Unless prohibited or limited by federal or state laws, Oklahoma Department of Human Services (OKDHS) may use or disclose protected health information (PHI) without written authorization for the circumstances explained in this Section.

• (1) Individual access.  OKDHS may disclose information to individuals who have requested disclosure of their own PHI in accordance with OAC 340:2-8-4(a)(1).
• (2) Required by law.  OKDHS may use or disclose PHI without authorization if the law requires such disclosure and the use or disclosure complies with, and is limited to, the relevant requirements of such law.  • 1
• (3) Treatment, payment, or health care operations.  OKDHS may use or disclose PHI without authorization:
  • (A) for its own treatment, payment, or health care operations;
  • (B) to another covered entity or health care provider for the payment activities of the entity that receives the PHI;
  • (C) to another covered entity for the health care activities of that entity, if:
    • (i) both that entity and OKDHS have or have had a relationship with the individual who is the subject of the PHI; and
    • (ii) the PHI pertains to such relationship.
• (4) Psychotherapy notes.  OKDHS may use or disclose psychotherapy notes generated by OKDHS:
  • (A) in training programs where students, trainees, or practitioners in mental health learn under supervision to practice or improve their skills;
  • (B) when a health oversight agency uses or discloses in connection with oversight of the originator of the notes; or
  • (C) to the extent authorized under state law to defend OKDHS in a legal action or other proceeding brought by the individual.
• (5) Public health activities.  OKDHS may disclose an individual's PHI to appropriate entities or persons for governmental public health activities and purposes, including but not limited to a:
  • (A) governmental public health authority that is authorized by law to collect or receive the PHI for the purpose of preventing or controlling disease, injury, or disability.  This includes reporting vital events, such as:
    • (i) birth or death; or
    • (ii) abuse or neglect of a vulnerable adult;
  • (B) governmental public health authority, or other appropriate government authority, that is authorized by law to receive report of child abuse or neglect; or
  • (C) person who may have been exposed to a communicable disease, or may be at risk of contracting or spreading a disease or condition, if OKDHS is authorized by law to notify such person as necessary in conducting a public health intervention or investigation.
• (6) Health oversight activities.  OKDHS may disclose PHI for health oversight activities authorized by law, including audits; civil, criminal, or administrative investigations, prosecutions, or actions; licensing or disciplinary actions; Medicaid fraud; or other activities necessary for oversight.
• (7) Judicial and administrative proceedings.  Unless prohibited by applicable federal and state law, OKDHS may disclose PHI for judicial or administrative proceedings as required by law, in response to an order of a court, a subpoena, a discovery request, or other lawful process.
• (8) Law enforcement purposes.  OKDHS discloses PHI only when required by federal or state laws.
• (9) Deceased persons.  OKDHS discloses PHI to a coroner or medical examiner only when required by federal or state laws.
• (10) Organ or tissue donation.  If a client is an organ donor, OKDHS may disclose PHI to an entity that participates in transplantation activities.
• (11) To avert a serious threat to health or safety.  OKDHS discloses PHI if:
  • (A) OKDHS believes in good faith that the PHI is necessary to prevent or lessen a serious or imminent threat to the health or safety of a person or the public; and
  • (B) the report is disclosed to a person(s) reasonably able to prevent or lessen the threat, including to the target of the threat.