Yes. Education and training are included in HIPAA’s definition of health care operations and is permitted. This means that the faculty may use PHI in lectures, case presentations, or in other classroom settings for educational purposes for students, residents, and other faculty within the university setting. A student or resident can also use PHI for educational purposes in the same type settings and for similar purposes.
Faculty, residents, or students cannot use PHI in external settings, such as conferences, seminars, and the like, unless specifically authorized to do so by the patient. The students or residents may not take PHI with them when leaving their affiliations with the university, unless specifically authorized to do so by the patient.