Authorization requirements

Authorization requirements

Authorization requirements

On this page

Authorization - The Default Gate

  • Default Rule: Patient authorization is required before disclosing Protected Health Information (PHI) for any purpose not otherwise permitted by HIPAA.
    • A detailed, signed document giving a covered entity permission to use or disclose specific PHI for a specific purpose.
    • 📌 "SAD-PERM" for valid authorization elements:
      • Specific description of PHI.
      • Authorized person/entity.
      • Date of expiration.
      • Purpose of disclosure.
      • Entity receiving PHI.
      • Right to revoke.
      • Must be signed by the patient.

HIPAA Release Form Checklist

Psychotherapy Notes: Require separate, specific patient authorization for most uses and disclosures, including for routine Treatment, Payment, and Operations (TPO). This is a stricter standard.

Valid Authorization - The Paper Trail

  • A signed document granting permission to use or disclose Protected Health Information (PHI) for specific, non-routine purposes (e.g., research, marketing).

  • Must be in plain language and contain specific core elements.

  • Required Components:

    • Clear description of the PHI to be used/disclosed.
    • Name of the person/entity authorized to make the disclosure.
    • Name of the recipient of the PHI.
    • Specific purpose of the disclosure.
    • An expiration date or event (e.g., "end of the research study").
    • Patient’s signature and date.

⭐ A patient can revoke authorization in writing at any time. The revocation is not effective for actions a Covered Entity has already taken in reliance on the prior authorization.

Exceptions - When No Means Go

HIPAA permits disclosure of Protected Health Information (PHI) without patient authorization in specific situations, primarily for public good and national priority purposes. The "minimum necessary" standard is paramount.

  • TPO - Treatment, Payment, & Healthcare Operations
    • Sharing info with a specialist, billing insurance, or for quality assurance.
  • Public Interest & Benefit Activities
    • Public Health: Reporting infectious diseases (e.g., TB, STIs).
    • Abuse & Neglect: Reporting suspected child or elder abuse to authorities.
    • Law Enforcement: Complying with a court order or warrant.
    • Health Oversight: For audits by agencies like CMS.
    • Serious Threat: To prevent imminent harm to a person or the public.

⭐ The minimum necessary rule requires disclosing the least amount of PHI needed to achieve the purpose. It does not apply to disclosures for treatment.

High‑Yield Points - ⚡ Biggest Takeaways

  • Default Rule: Patient authorization is required for any use or disclosure of PHI not for Treatment, Payment, or Healthcare Operations (TPO).
  • Psychotherapy Notes: Have stricter protection and require separate, specific authorization for most disclosures, including for TPO.
  • Always Required: Authorization is mandatory for most marketing communications and any sale of PHI.
  • Validity Requirements: Must be in plain language, include an expiration date, and detail the specific information to be disclosed.
  • Right to Revoke: Patients can revoke authorization at any time in writing, which stops all future disclosures.

Practice Questions: Authorization requirements

Test your understanding with these related questions

An 83-year-old man presents to the gastroenterologist to follow-up on results from a biopsy of a pancreatic head mass, which the clinician was concerned could be pancreatic cancer. After welcoming the patient and his wife to the clinic, the physician begins to discuss the testing and leads into delivering the results, which showed metastatic pancreatic adenocarcinoma. Before she is able to disclose these findings, the patient stops her and exclaims, "Whatever it is, I don't want to know. Please just make me comfortable in my last months alive. I have made up my mind about this." Which of the following is the most appropriate response on the part of the physician?

1 of 5

Flashcards: Authorization requirements

1/10

A _____ is a medical outcome that should never occur

TAP TO REVEAL ANSWER

A _____ is a medical outcome that should never occur

"never event"

browseSpaceflip

Enjoying this lesson?

Get full access to all lessons, practice questions, and more.

Start Your Free Trial