Privacy Rule explicitly permits uses
and disclosures that occur as a result of an otherwise permitted use or disclosure under the Privacy Rule.
Incidental use or disclosure is:
a secondary use or disclosure that cannot reasonably be prevented
is limited in nature
occurs as a by-product of an otherwise permitted use or disclosure
Columbia University must implement reasonable safeguards to limit unintended uses and disclosures and must implement the minimum necessary standard requirements