---
title: "HIPAA use and disclosure limits checklist"
url: "https://ailawframework.com/precedents/health-and-medical-law/us-phi-use-limits"
type: "precedent"
site: "AI Law Framework"
id: "a32-us-phi-use-limits"
area_id: "A32"
kind: "checklist"
ai_level: "yellow"
version: 1
task_ids: ["A32-T1-R8", "A32-B7-2", "A32-R20261018-4"]
law_stated_as_at: "2026-10-22"
---

# HIPAA use and disclosure limits checklist

> Checklist of the use and disclosure limits in 45 CFR 164.502 that a reviewer applies to a business associate contract and a privacy notice. It does not authorise a use.

Canonical page: https://ailawframework.com/precedents/health-and-medical-law/us-phi-use-limits  
Law stated as at: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

- Kind: Checklist. Steps or checks to work through and tick off.
- Practice area: [Health & Medical Law](https://ailawframework.com/precedents/health-and-medical-law.md)
- Jurisdictions: United States
- AI level: Yellow. You and the tool draft together, with you directing. You check every statement you rely on.
- Law stated as at: 2026-10-22
- Status: Maintained. Checked on 2026-10-22 against the 3 authorities it cites, for United States.

## When to use it

Use when a lawyer is checking whether a proposed use of protected health information stays inside the contract and the notice. Do not use it to approve a disclosure or to write a breach notice.

## Used for these tasks

- [Map health-privacy duties across the records systems](https://ailawframework.com/practice/health-and-medical-law/map-health-privacy-duties-across-the-records-systems.md)
- [Review an AI clinical-tool vendor contract for privacy and TGA issues](https://ailawframework.com/practice/health-and-medical-law/review-an-ai-clinical-tool-vendor-contract-for-privacy-and-tga-issues.md)
- [Assess a suspected data breach of patient information and decide whether to notify](https://ailawframework.com/practice/health-and-medical-law/assess-a-suspected-data-breach-of-patient-information-and-decide-whether.md)

## How AI may be used

Yellow: the lawyer decides whether a proposed use is permitted. The list only records the limits that were opened.

**AI may:**

- Restate the general limit in 45 CFR 164.502(a) and the business associate limit in 164.502(a)(3).
- Record the minimum-necessary standard in the words of 164.502(b).
- Record the notice-consistency limit in 164.502(i).

**AI must not:**

- Do not approve a use or disclosure.
- Do not apply an exception in 164.502(b) that was not opened.
- Do not describe the sale exceptions in 164.502(a)(5)(ii)(B)(2). That list was not read in full.
- Do not write a breach notification.

**The lawyer checks:**

- Identify the proposed use in the client's words before applying a limit.
- Read the unopened exceptions before treating the minimum-necessary standard as absolute.
- Compare the proposed use with the notice actually in effect.
- Do not treat this list as a decision that notice to an individual is required.

## Authorities

- [45 CFR § 164.502](https://www.law.cornell.edu/cfr/text/45/164.502)
- [45 CFR § 164.504](https://www.law.cornell.edu/cfr/text/45/164.504)
- [45 CFR § 164.520](https://www.law.cornell.edu/cfr/text/45/164.520)

## Full text and drafting notes

The full text and the drafting notes are not part of this public page. Signed-in firm accounts can read them at https://ailawframework.com/precedents/health-and-medical-law/us-phi-use-limits and through the signed-in MCP connector https://ailawframework.com/mcp/firm.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*