and a description of how the individual may revoke the authorization; or (B) To the extent that the information in paragraph (c)(2)(i)(A) of this section is included in the notice required by Section 164.520, a reference to the covered entity's notice. https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf\r\n\r\n*Usage Note:* Used to indicate the legal authority for assigning security labels to HIPAA governed information. In this case, where collection, access, use, or disclosure of healthcare information is governed by a an individual's HIPAA Authorization for Disclosure, use \"HIPAAAuthCD\" as the security label policy code.\r\n\r\nInformation governed under a HIPAA Authorization for Disclosure has the level of confidentiality protection afforded under the 45 CFR Section 164.506 - Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-506.pdf, which is considered the \"norm\", assign the HL7 Confidentiality code \"N\" (normal).", "property" : [ { "code" : "status", "valueCode" : "active" }, { "code" : "subsumedBy", "valueCode" : "_ActUSPrivacyConsentDirective" } ] }, { "code" : "HIPAAConsentCD", "display" : "HIPAA Consent Directive", "definition" : "A code representing U.S. Public Law 104-191 Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule 45 CFR Section 164.522 Rights to request privacy protection for protected health information https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-522.pdf, which stipulates the process by which a covered entity seeks agreement from an individual regarding how it will use and disclose the individual's protected health information for treatment, payment, and health care operations is termed a \"consent.\"\r\n\r\n*Usage Note:* Used to indicate the legal authority for assigning security labels to governed information. In this case, where collection, access, use, or disclosure of healthcare information is governed by an individual's consent directive under 45 CFR Section 164.522 use \"HIPAAConsentCD\" as the security label policy code.\r\n\r\nSince information governed by a 45 CFR Section 164.522 has a level of confidentiality protection that is more stringent than the normal level of protection under HIPAA 45 CFR Section 164.506 Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-506.pdf, assign the HL7 Confidentiality code \"R\" (restricted).", "property" : [ { "code" : "status", "valueCode" : "active" }, { "code" : "subsumedBy", "valueCode" : "_ActUSPrivacyConsentDirective" } ] }, { "code" : "HIPAAResearchAuthCD", "display" : "HIPAA Authorization for Disclosure for Research Consent Directive", "definition" : "A code representing an individual's consent directive that complies with HIPAA Privacy rule 45 CFR Section 164.508 Uses and disclosures for which an authorization is required https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf, which is a US Federal law stipulating the policy elements of a valid authorization under this Section specific to disclosures for purposes of research.\r\n\r\n*Usage Note:* Used to indicate the legal authority for assigning security labels to governed information. In this case, where collection, access, use, or disclosure of healthcare information is governed by an individual's HIPAA Authorization for Disclosure for Research under 45 CFR Section 164.508 use \"HIPAAResearchAuthCD\" as the security label policy code.\r\n\r\nInformation disclosed under an individual's HIPAA Authorization for Disclosure for Research are not protected by the HIPAA Privacy Rule. If protected under other laws such as confidentiality provisions under the Common Rule, assign the HL7 Confidentiality code \"M\" (moderate).\r\n\r\nSee ActCode.\\_ActPolicyType.\\_ActPrivacyPolicy.\\_ActPrivacyLaw.\\_ActUSPrivacyLaw.HIPAAAuth (HIPAA Authorization for Disclosure). See: HIPAAAuth and NIH Sample Authorization Language for Research Uses and Disclosures of Individually Identifiable Health Information by a Covered Health Care Provider https://privacyruleandresearch.nih.gov/authorization.asp", "property" : [ { "code" : "status", "valueCode" : "active" }, { "code" : "subsumedBy", "valueCode" : "_ActUSPrivacyConsentDirective" } ] }, { "code" : "HIPAAROAD", "display" : "HIPAA Right of Access Directive", "definition" : "A code representing U.S. Public Law 104-191 Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule 45 CFR Section 164.524 Access of individuals to protected health information https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-524.pdf, stipulating the policy elements of an individual's written and signed right of access directive requesting that a covered entity send the individual's protected health information (PHI) to a third party.\r\n\r\nSee 45 CFR 164.524(c)(3)(ii) If an individual's request for access directs the covered entity to transmit the copy of protected health information directly to another person designated by the individual, the covered entity must provide the copy to the person designated by the individual. The individual's request must be in writing, signed by the individual, and clearly identify the designated person and where to send the copy of protected health information. https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-524.pdf\r\n\r\nThis right applies to PHI in a designated record set, which is defined as \"Designated record set means: (1) A group of records maintained by or for a covered entity that is: (i) The medical records and billing records about individuals maintained by or for a covered health care provider; (ii) The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or (iii) Used, in whole or in part, by or for the covered entity to make decisions about individuals. \\[https://www.law.cornell.edu/cfr/text/45/164.501\\]. Also see HHS Individuals' Right under HIPAA to Access their Health Information 45 CFR Section 164.524 \\[https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html\\#maximumflatfee\\].\r\n\r\n*Usage Note:* Used to indicate the legal authority for assigning security labels to governed information. In this case, where collection, access, use, or disclosure of healthcare information is governed by an individual's right of access directive under 45 CFR Section 164.524 use \"HIPAAROAD\" as the security label policy code.\r\n\r\nInformation disclosed under a HIPAA 42 CFR Section 164.524 no longer has the level of confidentiality protection afforded under the 45 CFR Section 164.506 - Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf, which is considered the \"norm\", assign the HL7 Confidentiality code \"M\" (moderate), which may be protected under other laws such as the Federal Trade Commission privacy and security regulations.", "property" : [ { "code" : "status", "valueCode" : "active" }, { "code" : "subsumedBy", "valueCode" : "_ActUSPrivacyConsentDirective" } ] }, { "code" : "MDHHS-5515", "display" : "Michigan Consent to Share Behavioral Health Information for Care Coordination Purposes", "definition" : "The State of Michigan standard privacy consent form for sharing of health information specific to behavioral health and substance use treatment in accordance with Public Act 129 of 2014. In Michigan, while providers are not required to use this new standard form (MDHHS-5515), they are required to accept it.\r\n\r\n*Usage Note:* For legislative background, current MDHHS-5515 consent directive form, and provider and patient FAQs see http://www.michigan.gov/mdhhs/0,5885,7-339-71550\\_2941\\_58005-343686--,00.html", "property" : [ { "code" : "status", "valueCode" : "active" }, { "code" : "subsumedBy", "valueCode" : "_ActUSPrivacyConsentDirective" } ] }, { "code" : "42CFRPart2", "display" : "42 CFR Part2", "definition" : "A code representing 42 CFR Part 2 Confidentiality of Substance Use Disorder Patient Records. 42 CFR Part 2 stipulates the privacy rights of an individual who has applied for or been given diagnosis or treatment for alcohol or drug abuse at a federally assisted program, which includes non-disclosure of health information relating to health care paid for by a federally assisted substance use disorder program without patient consent. https://www.gpo.gov/fdsys/pkg/CFR-2010-title42-vol1/pdf/CFR-2010-title42-vol1-part2.pdf\r\n\r\n*Usage Note:* Used to indicate the legal authority for assigning security labels to governed information. In this case, the collection, access, use, and disclosure of healthcare information is governed by 42 CFR Part 2 Confidentiality of Substance Use Disorder Patient Records https://www.gpo.gov/fdsys/pkg/CFR-2010-title42-vol1/pdf/CFR-2010-title42-vol1-part2.pdf use \"42CFRPart2\" as the security label policy code.\r\n\r\nSince information governed by a 42 CFR Part 2 has a level of confidentiality protection that is more stringent than the normal level of protection under HIPAA 45 CFR Section 164.506 Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-506.pdf assign the HL7 Confidentiality code \"R\" (restricted).", "property" : [ { "code" : "status", "valueCode" : "active" }, { "code" : "subsumedBy", "valueCode" : "_ActUSPrivacyLaw" } ] }, { "code" : "CommonRule", "display" : "Common Rule", "definition" : "A code representing U.S. Federal laws governing research-related privacy policies known as the \"Common Rule\". The Common Rule is the U.S. Federal regulations governing the protection of human subjects in research (codified at Subpart A of 45 CFR part 46), which has been adopted by 15 U.S. Federal departments and agencies in an effort to promote uniformity, understanding, and compliance with human subject protections. Existing regulations governing the protection of human subjects in Food and Drug Administration (FDA)-regulated research (21 CFR parts 50, 56, 312, and 812) are separate from the Common Rule but include similar requirements.\r\n\r\n*Usage Note:* Used to indicate the legal authority for assigning security labels to governed information. In this case, where collection, access, use, or disclosure of healthcare information or biospecimen is governed by the Common Rule use \"COMMONRULE\" as the security label policy code. Information or biospecimen disclosed under the Common Rule are not protected by the HIPAA Privacy Rule. If protected under other laws such as confidentiality provisions under the Common Rule, assign the HL7 Confidentiality code \"M\" (moderate).", "property" : [ { "code" : "status", "valueCode" : "active" }, { "code" : "subsumedBy", "valueCode" : "_ActUSPrivacyLaw" } ] }, { "code" : "HIPAAAuth", "display" : "HIPAA Authorization for Disclosure", "definition" : "A code representing U.S. Public Law 104-191 Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule (45 CFR Section 164.508) Uses and disclosures for which an authorization is required https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf, which stipulates the process by which a covered entity seeks agreement from an individual to use or disclose protected health information for other purposes, or to authorize another covered entity to disclose protected health information to the requesting covered entity, are termed \"authorizations\".\r\n\r\nAn \"authorization\" is required by the Privacy Rule for uses and disclosures of protected health information not otherwise allowed by the Rule. Where the Privacy Rule requires patient authorization, voluntary consent is not sufficient to permit a use or disclosure of protected health information unless it also satisfies the requirements of a valid authorization. An authorization is a detailed document that gives covered entities permission to use protected health information for specified purposes, which are generally other than treatment, payment, or health care operations, or to disclose protected health information to a third party specified by the individual.\r\n\r\nAn authorization must specify a number of elements, including a description of the protected health information to be used and disclosed, the person authorized to make the use or disclosure, the person to whom the covered entity may make the disclosure, an expiration date, and, in some cases, the purpose for which the information may be used or disclosed. With limited exceptions, covered entities may not condition treatment or coverage on the individual providing an authorization. https://www.hhs.gov/hipaa/for-professionals/faq/264/what-is-the-difference-between-consent-and-authorization/index.html\r\n\r\n*Usage Note:* Used to indicate the legal authority for assigning security labels to HIPAA governed information. In this case, where use or disclosure of healthcare information is governed by a covered entity's HIPAA Authorization for Disclosure, use \"HIPAAAuth\" as the security label policy code.\r\n\r\nInformation disclosed under a HIPAA Authorization for Disclosure no longer has the level of confidentiality protection afforded under the 45 CFR Section 164.506 - Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf, which is considered the \"norm\", assign the HL7 Confidentiality code \"M\" (moderate), which may be protected under other laws such as the Federal Trade Commission privacy and security regulations.", "property" : [ { "code" : "status", "valueCode" : "active" }, { "code" : "subsumedBy", "valueCode" : "_ActUSPrivacyLaw" } ] }, { "code" : "HIPAAConsent", "display" : "HIPAA Consent", "definition" : "A code representing U.S. Public Law 104-191 Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule (45 CFR Section 164.522), which stipulates the process by which a covered entity seeks agreement from an individual regarding how it will use and disclose the individual's protected health information for treatment, payment, and health care operations is termed a \"consent\".\r\n\r\nThe Privacy Rule permits, but does not require, a covered entity to voluntarily obtain patient consent for uses and disclosures of protected health information for treatment, payment, and health care operations. Covered entities that do so have complete discretion to design a process that best suits their needs. From https://www.hhs.gov/hipaa/for-professionals/faq/264/what-is-the-difference-between-consent-and-authorization/index.html. The provisions relating to consent are largely contained in Section 164.522 Rights to request privacy protection for protected health information https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-522.pdf.\r\n\r\n*Usage Note:* Used to indicate the legal authority for assigning security labels to governed information. In this case, where collection, access, use, or disclosure of healthcare information is governed by 45 CFR Section 164.522 use 'HIPAAConsent' as the security label policy code.\r\n\r\nSince information governed by a 45 CFR Section 164.522 has a level of confidentiality protection that is more stringent than the normal level of protection under HIPAA 45 CFR Section 164.506 Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-506.pdf, assign the HL7 Confidentiality code 'R' (restricted).", "property" : [ { "code" : "status", "valueCode" : "active" }, { "code" : "subsumedBy", "valueCode" : "_ActUSPrivacyLaw" } ] }, { "code" : "HIPAANOPP", "display" : "HIPAA notice of privacy practices", "definition" : "A code representing U.S. Public Law 104-191 Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule (45 CFR Section 164.520), which stipulates an individual's right to adequate notice of the uses and disclosures of protected health information that may be made by the covered entity, and of the individual's rights and the covered entity's legal duties with respect to protected health information. Relevant HIPAA Privacy Rule provisions are at Section 164.520 (a) Standard: Notice of privacy practices. https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-520.pdf\r\n\r\n*Usage Note:* Used to indicate the legal authority for assigning security labels to HIPAA governed information. In this case, if collection, access, use, or disclosure of healthcare information is governed by a covered entity's HIPAA Notice of Privacy Practices, use \"HIPAANOPP\" as the security label policy code.\r\n\r\nInformation governed under a HIPAA Notice of Privacy Practices has the level of confidentiality protection afforded under the 45 CFR Section 164.506 - Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-506.pdf , which is considered the \"norm\", assign the HL7 Confidentiality code \"N\" (normal).", "property" : [ { "code" : "status", "valueCode" : "active" }, { "code" : "subsumedBy", "valueCode" : "_ActUSPrivacyLaw" } ] }, { "code" : "HIPAAPsyNotes", "display" : "HIPAA psychotherapy notes", "definition" : "A code representing U.S. Public Law 104-191 Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule (45 CFR Section 164.508), which stipulates the privacy rights of an individual who is the subject of psychotherapy notes, and requires authorization for certain uses and disclosure of that information.\r\n\r\nDefinition of Psychotherapy notes 45 CFR Section 164.501 https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-501.pdf: Psychotherapy notes means notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual's medical record. Psychotherapy notes excludes medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: Diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date.\r\n\r\nSee Section 164.508 Uses and disclosures for which an authorization is required. (2)Authorization required: Psychotherapy notes https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf: Notwithstanding any provision of this subpart, other than the transition provisions in Section 164.532, a covered entity must obtain an authorization for any use or disclosure of psychotherapy notes, except: (i) To carry out the following treatment, payment, or health care operations: (A) Use by the originator of the psychotherapy notes for treatment; (B) Use or disclosure by the covered entity for its own training programs in which students, trainees, or practitioners in mental health learn under supervision to practice or improve their skills in group, joint, family, or individual counseling; or (C) Use or disclosure by the covered entity to defend itself in a legal action or other proceeding brought by the individual; and (ii) A use or disclosure that is required by Section 164.502(a)(2)(ii) or permitted by Section 164.512(a); Section 164.512(d) with respect to the oversight of the originator of the psychotherapy notes; Section 164.512(g)(1); Section 164.512(j)(1)(i).\r\n\r\n*Usage Note:* Used to indicate the legal authority for assigning security labels to HIPAA governed information. In this case, the collection, access, use, or disclosure of healthcare information is governed by HIPAA 45 CFR 164.508 (2) Authorization required: Psychotherapy notes https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-506.pdf , use \"HIPAAPsyNotes\" as the security label policy code.\r\n\r\nSince information governed by a HIPAA 45 CFR 164.508 (2) has a level of confidentiality protection that is more stringent than the normal level of protection under 45 CFR Section 164.506 Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-506.pdf, assign the HL7 Confidentiality code \"R\" (restricted).", "property" : [ { "code" : "status", "valueCode" : "active" }, { "code" : "subsumedBy", "valueCode" : "_ActUSPrivacyLaw" } ] }, { "code" : "HIPAAROA", "display" : "HIPAA Right of Access", "definition" : "A code representing U.S. Public Law 104-191 Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule 45 CFR Section 164.524 Access of individuals to protected health information https://www.govinfo.gov/app/details/CFR-2017-title45-vol1/CFR-2017-title45-vol1-sec164-524, which stipulates that an individual has a right of access to inspect and obtain a copy of protected health information about the individual in a designated record set, for as long as the protected health information is maintained in the designated record set with exceptions stipulated in HIPAA Privacy Rule Section 164.524. Exceptions include psychotherapy notes and information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding.\r\n\r\nIf an individual's request for access directs the covered entity to transmit the copy of protected health information directly to another person designated by the individual, the covered entity must provide the copy to the person designated by the individual. The individual's request must be in writing, signed by the individual, and clearly identify the designated person and where to send the copy of protected health information.\r\n\r\nFor discussion on extent of right, grounds for denial, and documentation requirements see: HHS Individuals' Right under HIPAA to Access their Health Information 45 CFR Section 164.524 https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html and HHS FAQ on Right of Access vs. HIPAA Authorization https://www.hhs.gov/hipaa/for-professionals/faq/2041/why-depend-on-the-individuals-right/index.html\r\n\r\n*Usage Note:* Used to indicate the legal authority for assigning security labels to governed information. In this case, where collection, access, use, or disclosure of healthcare information is governed under 45 CFR Section 164.5224 use \"HIPAAROA\" as the security label policy code.\r\n\r\nInformation disclosed under a HIPAA 42 CFR Section 164.524 no longer has the level of confidentiality protection afforded under the 45 CFR Section 164.506 - Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf, which is considered the \"norm\", assign the HL7 Confidentiality code \"M\" (moderate), which may be protected under other laws such as the Federal Trade Commission privacy and security regulations.", "property" : [ { "code" : "status", "valueCode" : "active" }, { "code" : "subsumedBy", "valueCode" : "_ActUSPrivacyLaw" } ] }, { "code" : "HIPAASelfPay", "display" : "HIPAA self-pay", "definition" : "A code representing 45 CFR 164.522 Rights to request privacy protection for protected health information, which is a US Federal law stipulating the privacy rights of an individual to restrict disclosure of information related to health care items or services for which the individual pays out of pocket in full to a health plan or payer.\r\n\r\nSee 45 CFR 164.522 https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-522.pdf. (vi) A covered entity must agree to the request of an individual to restrict disclosure of protected health information about the individual to a health plan if: (A) The disclosure is for the purpose of carrying out payment or health care operations and is not otherwise required by law; and (B) The protected health information pertains solely to a health care item or service for which the individual, or person other than the health plan on behalf of the individual, has paid the covered entity in full.\r\n\r\n*Usage Note:* Used to indicate the legal authority for assigning security labels to HIPAA governed information. In this case, the collection, access, use, or disclosure of healthcare information is governed by HIPAA 45 CFR 164.522 https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-522.pdf use \"HIPAASelfPay\" as the security label policy code.\r\n\r\nSince information governed by a HIPAA 45 CFR 164.522 has a level of confidentiality protection that is more stringent than the normal level of protection under 45 CFR Section 164.506 Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-506.pdf, assign the HL7 Confidentiality code \"R\" (restricted).", "property" : [ { "code" : "status", "valueCode" : "active" }, { "code" : "subsumedBy", "valueCode" : "_ActUSPrivacyLaw" } ] }, { "code" : "Title38Section7332", "display" : "Title 38 Section 7332", "definition" : "A code representing Title 38 Section 7332, which is a US Federal law stipulating the privacy rights of veterans diagnosed and treated for substance use disorders, infection with the human immunodeficiency virus, or sickle cell anemia.\r\n\r\nhttps://www.gpo.gov/fdsys/granule/USCODE-2011-title38/USCODE-2011-title38-partV-chap73-subchapIII-sec7332/content-detail.html . (1) Records of the identity, diagnosis, prognosis, or treatment of any patient or subject which are maintained in connection with the performance of any program or activity (including education, training, treatment, rehabilitation, or research) relating to drug abuse, alcoholism or alcohol abuse, infection with the human immunodeficiency virus, or sickle cell anemia which is carried out by or for the Department under this title shall, except as provided in subsections (e) and (f), be confidential, and (section 5701 of this title to the contrary notwithstanding) such records may be disclosed only for the purposes and under the circumstances expressly authorized under subsection (b). (2) Paragraph (1) prohibits the disclosure to any person or entity other than the patient or subject concerned of the fact that a special written consent is required in order for such records to be disclosed. (b) (1) The content of any record referred to in subsection (a) may be disclosed by the Secretary in accordance with the prior written consent of the patient or subject with respect to whom such record is maintained, but only to such extent, under such circumstances, and for such purposes as may be allowed in regulations prescribed by the Secretary. (2) Whether or not any patient or subject, with respect to whom any given record referred to in subsection (a) is maintained, gives written consent, the content of such record may be disclosed by the Secretary as follows: (A) To medical personnel to the extent necessary to meet a bona fide medical emergency. (B) To qualified personnel for the purpose of conducting scientific research, management audits, financial audits, or program evaluation, but such personnel may not identify, directly or indirectly, any individual patient or subject in any report of such research, audit, or evaluation, or otherwise disclose patient or subject identities in any manner. (C) (i) In the case of any record which is maintained in connection with the performance of any program or activity relating to infection with the human immunodeficiency virus, to a Federal, State, or local public-health authority charged under Federal or State law with the protection of the public health, and to which Federal or State law requires disclosure of such record, if a qualified representative of such authority has made a written request that such record be provided as required pursuant to such law for a purpose authorized by such law. (ii) A person to whom a record is disclosed under this paragraph may not redisclose or use such record for a purpose other than that for which the disclosure was made. (D) If authorized by an appropriate order of a court of competent jurisdiction granted after application showing good cause therefor. In assessing good cause the court shall weigh the public interest and the need for disclosure against the injury to the patient or subject, to the physician-patient relationship, and to the treatment services. Upon the granting of such order, the court, in determining the extent to which any disclosure of all or any part of any record is necessary, shall impose appropriate safeguards against unauthorized disclosure. (E) To an entity described in paragraph (1)(B) of section 5701(k) of this title, but only to the extent authorized by such section. (F) (i) To a representative of a patient who lacks decision-making capacity, when a practitioner deems the content of the given record necessary for that representative to make an informed decision regarding the patient's treatment. (ii) In this subparagraph, the term \"representative\" means an individual, organization, or other body authorized under section 7331 of this title and its implementing regulations to give informed consent on behalf of a patient who lacks decision-making capacity. (G) To a State controlled substance monitoring program, including a program approved by the Secretary of Health and Human Services under section 399O of the Public Health Service Act (42 U.S.C. 280g-3), to the extent necessary to prevent misuse and diversion of prescription medicines. (H) (i) To a non-Department entity (including private entities and other Federal agencies) for purposes of providing health care, including hospital care, medical services, and extended care services, to Veterans or performing other health care-related activities or functions. (ii) An entity to which a record is disclosed under this subparagraph may not disclose or use such record for a purpose other than that for which the disclosure was made or as permitted by law. (I) To a third party in order to recover or collect reasonable charges for care furnished to, or paid on behalf of, a Veteran in connection with a non-service connected disability as permitted by section 1729 of this title or for a condition for which recovery is authorized or with respect to which the United States is deemed to be a third party beneficiary under the Act entitled 'An Act to provide for the recovery from tortiously liable third persons of the cost of hospital and medical care and treatment furnished by the United States' (Public Law 87-693; 42 U.S.C. 2651 et seq.; commonly known as the 'Federal Medical Care Recovery Act').\r\n\r\n*Usage Note:* Used to indicate the legal authority for assigning security labels to governed information. In this case, where collection, access, use, or disclosure of healthcare information is governed by 38 U.S. Code Section 7332 - Confidentiality of certain medical records https://www.gpo.gov/fdsys/granule/USCODE-2011-title38/USCODE-2011-title38-partV-chap73-subchapIII-sec7332/content-detail.html use \"Title38Section7332\" as the security label policy code.\r\n\r\nSince information governed by a Title 38 Section 7332 has a level of confidentiality protection that is more stringent than the normal level of protection under HIPAA 45 CFR Section 164.506 Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-506.pdf, assign the HL7 Confidentiality code \"R\" (restricted).", "property" : [ { "code" : "status", "valueCode" : "active" }, { "code" : "subsumedBy", "valueCode" : "_ActUSPrivacyLaw" } ] }, { "code" : "a) HIPAAConsent", "display" : "HIPAA Consent", "definition" : "Code retired in December 2019 and replaced by code HIPAAConsent. Originally entered with copy/paste error in code value.\r\n\r\nA code representing U.S. Public Law 104-191 Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule (45 CFR Section 164.522), which stipulates the process by which a covered entity seeks agreement from an individual regarding how it will use and disclose the individual's protected health information for treatment, payment, and health care operations is termed a \"consent.\" The Privacy Rule permits, but does not require, a covered entity to voluntarily obtain patient consent for uses and disclosures of protected health information for treatment, payment, and health care operations. Covered entities that do so have complete discretion to design a process that best suits their needs. From https://www.hhs.gov/hipaa/for-professionals/faq/264/what-is-the-difference-between-consent-and-authorization/index.html. The provisions relating to consent are largely contained in Section 164.522 Rights to request privacy protection for protected health information https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-522.pdf.\r\n\r\n*Usage Note:* Used to indicate the legal authority for assigning security labels to governed information. In this case, where collection, access, use, or disclosure of healthcare information is governed by 45 CFR Section 164.522 use \"HIPAAConsent\" as the security label policy code.\r\n\r\nSince information governed by a 45 CFR Section 164.522 has a level of confidentiality protection that is more stringent than the normal level of protection under HIPAA 45 CFR Section 164.506 Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-506.pdf, assign the HL7 Confidentiality code \"R\" (restricted).", "property" : [ { "code" : "status", "valueCode" : "retired" }, { "code" : "subsumedBy", "valueCode" : "_ActUSPrivacyLaw" } ] }, { "code" : "USResearchInformedAssent", "display" : "Informed Assent for Research", "definition" : "An informed assertion by a minor who is a candidate research subject, of the individual's willingness to participate in research. Assent means a child's affirmative agreement to participate in a clinical investigation. Mere failure to object should not, absent affirmative agreement, be construed as assent. The minor's assent must be accompanied by parental or guardian consent that the minor participate in a specified research. The assent is not legally binding, however, the accompanying consent is legally binding. Background: In the US, informed assent is governed under 21 CFR Part 50, Subpart D - Additional Safeguards for Children in Clinical Investigations. Available at https://www.law.cornell.edu/cfr/text/21/part-50/subpart-D", "property" : [ { "code" : "status", "valueCode" : "active" }, { "code" : "subsumedBy", "valueCode" : "_ActUSPrivacyConsentDirective" } ] }, { "code" : "USResearchInformedConsent", "display" : "Informed Consent for Research", "definition" : "An informed assertion by an adult, or the parent/guardian of a minor who is a candidate research subject, of the individual's willingness to participate in a specified research study. The consent is legally binding. Background: In the US, informed assent is governed under 49 CFR ( src )
• 164.506 Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-506.pdf, assign the HL7 Confidentiality code \"R\" (restricted).</p>\n</div></td><td/><td>active</td><td/><td/><td/><td>_ActUSPrivacyConsentDirective</td></tr><tr><td>5</td><td style=\"white-space:nowrap\">        CompoundResearchCD<a name=\"v3-ActCode-CompoundResearchCD\"> </a></td><td>Compound HIPAA Research Authorization and Informed Consent for Research</td><td><div><p>A code representing an individual's consent directive that complies with HIPAA Privacy rule 45 CFR Section 164.508 Uses and disclosures for which an authorization is required https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf, which is a US Federal law stipulating the policy elements of a valid authorization under this Section specific to disclosures for purposes of research when combined with a Common Rule or Federal Drug Administration consent to participate in research also known as a compound authorization.</p>\n<p><em>Usage Note:</em> The Agency for Healthcare Research and Quality (AHRQ) has developed the Informed Consent and Authorization Toolkit for Minimal Risk Research to facilitate the process of obtaining informed consent and Health Insurance Portability and Accountability Act (HIPAA) authorization from potential research subjects. This toolkit contains information for people responsible for ensuring that potential research subjects are informed in a manner that is consistent with medical ethics and regulatory guidelines. From https://www.ahrq.gov/sites/default/files/publications/files/ictoolkit.pdf.</p>\n<p>Used to indicate the legal authority for assigning security labels to governed information. In this case, where collection, access, use, or disclosure of healthcare information is governed by an individual's right of access directive under 45 CFR Section 164.508 use \"CompoundResearchCD\" as the security label policy code.</p>\n<p>Information or biospecimen disclosed under the Common Rule are not protected by the HIPAA Privacy Rule. If protected under other laws such as confidentiality provisions under the Common Rule, assign the HL7 Confidentiality code \"M\" (moderate).</p>\n<p>See ActCode._ActPolicyType._ActPrivacyPolicy._ActPrivacyLaw._ActUSPrivacyLaw.HIPAAAuth (HIPAA Authorization for Disclosure). See: HIPAAAuth and NIH Sample Authorization Language for Research Uses and Disclosures of Individually Identifiable Health Information by a Covered Health Care Provider https://privacyruleandresearch.nih.gov/authorization.asp</p>\n</div></td><td/><td>active</td><td/><td/><td/><td>_ActUSPrivacyConsentDirective</td></tr><tr><td>5</td><td style=\"white-space:nowrap\">        HIPAAAuthCD<a name=\"v3-ActCode-HIPAAAuthCD\"> </a></td><td>HIPAA Authorization Consent Directive</td><td><div><p>A code representing an individual's consent directive that complies with HIPAA Privacy rule 45 CFR Section 164.508 Uses and disclosures for which an authorization is required https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf, which is a US Federal law stipulating the policy elements of a valid authorization under this Section.</p>\n<p>An \"authorization\" is required by the Privacy Rule for uses and disclosures of protected health information not otherwise allowed by the Rule. Where the Privacy Rule requires patient authorization, voluntary consent is not sufficient to permit a use or disclosure of protected health information unless it also satisfies the requirements of a valid authorization. An authorization is a detailed document that gives covered entities permission to use protected health information for specified purposes, which are generally other than treatment, payment, or health care operations, or to disclose protected health information to a third party specified by the individual.</p>\n<p>An authorization must specify a number of elements, including a description of the protected health information to be used and disclosed, the person authorized to make the use or disclosure, the person to whom the covered entity may make the disclosure, an expiration date, and, in some cases, the purpose for which the information may be used or disclosed. With limited exceptions, covered entities may not condition treatment or coverage on the individual providing an authorization. https://www.hhs.gov/hipaa/for-professionals/faq/264/what-is-the-difference-between-consent-and-authorization/index.html</p>\n<p>A HIPAA Authorization must comply with 45 CFR Section164.508(c) Implementation specifications: Core elements and requirements - (1) Core elements. A valid authorization under this Section must contain at least the following elements: (i) A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion. (ii) The name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure. (iii) The name or other specific identification of the person(s), or class of persons, to whom the covered entity may make the requested use or disclosure. (iv) A description of each purpose of the requested use or disclosure. The statement \"at the request of the individual\" is a sufficient description of the purpose when an individual initiates the authorization and does not, or elects not to, provide a statement of the purpose. (v) An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure. The statement \"end of the research study,\" \"none,\" or similar language is sufficient if the authorization is for a use or disclosure of protected health information for research, including for the creation and maintenance of a research database or research repository. (vi) Signature of the individual and date. If the authorization is signed by a personal representative of the individual, a description of such representative's authority to act for the individual must also be provided. (2)Required statements. In addition to the core elements, the authorization must contain statements adequate to place the individual on notice of all of the following: (i) The individual's right to revoke the authorization in writing, and either: (A) The exceptions to the right to revoke and a description of how the individual may revoke the authorization; or (B) To the extent that the information in paragraph (c)(2)(i)(A) of this section is included in the notice required by Section 164.520, a reference to the covered entity's notice. https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf</p>\n<p><em>Usage Note:</em> Used to indicate the legal authority for assigning security labels to HIPAA governed information. In this case, where collection, access, use, or disclosure of healthcare information is governed by a an individual's HIPAA Authorization for Disclosure, use \"HIPAAAuthCD\" as the security label policy code.</p>\n<p>Information governed under a HIPAA Authorization for Disclosure has the level of confidentiality protection afforded under the 45 CFR Section 164.506 - Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-506.pdf, which is considered the \"norm\", assign the HL7 Confidentiality code \"N\" (normal).</p>\n</div></td><td/><td>active</td><td/><td/><td/><td>_ActUSPrivacyConsentDirective</td></tr><tr><td>5</td><td style=\"white-space:nowrap\">        HIPAAConsentCD<a name=\"v3-ActCode-HIPAAConsentCD\"> </a></td><td>HIPAA Consent Directive</td><td><div><p>A code representing U.S. Public Law 104-191 Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule 45 CFR Section 164.522 Rights to request privacy protection for protected health information https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-522.pdf, which stipulates the process by which a covered entity seeks agreement from an individual regarding how it will use and disclose the individual's protected health information for treatment, payment, and health care operations is termed a \"consent.\"</p>\n<p><em>Usage Note:</em> Used to indicate the legal authority for assigning security labels to governed information. In this case, where collection, access, use, or disclosure of healthcare information is governed by an individual's consent directive under 45 CFR Section 164.522 use \"HIPAAConsentCD\" as the security label policy code.</p>\n<p>Since information governed by a 45 CFR Section 164.522 has a level of confidentiality protection that is more stringent than the normal level of protection under HIPAA 45 CFR Section 164.506 Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-506.pdf, assign the HL7 Confidentiality code \"R\" (restricted).</p>\n</div></td><td/><td>active</td><td/><td/><td/><td>_ActUSPrivacyConsentDirective</td></tr><tr><td>5</td><td style=\"white-space:nowrap\">        HIPAAResearchAuthCD<a name=\"v3-ActCode-HIPAAResearchAuthCD\"> </a></td><td>HIPAA Authorization for Disclosure for Research Consent Directive</td><td><div><p>A code representing an individual's consent directive that complies with HIPAA Privacy rule 45 CFR Section 164.508 Uses and disclosures for which an authorization is required https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf, which is a US Federal law stipulating the policy elements of a valid authorization under this Section specific to disclosures for purposes of research.</p>\n<p><em>Usage Note:</em> Used to indicate the legal authority for assigning security labels to governed information. In this case, where collection, access, use, or disclosure of healthcare information is governed by an individual's HIPAA Authorization for Disclosure for Research under 45 CFR Section 164.508 use \"HIPAAResearchAuthCD\" as the security label policy code.</p>\n<p>Information disclosed under an individual's HIPAA Authorization for Disclosure for Research are not protected by the HIPAA Privacy Rule. If protected under other laws such as confidentiality provisions under the Common Rule, assign the HL7 Confidentiality code \"M\" (moderate).</p>\n<p>See ActCode._ActPolicyType._ActPrivacyPolicy._ActPrivacyLaw._ActUSPrivacyLaw.HIPAAAuth (HIPAA Authorization for Disclosure). See: HIPAAAuth and NIH Sample Authorization Language for Research Uses and Disclosures of Individually Identifiable Health Information by a Covered Health Care Provider https://privacyruleandresearch.nih.gov/authorization.asp</p>\n</div></td><td/><td>active</td><td/><td/><td/><td>_ActUSPrivacyConsentDirective</td></tr><tr><td>5</td><td style=\"white-space:nowrap\">        HIPAAROAD<a name=\"v3-ActCode-HIPAAROAD\"> </a></td><td>HIPAA Right of Access Directive</td><td><div><p>A code representing U.S. Public Law 104-191 Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule 45 CFR Section 164.524 Access of individuals to protected health information https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-524.pdf, stipulating the policy elements of an individual's written and signed right of access directive requesting that a covered entity send the individual's protected health information (PHI) to a third party.</p>\n<p>See 45 CFR 164.524(c)(3)(ii) If an individual's request for access directs the covered entity to transmit the copy of protected health information directly to another person designated by the individual, the covered entity must provide the copy to the person designated by the individual. The individual's request must be in writing, signed by the individual, and clearly identify the designated person and where to send the copy of protected health information. https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-524.pdf</p>\n<p>This right applies to PHI in a designated record set, which is defined as \"Designated record set means: (1) A group of records maintained by or for a covered entity that is: (i) The medical records and billing records about individuals maintained by or for a covered health care provider; (ii) The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or (iii) Used, in whole or in part, by or for the covered entity to make decisions about individuals. [https://www.law.cornell.edu/cfr/text/45/164.501]. Also see HHS Individuals' Right under HIPAA to Access their Health Information 45 CFR Section 164.524 [https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html#maximumflatfee].</p>\n<p><em>Usage Note:</em> Used to indicate the legal authority for assigning security labels to governed information. In this case, where collection, access, use, or disclosure of healthcare information is governed by an individual's right of access directive under 45 CFR Section 164.524 use \"HIPAAROAD\" as the security label policy code.</p>\n<p>Information disclosed under a HIPAA 42 CFR Section 164.524 no longer has the level of confidentiality protection afforded under the 45 CFR Section 164.506 - Uses and disclosures to carry out treatment, payment, or health care operations https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf, which is considered the \"norm\", assign the HL7 Confidentiality code \"M\" (moderate), which may be protected under other laws such as the Federal Trade Commission privacy and security regulations.</p>\n</div></td><td/><td>active</td><td/><td/><td/><td>_ActUSPrivacyConsentDirective</td></tr><tr><td>5</td><td style=\"white-space:nowrap\">        MDHHS-5515<a name=\"v3-ActCode-MDHHS-5515\"> </a></td><td>Michigan Consent to Share Behavioral Health Information for Care Coordination Purposes</td><td><div><p>The State of Michigan standard privacy consent form for sharing of health information specific to behavioral health and substance use treatment in accordance with Public Act 129 of 2014. In Michigan, while providers are not required to use this new standard form (MDHHS-5515), they are required to accept it.</p>\n<p><em>Usage Note:</em> For legislative background, current MDHHS-5515 consent directive form, and provider and patient FAQs see http://www.michigan.gov/mdhhs/0,5885,7-339-71550_2941_58005-343686--,00.html</p>\n</div></td><td/><td>active</td><td/><td/><td/><td>_ActUSPrivacyConsentDirective</td></tr><tr><td>6</td><td style=\"white-space:nowrap\">          MDHHS-5515MMHC<a name=\"v3-ActCode-MDHHS-5515MMHC\"> </a></td><td>Michigan Consent to Share Behavioral Health Information for Care Coordination Purposes-Michigan Mental Health Code</td><td><div><p>The State of Michigan standard privacy consent form for sharing of health information specific to behavioral health governed by the Michigan Mental Health Code Act 258 of 1974, which require patient authorization for purposes other than treatment, payment, and coordination of care, in accordance with Public Act 129 of 2014.</p>\n<p><em>Usage Note:</em> For legislative background, current MDHHS-5515 consent directive form, and provider and patient FAQs see http://www.michigan.gov/mdhhs/0,5885,7-339-71550_2941_58005-343686--,00.html</p>\n</div></td><td/><td>active</td><td/><td/><td/><td>MDHHS-5515</td></tr><tr><td>6</td><td style=\"white-space:nowrap\">          MDHHS-5515Part2<a name=\"v3-ActCode-MDHHS-5515Part2\"> </a></td><td>Michigan Consent to Share Behavioral Health Information for Care Coordination Purposes-US 42 CFR Part 2</td><td><div><p>The State of Michigan standard privacy consent form for sharing of health information specific to substance use information governed under US 42 CFR Part 2 in accordance with Public Act 129 of 2014.</p>\n<p><em>Usage Note:</em> For legislative background, current MDHHS-5515 consent directive form, and provider and patient FAQs see http://www.michigan.gov/mdhhs/0,5885,7-339-71550_2941_58005-343686--,00.html</p>\n</div></td><td/><td>active</td><td/><td/><td/><td>MDHHS-5515</td></tr><tr><td>5</td><td style=\"white-space:nowrap\">        USResearchInformedAssent<a name=\"v3-ActCode-USResearchInformedAssent\"> </a></td><td>Informed Assent for Research</td><td><div><p>An informed assertion by a minor who is a candidate research subject, of the individual's willingness to participate in research. Assent means a child's affirmative agreement to participate in a clinical investigation. Mere failure to object should not, absent affirmative agreement, be construed as assent. The minor's assent must be accompanied by parental or guardian consent that the minor participate in a specified research. The assent is not legally binding, however, the accompanying consent is legally binding. Background: In the US, informed assent is governed under 21 CFR Part 50, Subpart D - Additional Safeguards for Children in Clinical Investigations. Available at https://www.law.cornell.edu/cfr/text/21/part-50/subpart-D</p>\n</div></td><td/><td>active</td><td/><td/><td/><td>_ActUSPrivacyConsentDirective</td></tr><tr><td>5</td><td style=\"white-space:nowrap\">        USResearchInformedConsent<a name=\"v3-ActCode-USResearchInformedConsent\"> </a></td><td>Informed Consent for Research</td><td><div><p>An informed assertion by an adult, or the parent/guardian of a minor who is a candidate research subject, of the individual's willingness to participate in a specified research study. The consent is legally binding. Background: In the US, informed assent is governed under 49 CFR ( src )
• "GS1®, under its IP Policy, seeks to avoid uncertainty regarding intellectual property claims by requiring the participants in the Work Group that developed this Healthcare GLN Implementation Guideline to agree to grant to GS1 members a royalty-free licence or a RAND licence to Necessary Claims, as that term is defined in the GS1 IP Policy. Furthermore, attention is drawn to the possibility that an implementation of one or more features of this Specification may be the subject of a patent or other intellectual property right that does not involve a Necessary Claim. Any such patent or other intellectual property right is not subject to the licensing obligations of GS1. Moreover, the agreement to grant licences provided under the GS1 IP Policy does not include IP rights and any claims of third parties who were not participants in the Work Group. ( src )
• "Material on this site is the copyrighted property of the United States Postal Service® (Postal Service™). All rights reserved. The information and images presented here may not under any circumstances be reproduced or used without prior written permission. Users may view and download material from this site only for the following purposes: (a) for personal, non-commercial home use; (b) where the materials clearly state that these materials may be copied and reproduced according to the terms stated in those particular pages; or (c) with the express written permission of the Postal Service. In all other cases, you will need written permission from the Postal Service to reproduce, republish, upload, post, transmit, distribute or publicly display material from this Web site. Users agree not to use the site for sale, trade or other commercial purposes. Users may not use language that is threatening, abusive, vulgar, discourteous or criminal. Users also may not post or transmit information or materials that would violate rights of any third party or which contains a virus or other harmful component. The Postal Service reserves the right to remove or edit any messages or material submitted by users." ( src )
• "The Dun & Bradstreet D-U-N-S® Number (short for Data Universal Numbering System) is a nine-digit unique identifier for businesses. Hundreds of millions of D-U-N-S Numbers exist for companies across the globe. ( src )
• "The Dun & Bradstreet D-U-N-S® Number (short for Data Universal Numbering System) is a nine-digit u… ( src )
• "This material contains content from the pan-Canadian LOINC® Observation Code Database (pCLOCD). Canada Health Infoway Inc. (Infoway) has created pCLOCD from LOINC® to address local requirements in Canada. Infoway maintains the copyright on these localized additions. pCLOCD is available at no cost to users with Standards Access. Access to pan-Canadian standards and supporting information is available to anyone who accepts the applicable license agreements annually. Link to pCLOCD Terms of Use is https://infocentral.infoway-inforoute.ca/8_UserReferencesAndSupports/Terms_And_License_Agreements/pCLOCD_Terms_of_Use. This material also includes a portion of the LOINC table and is subject to a license from Regenstrief Institute, Inc. which is available at http://loinc.org/terms-of-use." ( src )
• "We (RSNA) recognize the benefits that come from radiologists using common language to communicate diagnostic results. For this reason, RSNA produced RadLex®, a comprehensive set of radiology terms for use in radiology reporting, decision support, data mining, data registries, education and research. ( src )
• (c) The OMOP Standardized Vocabularies Copyright Observational Health Data Sciences and Informatics, Columbia University, New York, NY. Licensed under Apache 2.0 ( src )
• **Definition:** an association between two Entities where the playing Entity (the part) is a component of the whole (scoper) in the sense of an integral structural component, that is distinct from other parts in the same whole, has a distinct function in the whole, and, as an effect, the full integrity of the whole depends (to some degree) on the presence of this part, even though the part may often be separable from the whole.**Discussion:** Part is defined in opposition to (a) ingredient (not separable), (b) content (not a functional component), and (c) member (not functionally distinct from other members). ( src )
• : Current Procedural Terminology (CPT®) ( src )
• A HIPAA Authorization must comply with 45 CFR Section164.508(c) Implementation specifications: Core elements and requirements - (1) Core elements. A valid authorization under this Section must contain at least the following elements: (i) A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion. (ii) The name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure. (iii) The name or other specific identification of the person(s), or class of persons, to whom the covered entity may make the requested use or disclosure. (iv) A description of each purpose of the requested use or disclosure. The statement "at the request of the individual" is a sufficient description of the purpose when an individual initiates the authorization and does not, or elects not to, provide a statement of the purpose. (v) An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure. The statement "end of the research study," "none," or similar language is sufficient if the authorization is for a use or disclosure of protected health information for research, including for the creation and maintenance of a research database or research repository. (vi) Signature of the individual and date. If the authorization is signed by a personal representative of the individual, a description of such representative's authority to act for the individual must also be provided. (2)Required statements. In addition to the core elements, the authorization must contain statements adequate to place the individual on notice of all of the following: (i) The individual's right to revoke the authorization in writing, and either: (A) The exceptions to the right to revoke and a description of how the individual may revoke the authorization; or (B) To the extent that the information in paragraph (c)(2)(i)(A) of this section is included in the notice required by Section 164.520, a reference to the covered entity's notice. https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf ( src )
• A code representing Title 38 Section 7332, which is a US Federal law stipulating the privacy rights of veterans diagnosed and treated for substance use disorders, infection with the human immunodeficiency virus, or sickle cell anemia. Title 38 Section 7332 - Confidentiality of certain medical records https://www.gpo.gov/fdsys/granule/USCODE-2011-title38/USCODE-2011-title38-partV-chap73-subchapIII-sec7332/content-detail.html (1) Records of the identity, diagnosis, prognosis, or treatment of any patient or subject which are maintained in connection with the performance of any program or activity (including education, training, treatment, rehabilitation, or research) relating to drug abuse, alcoholism or alcohol abuse, infection with the human immunodeficiency virus, or sickle cell anemia which is carried out by or for the Department under this title shall, except as provided in subsections (e) and (f), be confidential, and (section 5701 of this title to the contrary notwithstanding) such records may be disclosed only for the purposes and under the circumstances expressly authorized under subsection (b). (2) Paragraph (1) prohibits the disclosure to any person or entity other than the patient or subject concerned of the fact that a special written consent is required in order for such records to be disclosed. (b) (1) The content of any record referred to in subsection (a) may be disclosed by the Secretary in accordance with the prior written consent of the patient or subject with respect to whom such record is maintained, but only to such extent, under such circumstances, and for such purposes as may be allowed in regulations prescribed by the Secretary. (2) Whether or not any patient or subject, with respect to whom any given record referred to in subsection (a) is maintained, gives written consent, the content of such record may be disclosed by the Secretary as follows: (A) To medical personnel to the extent necessary to meet a bona fide medical emergency. (B) To qualified personnel for the purpose of conducting scientific research, management audits, financial audits, or program evaluation, but such personnel may not identify, directly or indirectly, any individual patient or subject in any report of such research, audit, or evaluation, or otherwise disclose patient or subject identities in any manner. (C) (i) In the case of any record which is maintained in connection with the performance of any program or activity relating to infection with the human immunodeficiency virus, to a Federal, State, or local public-health authority charged under Federal or State law with the protection of the public health, and to which Federal or State law requires disclosure of such record, if a qualified representative of such authority has made a written request that such record be provided as required pursuant to such law for a purpose authorized by such law. (ii) A person to whom a record is disclosed under this paragraph may not redisclose or use such record for a purpose other than that for which the disclosure was made. (D) If authorized by an appropriate order of a court of competent jurisdiction granted after application showing good cause therefor. In assessing good cause the court shall weigh the public interest and the need for disclosure against the injury to the patient or subject, to the physician-patient relationship, and to the treatment services. Upon the granting of such order, the court, in determining the extent to which any disclosure of all or any part of any record is necessary, shall impose appropriate safeguards against unauthorized disclosure. (E) To an entity described in paragraph (1)(B) of section 5701(k) of this title, but only to the extent authorized by such section. (F) (i) To a representative of a patient who lacks decision-making capacity, when a practitioner deems the content of the given record necessary for that representative to make an informed decision regarding the patient’s treatment. (ii) In this subparagraph, the term “representative” means an individual, organization, or other body authorized under section 7331 of this title and its implementing regulations to give informed consent on behalf of a patient who lacks decision-making capacity. (G) To a State controlled substance monitoring program, including a program approved by the Secretary of Health and Human Services under section 399O of the Public Health Service Act (42 U.S.C. 280g–3), to the extent necessary to prevent misuse and diversion of prescription medicines. (H) (i) To a non-Department entity (including private entities and other Federal agencies) for purposes of providing health care, including hospital care, medical services, and extended care services, to Veterans or performing other health care-related activities or functions. (ii) An entity to which a record is disclosed under this subparagraph may not disclose or use such record for a purpose other than that for which the disclosure was made or as permitted by law. (I) To a third party in order to recover or collect reasonable charges for care furnished to, or paid on behalf of, a Veteran in connection with a non-service connected disability as permitted by section 1729 of this title or for a condition for which recovery is authorized or with respect to which the United States is deemed to be a third party beneficiary under the Act entitled ‘An Act to provide for the recovery from tortiously liable third persons of the cost of hospital and medical care and treatment furnished by the United States’ (Public Law 87–693; 42 U.S.C. 2651 et seq.; commonly known as the ‘Federal Medical Care Recovery Act’). ( src )
• ANSI/DS2020-03-101-2024 - Event Notifications via the Direct Standard® Release Version 1.1 - US Realm ( src )
• All non-trademark uses of the foregoing marks should include the ® symbol and indicate in text that: "HL7, FHIR and the FHIR [FLAME DESIGN] are the registered trademarks of Health Level Seven International and their use does not constitute endorsement by HL7." ( src )
• An authorization must specify a number of elements, including a description of the protected health information to be used and disclosed, the person authorized to make the use or disclosure, the person to whom the covered entity may make the disclosure, an expiration date, and, in some cases, the purpose for which the information may be used or disclosed. With limited exceptions, covered entities may not condition treatment or coverage on the individual providing an authorization. https://www.hhs.gov/hipaa/for-professionals/faq/264/what-is-the-difference-between-consent-and-authorization/index.html A HIPAA Authorization must comply with 45 CFR Section164.508(c) Implementation specifications: Core elements and requirements – (1) Core elements. A valid authorization under this Section must contain at least the following elements: (i) A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion. (ii) The name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure. (iii) The name or other specific identification of the person(s), or class of persons, to whom the covered entity may make the requested use or disclosure. (iv) A description of each purpose of the requested use or disclosure. The statement “at the request of the individual” is a sufficient description of the purpose when an individual initiates the authorization and does not, or elects not to, provide a statement of the purpose. (v) An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure. The statement “end of the research study,” “none,” or similar language is sufficient if the authorization is for a use or disclosure of protected health information for research, including for the creation and maintenance of a research database or research repository. (vi) Signature of the individual and date. If the authorization is signed by a personal representative of the individual, a description of such representative's authority to act for the individual must also be provided. (2)Required statements. In addition to the core elements, the authorization must contain statements adequate to place the individual on notice of all of the following: (i) The individual's right to revoke the authorization in writing, and either: (A) The exceptions to the right to revoke and a description of how the individual may revoke the authorization; or (B) To the extent that the information in paragraph (c)(2)(i)(A) of this section is included in the notice required by Section 164.520, a reference to the covered entity's notice. https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf ( src )
• CPT © Copyright 2026 American Medical Association. All rights reserved. AMA and CPT are registered trademarks of the American Medical Association. ( src )
• Code system of concepts specifying the status of the patient's or the patient's representative's consent for responsibility to pay for potentially uninsured services. This element was introduced to satisfy CMS Medical Necessity requirements for outpatient services in the United States. Includes concepts such as (a) whether the associated diagnosis codes for the service are subject to medical necessity procedures, (b) whether, for this type of service, the patient has been informed that they may be responsible for payment for the service, and (c) whether the patient agrees to be billed for this service. Used in HL7 Version 2.x messaging in the ORC and FT1 segments. ( src )
• Confidentiality code total order hierarchy: Restricted (R) is less protective than V, and subsumes all other protection levels (i.e., N, M, L, and U). ( src )
• Copyright © 1989+ HL7. ( src )
• Copyright © ICAO 2021. All rights reserved. None of the materials provided on this web site may be used, reproduced or transmitted, in whole or in part, in any form or by any means, electronic or mechanical, including photocopying, recording or the use of any information storage and retrieval system, except as provided for in the site Terms and Conditions without permission in writing from ICAO. ( src )
• Copyright ©2026 World Wide Web Consortium. W3C® liability, trademark and permissive document license rules apply. ( src )
• Copyright/Legal: "Material on this site is the copyrighted property of the United States Postal Service® (Postal Service™). All rights reserved. The information and images presented here may not under any circumstances be reproduced or used without prior written permission. Users may view and download material from this site only for the following purposes: (a) for personal, non-commercial home use; (b) where the materials clearly state that these materials may be copied and reproduced according to the terms stated in those particular pages; or (c) with the express written permission of the Postal Service. In all other cases, you will need written permission from the Postal Service to reproduce, republish, upload, post, transmit, distribute or publicly display material from this Web site. Users agree not to use the site for sale, trade or other commercial purposes. Users may not use language that is threatening, abusive, vulgar, discourteous or criminal. Users also may not post or transmit information or materials that would violate rights of any third party or which contains a virus or other harmful component. The Postal Service reserves the right to remove or edit any messages or material submitted by users." ( src )
• Copyright/Legal: (c) The OMOP Standardized Vocabularies Copyright Observational Health Data Sciences and Informatics, Columbia University, New York, NY. Licensed under Apache 2.0 ( src )
• Copyright/Legal: Adapted from content published by IHE Copyright (c) 2015 IHE International, Inc. Used here according to the terms of the CC BY 4 License. Makes use of duration definitions as defined in the ISO 8601 specification. ( src )
• Copyright/Legal: Adapted from content published by IHE Copyright (c) 2015 IHE International, Inc. Used here according to the terms of the CC BY 4 License. This CodeSystem constitutes a profile on ISO 8601, specifying use of its duration definitions for expressing time period ranges. ( src )
• Copyright/Legal: CPT © Copyright 2023 American Medical Association. All rights reserved. AMA and CPT are registered trademarks of the American Medical Association. ( src )
• Copyright/Legal: CPT © Copyright 2026 American Medical Association. All rights reserved. AMA and CPT are registered trademarks of the American Medical Association. ( src )
• Copyright/Legal: Copyright © ICAO 2021. All rights reserved. None of the materials provided on this web site may be used, reproduced or transmitted, in whole or in part, in any form or by any means, electronic or mechanical, including photocopying, recording or the use of any information storage and retrieval system, except as provided for in the site Terms and Conditions without permission in writing from ICAO. ( src )
• Copyright/Legal: Copyright ©2026 World Wide Web Consortium. W3C® liability, trademark and permissive document license rules apply. ( src )
• Copyright/Legal: Dun & Bradstreet DUNS® Numbers are proprietary to and controlled by Dun & Bradstreet. Dun & Bradstreet grants you a non-exclusive, perpetual, limited license to use DUNS® Numbers (excluding linkage DUNS® Numbers) solely for identification purposes and only for your internal business use. Where practicable, you will refer to the number as a “DUNS® Number” and state that DUNS® is a registered trademark of Dun & Bradstreet. For more information, see https://www.dnb.com/utility-pages/terms-of-use.html ( src )
• Copyright/Legal: Some content from IHE® Copyright © 2015 IHE International, Inc. ( src )
• Copyright/Legal: The Direct Standard® data element labels and mappings to content from HL7 Version 2 are incorporated from ANSI/DS2020-03-101-2024 - Event Notifications via the Direct Standard™ Release Version 1.1 - US Realm, which is licensed under Creative Commons "No Rights Reserved" (CC0) by DirectTrust.org, Inc. The Direct Standard™ is a trademark owned by DirectTrust.org, Inc. ( src )
• Copyright/Legal: The UCUM codes, UCUM table (regardless of format), and UCUM Specification are copyright © 1999-2009, Regenstrief Institute, Inc. and the Unified Codes for Units of Measures (UCUM) Organization. All rights reserved. This material derives from the HL7 Terminology THO. THO is copyright ©1989+ Health Level Seven International and is made available under the CC0 designation. For more licensing information see: https://terminology.hl7.org/license.html. ( src )
• Copyright/Legal: These codes are excerpted from Digital Imaging and Communications in Medicine (DICOM) Standard, Part 16: Content Mapping Resource, Copyright © 2011 by the National Electrical Manufacturers Association. ( src )
• Copyright/Legal: This material derives from the HL7 Terminology (THO). THO is copyright ©1989+ Health Level Seven International and is made available under the CC0 designation. For more licensing information see: https://terminology.hl7.org/license ( src )
• Copyright/Legal: This material derives from the HL7 Terminology (THO). THO is copyright ©1989+ Health Level Seven International and is made available under the CC0 designation. For more licensing information see: https://terminology.hl7.org/license. https://creativecommons.org/licenses/by-sa/4.0/ copyright holder is Scientific Knowledge Accelerator Foundation ( src )
• Copyright/Legal: This material derives from the HL7 Terminology (THO). THO is copyright ©1989+ Health Level Seven International and is made available under the CC0 designation. For more licensing information see: https://terminology.hl7.org/license.html ( src )
• Copyright/Legal: This material derives from the HL7 Terminology (THO). THO is copyright ©1989+ Health Level Seven International and is made available under the CC0 designation. For more licensing information see: https://terminology.hl7.org/license.html. This resource includes content from SNOMED Clinical Terms® (SNOMED CT®) which is copyright of the International Health Terminology Standards Development Organisation (IHTSDO). Implementers of these specifications must have the appropriate SNOMED CT Affiliate license - for more information contact http://www.snomed.org/snomed-ct/get-snomed-ct or info@snomed.org ( src )
• Copyright/Legal: This material derives from the HL7 Terminology THO. THO is copyright ©1989+ Health Level Seven International and is made available under the CC0 designation. For more licensing information see: https://terminology.hl7.org/license ( src )
• Copyright/Legal: This material derives from the HL7 Terminology THO. THO is copyright ©1989+ Health Level Seven International and is made available under the CC0 designation. For more licensing information see: https://terminology.hl7.org/license.html ( src )
• Copyright/Legal: This material derives from the HL7 Terminology THO. THO is copyright ©1989+ Health Level Seven International and is made available under the CC0 designation. For more licensing information see: https://terminology.hl7.org/license.html. ( src )
• Copyright/Legal: This resource includes content from SNOMED Clinical Terms® (SNOMED CT®) which is copyright of the International Health Terminology Standards Development Organisation (IHTSDO). Implementers of these specifications must have the appropriate SNOMED CT Affiliate license - for more information contact http://www.snomed.org/snomed-ct/get-snomed-ct or info@snomed.org ( src )
• Copyright/Legal: UCUM is Copyright © 1999-2013 Regenstrief Institute, Inc. and The UCUM Organization, Indianapolis, IN. All rights reserved. See http://unitsofmeasure.org/trac//wiki/TermsOfUse for details. This material derives from the HL7 Terminology THO. THO is copyright ©1989+ Health Level Seven International and is made available under the CC0 designation. For more licensing information see: https://terminology.hl7.org/license.html ( src )
• Copyright/Legal: © Canadian Association of Emergency Physicians (CAEP). Used with permission of the CTAS National Working Group. Reuse of CTAS materials (including educational content) requires express permission from CAEP/CTAS. ( src )
• Current Procedural Terminology (CPT®) ( src )
• Current Procedural Terminology (CPT®) - HL7 Terminology (THO) v7.4.0 ( src )
• Current Procedural Terminology (CPT®) - JSON Representation - HL7 Terminology (THO) v7.4.0 ( src )
• Current Procedural Terminology (CPT®) - TTL Representation - HL7 Terminology (THO) v7.4.0 ( src )
• Current Procedural Terminology (CPT®) - XML Representation - HL7 Terminology (THO) v7.4.0 ( src )
• Discussion: Part is defined in opposition to (a) ingredient (not separable), (b) content (not a functional component), and (c) member (not functionally distinct from other members). ( src )
• Dun & Bradstreet DUNS® Numbers are proprietary to and controlled by Dun & Bradstreet. Dun & Bradstreet grants you a non-exclusive, perpetual, limited license to use DUNS® Numbers (excluding linkage DUNS® Numbers) solely for identification purposes and only for your internal business use. Where practicable, you will refer to the number as a “DUNS® Number” and state that DUNS® is a registered trademark of Dun & Bradstreet. For more information, see https://www.dnb.com/utility-pages/terms-of-use.html ( src )
• HL7 Terminology (THO), published by HL7 International - Vocabulary Work Group. This guide is not an authorized publication; it is the continuous build for version 7.4.0 built by the FHIR (HL7® FHIR® Standard) CI Build. This version is based on the current content of https://github.com/HL7/UTG/ and changes regularly. See the Directory of published versions ( src )
• HL7® (Health Level Seven, Inc.) Terminology Copyright and License ( src )
• HL7®, HEALTH LEVEL SEVEN®, FHIR® and the FHIR [image]® are trademarks owned by Health Level Seven International, registered with the United States Patent and Trademark Office. ( src )
• ICD-10 is ©Copyright World Health Organization (WHO). WHO licenses its published material widely, in order to encourage maximum use and dissemination. See Licensing WHO classifications for details. The ICD variants have their own separate copyright and licensing (refer to the documentation for the particular variant for details). ( src )
• ICNP(r) is a combinatorial terminology, using a multi-axial structure. ICNP(r) provides standardized terms and codes for terms in two classifications that can be used to compose or create pre-coordinated concepts to represent observations and procedures, specifically, patient problems/nursing diagnoses, nursing interventions including those focused on assessment and actual or expected (goal) outcomes. The ICNP(r) Classification for Nursing Phenomena is used to compose concepts or statements to represent observations (nursing diagnoses, patient problems, patient status, patient outcomes). The ICNP(r) Nursing Actions Classification is used to compose concepts or statements to represent procedures (nursing interventions) ( src )
• International Healthcare Terminology Standards Developing Organization (IHTSDO).This specification includes content from SNOMED CT, which is copyright © 2002+ International Health Terminology Standards Development Organisation (IHTSDO) and distributed by agreement between IHTSDO and HL7. Implementer use of SNOMED CT is not covered by this agreement ( src )
• Logical Observation Identifier Names and Codes (LOINC®) ( src )
• Logical Observation Identifiers Names and Codes (LOINC®) provides a set of universal codes and names for identifying laboratory and other clinical observations. One of the main goals of LOINC is to facilitate the exchange and pooling of results for clinical care, outcomes management, and research. LOINC was initiated by Regenstrief Institute research scientists who continue to develop it with the collaboration of the LOINC Committee. The LOINC table, LOINC codes, and LOINC panels and forms file are copyright © 1995-2011, Regenstrief Institute, Inc. and the LOINC Committee and available at no cost (http://loinc.org) under the license at http://loinc.org/terms-of-use. The laboratory portion of the LOINC database contains the usual clinical laboratory categories of chemistry, hematology, serology, microbiology (including parasitology and virology), toxicology; as well as categories for drugs and the cell counts, antibiotic susceptibilities, and more. The clinical portion of the LOINC database includes entries for vital signs, hemodynamics, intake/output, EKG, obstetric ultrasound, cardiac echo, radiology report titles, pulmonary ventilator management, document and section titles, patient assessment instruments (e.g. Glascow Coma Score, PHQ-9 depression scale, CMS-required patient assessment instruments), and other clinical observations. ( src )
• NamingSystem Current Procedural Terminology (CPT®) ( src )
• NamingSystem: Current Procedural Terminology (CPT®) ( src )
• NamingSystem: Current Procedural Terminology (CPT®) - Change History ( src )
• Notice of any changes or modifications, through a copyright statement on the new code or document such as "This software or document includes material copied from or derived from [title and URI of the W3C document]. Copyright © [$year-of-document] World Wide Web Consortium. https://www.w3.org/copyright/software-license-2023/" ( src )
• Placer Applications. In response to a Filler application requesting refill authorization (RF), DF indicates that the placer does not authorize refills for the order. ORC-16 Order Control Code reason may be used to indicate the reason for the request denial. Some suggested values include: AA Patient unknown to the provider AB Patient never under provider care AC Patient no longer under provider care AD Patient has requested refill too soon AE Medication never prescribed for the patient AF Patient should contact provider first AG Refill not appropriate Note that these values originate from the NCPDP SCRIPT Response Segment Code List Qualifiers. Materials Reproduced with the consent of ©National Council for Prescription Drug Programs, Inc. 1988, 1992, 2002 NCPDP. ( src )
• Privacy metadata indicating the level of protection required to safeguard potentially stigmatizing information, which if disclosed without authorization, would present a high risk of harm to an individual's reputation and sense of privacy.*Usage Note:* The level of protection afforded restricted confidential information is dictated by specially protective organizational or jurisdictional privacy policies, including at an authorized individual's request, intended to engender patient trust in providers of sensitive services.Privacy policies mandating additional levels of protection by restricting information access preempt less protective privacy policies when the information is used in the delivery and management of healthcare. May be pre-empted by jurisdictional law (e.g., for public health reporting or emergency treatment).Confidentiality code total order hierarchy: Restricted (R) is less protective than *V*, and subsumes all other protection levels (i.e., *N, M, L, and U*).**Examples:** Includes information that is additionally protected such as sensitive conditions mental health, HIV, substance abuse, domestic violence, child abuse, genetic disease, and reproductive health; or sensitive demographic information such as a patient's standing as an employee or a celebrity. May be used to indicate proprietary or classified information that is not related to an individual (e.g., secret ingredients in a therapeutic substance; or the name of a manufacturer). ( src )
• Regenstrief Institute provides access to LOINC's terminology content through the HL7® FHIR® API. See the LOINC FHIR Terminology Server page for details. ( src )
• SNOMED CT is © and ® SNOMED International. The right to maintain the GPS remains vested exclusively in SNOMED International. ( src )
• SNOMED CT® was originally created by the College of American Pathologists. ( src )
• Section 1886(d) of the Act specifies that the Secretary shall establish a classification system (referred to as DRGs) for inpatient discharges and adjust payments under the IPPS based on appropriate weighting factors assigned to each DRG. Therefore, under the IPPS, we[CMS] pay for inpatient hospital services on a rate per discharge basis that varies according to the DRG to which a beneficiary's stay is assigned. The formula used to calculate payment for a specific case multiplies an individual hospital's payment rate per case by the weight of the DRG to which the case is assigned. Each DRG weight represents the average resources required to care for cases in that particular DRG, relative to the average resources used to treat cases in all DRGs. Congress recognized that it would be necessary to recalculate the DRG relative weights periodically to account for changes in resource consumption. Accordingly, section 1886(d)(4)(C) of the Act requires that the Secretary adjust the DRG classifications and relative weights at least annually. These adjustments are made to reflect changes in treatment patterns, technology, and any other factors that may change the relative use of hospital resources. ( src )
• See 45 CFR 164.524(c)(3)(ii) If an individual's request for access directs the covered entity to transmit the copy of protected health information directly to another person designated by the individual, the covered entity must provide the copy to the person designated by the individual. The individual's request must be in writing, signed by the individual, and clearly identify the designated person and where to send the copy of protected health information. https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-524.pdf ( src )
• See 45 CFR 164.524(c)(3)(ii) If an individual's request for access directs the covered entity to transmit the copy of protected health information directly to another person designated by the individual, the covered entity must provide the copy to the person designated by the individual. The individual's request must be in writing, signed by the individual, and clearly identify the designated person and where to send the copy of protected health information. https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-524.pdf ( src )
• See Section 164.508 Uses and disclosures for which an authorization is required. (2)Authorization required: Psychotherapy notes https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf: Notwithstanding any provision of this subpart, other than the transition provisions in Section 164.532, a covered entity must obtain an authorization for any use or disclosure of psychotherapy notes, except: (i) To carry out the following treatment, payment, or health care operations: (A) Use by the originator of the psychotherapy notes for treatment; (B) Use or disclosure by the covered entity for its own training programs in which students, trainees, or practitioners in mental health learn under supervision to practice or improve their skills in group, joint, family, or individual counseling; or (C) Use or disclosure by the covered entity to defend itself in a legal action or other proceeding brought by the individual; and (ii) A use or disclosure that is required by Section 164.502(a)(2)(ii) or permitted by Section 164.512(a); Section 164.512(d) with respect to the oversight of the originator of the psychotherapy notes; Section 164.512(g)(1); Section 164.512(j)(1)(i). ( src )
• See Section 164.508 Uses and disclosures for which an authorization is required. (2)Authorization required: Psychotherapy notes https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/pdf/CFR-2017-title45-vol1-sec164-508.pdf: Notwithstanding any provision of this subpart, other than the transition provisions in Section 164.532, a covered entity must obtain an authorization for any use or disclosure of psychotherapy notes, except: (i) To carry out the following treatment, payment, or health care operations: (A) Use by the originator of the psychotherapy notes for treatment; (B) Use or disclosure by the covered entity for its own training programs in which students, trainees, or practitioners in mental health learn under supervision to practice or improve their skills in group, joint, family, or individual counseling; or (C) Use or disclosure by the covered entity to defend itself in a legal action or other proceeding brought by the individual; and (ii) A use or disclosure that is required by Section 164.502(a)(2)(ii) or permitted by Section 164.512(a); Section 164.512(d) with respect to the oversight of the originator of the psychotherapy notes; Section 164.512(g)(1); Section 164.512(j)(1)(i). ( src )
• Some content from IHE® Copyright © 2015 IHE International, Inc. ( src )
• Some content from IHE® Copyright © 2015 IHE International, Inc. The IHE concepts are from the IHE Technical Frameworks and Supplements, available for free download and use at http://www.ihe.net/Technical_Frameworks/ ( src )
• Staged or Related Procedure or Service by the Same Physician or Other Qualified Health Care Professional During the Postoperative Period: It may be necessary to indicate that the performance of a procedure or service during the postoperative period was: (a) planned or anticipated (staged); (b) more extensive than the original procedure; or (c) for therapy following a surgical procedure. This circumstance may be reported by adding modifier 58 to the staged or related procedure. Note: For treatment of a problem that requires a return to the operating/procedure room (eg, unanticipated clinical condition), see modifier 78 ( src )
• Table of codes specifying the status of the patient's or the patient's representative's consent for responsibility to pay for potentially uninsured services. This element was introduced to satisfy CMS Medical Necessity requirements for outpatient services in the United States. Includes concepts such as (a) whether the associated diagnosis codes for the service are subject to medical necessity procedures, (b) whether, for this type of service, the patient has been informed that they may be responsible for payment for the service, and (c) whether the patient agrees to be billed for this service. ( src )
• The Direct Standard® data element labels and mappings to content from HL7 Version 2 are incorporated from ANSI/DS2020-03-101-2024 - Event Notifications via the Direct Standard™ Release Version 1.1 - US Realm, which is licensed under Creative Commons "No Rights Reserved" (CC0) by DirectTrust.org, Inc. The Direct Standard™ is a trademark owned by DirectTrust.org, Inc. ( src )
• The FHIR R5 specification includes content from SNOMED Clinical Terms® (SNOMED CT®) is copyright of the International Health Terminology Standards Development Organisation (IHTSDO) (trading as SNOMED International). Implementers of these specifications must have the appropriate SNOMED CT Affiliate license - for more information access http://www.snomed.org/snomed-ct/get-snomed-ct or contact SNOMED International via email at info@snomed.org. ( src )
• The HL7 Terminology is produced by HL7 under the terms of HL7® Governance and Operations Manual relating to Intellectual Property (Section 09, at the time of this publication), specifically its copyright, trademark, and patent provisions. ( src )
• The HL7®(Health Level Seven, Inc.) Terminology content developed by HL7 are derived from the collective experience of the HL7 membership and community feedback from the development and application of a spectrum of health care interoperability solutions. However, because HL7 Terminology supports multiple contexts of use, it is the responsibility of the persons or organizations using this content to ensure their use is fit for their particular purpose, including validation for clinical and operational use. ( src )
• The description is based on the following GDPR provisions: Article 6.1.c https://gdpr-info.eu/art-6-gdpr/ 1Processing shall be lawful only if and to the extent that at least one of the following applies: (c) processing is necessary for compliance with a legal obligation to which the controller is subject. Article 9.1, 9.2.b https://gdpr-info.eu/art-9-gdpr/ 1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited. 2. Paragraph 1 shall not apply if one of the following applies: (b) processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject. ( src )
• The description is based on the following GDPR provisions: Article 6.1.d https://gdpr-info.eu/art-6-gdpr/ 1Processing shall be lawful only if and to the extent that at least one of the following applies: (d) processing is necessary in order to protect the vital interests of the data subject or of another natural person. Article 9.1, and 9.2.c and 9.2.h, 9.3 https://gdpr-info.eu/art-9-gdpr/ 1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited. 2. Paragraph 1 shall not apply if one of the following applies: (c) processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent; (h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3; 3. Personal data referred to in paragraph 1 may be processed for the purposes referred to in point (h) of paragraph 2 when those data are processed by or under the responsibility of a professional subject to the obligation of professional secrecy under Union or Member State law or rules established by national competent bodies or by another person also subject to an obligation of secrecy under Union or Member State law or rules established by national competent bodies. ( src )
• The domain of possible values for the status of the patient's or the patient's representative's consent for responsibility to pay for potentially uninsured services. This element was introduced to satisfy CMS Medical Necessity requirements for outpatient services in the United States. Includes concepts such as (a) whether the associated diagnosis codes for the service are subject to medical necessity procedures, (b) whether, for this type of service, the patient has been informed that they may be responsible for payment for the service, and (c) whether the patient agrees to be billed for this service. ( src )
• The pan Canadian LOINC Observation Code Database (pCLOCD) is the Canadian version of the LOINC(tm) database. It was created using the LOINC(tm) records and attributes that were constrained for Canadian use and supplemented to specifically meet Canadian requirements. It contains the core LOINC(tm) attributes as required by Regenstrief copyright rules. The LOINC(tm) Component has been customized to meet Canadian requirements and is displayed as the pan Canadian Component Name. This component name is the basis for the pan Canadian Display Name. Core attributes are include both English and Canadian French. ( src )
• This material contains content from LOINC (http://loinc.org). LOINC is copyright © 1995-2020, Regenstrief Institute, Inc. and the Logical Observation Identifiers Names and Codes (LOINC) Committee and is available at no cost under the license at http://loinc.org/license. LOINC® is a registered United States trademark of Regenstrief Institute, Inc. ( src )
• This material derives from the HL7 Terminology (THO). THO is copyright ©1989+ Health Level Seven International and is made available under the CC0 designation. For more licensing information see: https://terminology.hl7.org/license.html ( src )
• This material derives from the HL7 Terminology THO. THO is copyright ©1989+ Health Level Seven International and is made available under the CC0 designation. For more licensing information see: https://terminology.hl7.org/license.html ( src )
• This page describes the license terms for everything contained in these HL7 Terminology pages that has been developed by HL7®(Health Level Seven, Inc.), but does not include any content developed by third parties that may be available on these pages. ( src )
• This processing policy code offers an escape-hatch to countries like Denmark and Austria: they simply declare their national healthcare data exchanges to be necessary for the management of their healthcare system. This allows them to establish an opt-out mechanism under the GDPR, whereas normally GDPR would be opt-in when it comes to such national exchanges. The description is based on the following GDPR provisions: Article 9.1, and 9.2.c and 9.2.h, 9.3 https://gdpr-info.eu/art-9-gdpr/ 1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited. 2. Paragraph 1 shall not apply if one of the following applies: (c) processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent; (h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3; 3. Personal data referred to in paragraph 1 may be processed for the purposes referred to in point (h) of paragraph 2 when those data are processed by or under the responsibility of a professional subject to the obligation of professional secrecy under Union or Member State law or rules established by national competent bodies or by another person also subject to an obligation of secrecy under Union or Member State law or rules established by national competent bodies. ( src )
• This value set contains content from SNODENT® Copyright American Dental Association (ADA). All rights reserved. SNODENT is a registered trademark of the ADA. ( src )
• UCUM is Copyright © 1999-2013 Regenstrief Institute, Inc. and The UCUM Organization, Indianapolis, IN. All rights reserved. See TermsOfUse for details. ( src )
• W3C® Software and Document License ( src )
• When Value Sets include CPT codes, the ValueSet.compose.include.copyright element should have the text "CPT © Copyright 2023 American Medical Association. All rights reserved. AMA and CPT are registered trademarks of the American Medical Association.". The year in the copyright element should be adjusted to reflect the release year(s) being used. ( src )
• When referencing the FHIR® standard in a website, document, presentation, or otherwise, please in a place of prominence refer to it as the "HL7® FHIR® standard". In subsequent uses, please refer to it as the "FHIR® standard" or "FHIR®", using the ® symbol as often as is practical, at least once on each page of printed matter, generally in connection with the first or dominant usage. ( src )
• When using the [image] logo, always include the ® symbol ( src )
• https://www.gpo.gov/fdsys/granule/USCODE-2011-title38/USCODE-2011-title38-partV-chap73-subchapIII-sec7332/content-detail.html . (1) Records of the identity, diagnosis, prognosis, or treatment of any patient or subject which are maintained in connection with the performance of any program or activity (including education, training, treatment, rehabilitation, or research) relating to drug abuse, alcoholism or alcohol abuse, infection with the human immunodeficiency virus, or sickle cell anemia which is carried out by or for the Department under this title shall, except as provided in subsections (e) and (f), be confidential, and (section 5701 of this title to the contrary notwithstanding) such records may be disclosed only for the purposes and under the circumstances expressly authorized under subsection (b). (2) Paragraph (1) prohibits the disclosure to any person or entity other than the patient or subject concerned of the fact that a special written consent is required in order for such records to be disclosed. (b) (1) The content of any record referred to in subsection (a) may be disclosed by the Secretary in accordance with the prior written consent of the patient or subject with respect to whom such record is maintained, but only to such extent, under such circumstances, and for such purposes as may be allowed in regulations prescribed by the Secretary. (2) Whether or not any patient or subject, with respect to whom any given record referred to in subsection (a) is maintained, gives written consent, the content of such record may be disclosed by the Secretary as follows: (A) To medical personnel to the extent necessary to meet a bona fide medical emergency. (B) To qualified personnel for the purpose of conducting scientific research, management audits, financial audits, or program evaluation, but such personnel may not identify, directly or indirectly, any individual patient or subject in any report of such research, audit, or evaluation, or otherwise disclose patient or subject identities in any manner. (C) (i) In the case of any record which is maintained in connection with the performance of any program or activity relating to infection with the human immunodeficiency virus, to a Federal, State, or local public-health authority charged under Federal or State law with the protection of the public health, and to which Federal or State law requires disclosure of such record, if a qualified representative of such authority has made a written request that such record be provided as required pursuant to such law for a purpose authorized by such law. (ii) A person to whom a record is disclosed under this paragraph may not redisclose or use such record for a purpose other than that for which the disclosure was made. (D) If authorized by an appropriate order of a court of competent jurisdiction granted after application showing good cause therefor. In assessing good cause the court shall weigh the public interest and the need for disclosure against the injury to the patient or subject, to the physician-patient relationship, and to the treatment services. Upon the granting of such order, the court, in determining the extent to which any disclosure of all or any part of any record is necessary, shall impose appropriate safeguards against unauthorized disclosure. (E) To an entity described in paragraph (1)(B) of section 5701(k) of this title, but only to the extent authorized by such section. (F) (i) To a representative of a patient who lacks decision-making capacity, when a practitioner deems the content of the given record necessary for that representative to make an informed decision regarding the patient's treatment. (ii) In this subparagraph, the term "representative" means an individual, organization, or other body authorized under section 7331 of this title and its implementing regulations to give informed consent on behalf of a patient who lacks decision-making capacity. (G) To a State controlled substance monitoring program, including a program approved by the Secretary of Health and Human Services under section 399O of the Public Health Service Act (42 U.S.C. 280g-3), to the extent necessary to prevent misuse and diversion of prescription medicines. (H) (i) To a non-Department entity (including private entities and other Federal agencies) for purposes of providing health care, including hospital care, medical services, and extended care services, to Veterans or performing other health care-related activities or functions. (ii) An entity to which a record is disclosed under this subparagraph may not disclose or use such record for a purpose other than that for which the disclosure was made or as permitted by law. (I) To a third party in order to recover or collect reasonable charges for care furnished to, or paid on behalf of, a Veteran in connection with a non-service connected disability as permitted by section 1729 of this title or for a condition for which recovery is authorized or with respect to which the United States is deemed to be a third party beneficiary under the Act entitled 'An Act to provide for the recovery from tortiously liable third persons of the cost of hospital and medical care and treatment furnished by the United States' (Public Law 87-693; 42 U.S.C. 2651 et seq.; commonly known as the 'Federal Medical Care Recovery Act'). ( src )
• © Canadian Association of Emergency Physicians (CAEP). Used with permission of the CTAS National Working Group. Reuse of CTAS materials (including educational content) requires express permission from CAEP/CTAS. ( src )

External References