May an employee of a Health Care Component (HCC) share PHI with individuals within the HCC or with individuals in another HCC in the University if they request it as part of an audit, quality improvement initiative, or training project?

Yes. Disclosures for treatment, payment, or operations (TPO) purposes are always permissible. The disclosure described above would be considered part of the University’s operations, so it is permitted under HIPAA. In addition, so long as the disclosure is to an authorized individual for TPO, the disclosure need not be limited to individuals within an HCC, nor is patient Authorization required.