Skip Navigation

Defense Health Agency

"On October 1, 2013, the Department of Defense established the Defense Health Agency (DHA) to manage the activities of the Military Health System. These activities include those previously managed by TRICARE Management Activity (TMA), which was disestablished on the same date. During the next several months, all TMA websites will change to reflect the new DHA. We appreciate your patience during this transition."

Health Insurance Portability and Accountability Act (HIPAA) Privacy Information and Guidance Papers

Note: The Privacy Office is in the process of reviewing each of these Information Papers; however, the guidance is current. The overall presentation is under construction to reflect organizational changes. The goal is to transition these papers to the new website. This will include additional papers featuring new topics. To suggest topics, please contact us at

Information Papers
Guidance Papers

Information Papers

14 Uses and Disclosures When an Authorization is Not Required (Updated March 2010)

Accounting of Disclosures of PHI

Amendment of PHI (February 2012)

American Recovery and Reinvestment Act (ARRA) of 2009 (Updated April 2010)

Best Practices for Camera and Video Use within an MHS Covered Entity (Updated July 2011)

Best Practices for Disposing PHI (Updated September 2011)

Business Practices for DoD/VA Sharing

Best Practices for Safeguarding Laptops (March 2011)

Best Practices for Verification of Identity

Decedents: Use and Disclosure (Updated February 2012)

Disclosures in Emergency Situations (Updated January 2012)

Disclosure of PHI to DoD Safety Offices (February 2012)

Health Information Technology (HIT) Initiatives

Incidental Uses and Disclosures of PHI (Updated October 2010)

Judicial and Administrative Proceedings (Updated July 2011)

Medical Facility Directory: Use and Disclosure (Updated August 2010)

Medical Training and Education (Updated January 2012)

Military Command Exception and Disclosing PHI of Armed Forces Personnel
(Updated March 2013)

Minimum Necessary Rule (Updated January 2012)

New Guidance on De-Identification Methods under the HIPAA Privacy Rule

Obtaining Military Records (Updated May 2010)

Oral Communication of PHI (Updated March 2010)

Organized Health Care Arrangements (Updated July 2011)

The Privacy Rule and Documentation

Protected Health Information Management Tool (PHIMT) (Updated August 2010)

Psychotherapy Notes (Updated February 2012)

Release of Information to Congress or Congressional Offices (Updated June 2010)

Requests for Restrictions on the Use & Disclosure of PHI (Updated January 2012)

Role-Based Access (Updated February 2012)

Sending and Receiving PHI by Facsimile (Updated August 2010)

Special Rules for Alcohol and Drug Abuse Program Patient Records
(Updated September 2011)

Transporting PII or PHI (Updated April 2010)

Uses and Disclosures When an Authorization is Required

Uses and Disclosures of PHI for Health Oversight Activities (Updated September 2011)

Uses and Disclosures of PHI for Law Enforcement Purposes (Updated February 2011)

Uses and Disclosures of PHI for Payment Purposes (Updated July 2011)

Victims of Abuse, Neglect, or Domestic Violence (Updated February 2011)

Women, Infants, and Children Program (WIC) (Updated March 2010)