The rules regarding the use of PHI pertain to disclosures as well. Essentially, your practice may use and disclose PHI for your own TPO activities. The regulation also requires that you put in place policies regarding use and disclosure (e.g., who in your practice will be permitted to disclose PHI).
