2.1 PURPOSE
The purpose of this policy is to define permissible uses of the Saudi Health Information Exchange such as Patient Care, Public Health, and Quality.

2.2 SCOPE/APPLICABILITY
This policy applies to the Saudi Health Information Exchange, and to all individuals and organizations who have access to the Saudi Health Information Exchange managed health records, including
• Participating Healthcare Subscriber (PHCSs),
• their Business Associates,
• any subcontractors of Business Associates that perform functions or provide services involving the use and disclosure of PHI,
• any Saudi Health Information Exchange Infrastructure Service Provider, and
• any other subcontractors of the Saudi Health Information Exchange.
This policy applies to all information provided to or retrieved from the Saudi Health Information Exchange systems.

2.3 POLICY
Personal Health Information (PHI) will primarily be made available on the Saudi Health Information Exchange for purposes of Treatment, Payment, Healthcare Operations, and Public Health:
2.3.1 Uses That SHALL Be Permitted
The following uses of the Saudi Health Information Exchange systems SHALL be permitted and SHALL be subject to all applicable Saudi Health Information Exchange Policies:
2.3.1.1 TREATMENT
2.3.1.1.1 Clinical Care Provision to an Individual Subject of Care
To inform individuals or processes responsible for providing healthcare services to the Subject of Care
2.3.1.1.2 Emergency Care Provision to an Individual Subject of Care
To inform individuals needing to provide healthcare services to the Subject of Care urgently and possibly needing to override the policies and consents pertaining to clinical care provision.
2.3.1.1.3 Support of Care Activities within the Provider Organization for an Individual Subject of Care
To inform individuals or processes enabling others [healthcare providers who have a legitimate right to provide care] to provide healthcare services to the Subject of Care.
2.3.1.1.4 Subject of Care Uses
To inform the Subject of Care in support of his or her own interests.
2.3.1.2 OPERATIONS
2.3.1.2.1 Health Service Management and Quality Assurance
To inform individuals or processes responsible for determining the availability, quality, safety, equity and cost-effectiveness of healthcare services.
2.3.1.3 PUBLIC HEALTH
2.3.1.3.1 Public Health Surveillance, Disease Control
To inform individuals or processes with responsibility to monitor populations or sub-populations for significant health events and then intervene to provide healthcare or preventive care services to relevant individuals.
2.3.1.3.2 Public Safety Emergency
To inform individuals with responsibility for the protection of the public in a situation in which there is considered to be a significant risk to one or more members of the public and possibly needing to over-ride the policies and consents pertaining to Public Health Surveillance and Disease Control.
2.3.1.3.3 Population Health Management
To inform individuals or processes with responsibility to monitor populations or sub-populations for health events, trends or outcomes in order to inform relevant strategy and policy.
2.3.2 Uses That MAY Be Permitted
The following uses of the Saudi Health Information Exchange systems MAY be permitted and SHALL be subject to the Secondary Use Policy constraints or further use constraints:
2.3.2.1 RESEARCH
To support the discovery of generalizable knowledge.
2.3.2.2 EDUCATION
To support learning and professional development.
2.3.2.3 MARKET STUDIES [INCLUDING FUNDRAISING]
To support the discovery of product or organization specific knowledge.
2.3.2.4 PAYMENT – ADMINISTRATION OF CARE FOR AN INDIVIDUAL SUBJECT OF CARE
To inform individuals or processes responsible for enabling the availability of resources or funding or permissions for providing healthcare services to the Subject of Care.
2.3.3 Uses That SHALL NOT Be Permitted
The following use of the Saudi Health Information Exchange systems SHALL NOT be permitted unless there is a valid court order to disclose PHI:
2.3.3.1 LEGAL INVESTIGATION OR INQUIRY
To inform persons or processes responsible for enforcing jurisdictional legislation, or undertaking legal or forensic investigation.
The following uses of the Saudi Health Information Exchange systems SHALL NOT be permitted at this time:
2.3.3.2 NOT SPECIFIED OR UNKNOWN
Disclosure on the basis of authorizations not requiring a purpose to be declared, or where the purpose is not known, or purposes for which the other categories in this clause do not apply (e.g. unless a purpose as described above is declared, disclosure SHALL NOT be permitted).

2.4 POLICY MAINTENANCE
The Saudi Ministry of Health (MOH) is responsible for monitoring and maintenance