Authorization requirements

Authorization - The Default Gate

• Default Rule: Patient authorization is required before disclosing Protected Health Information (PHI) for any purpose not otherwise permitted by HIPAA.
  • A detailed, signed document giving a covered entity permission to use or disclose specific PHI for a specific purpose.
  • 📌 "SAD-PERM" for valid authorization elements:
    • Specific description of PHI.
    • Authorized person/entity.
    • Date of expiration.
    • Purpose of disclosure.
    • Entity receiving PHI.
    • Right to revoke.
    • Must be signed by the patient.

⭐ Psychotherapy Notes: Require separate, specific patient authorization for most uses and disclosures, including for routine Treatment, Payment, and Operations (TPO). This is a stricter standard.

Valid Authorization - The Paper Trail

• A signed document granting permission to use or disclose Protected Health Information (PHI) for specific, non-routine purposes (e.g., research, marketing).

• Must be in plain language and contain specific core elements.

• Required Components:

  • Clear description of the PHI to be used/disclosed.
  • Name of the person/entity authorized to make the disclosure.
  • Name of the recipient of the PHI.
  • Specific purpose of the disclosure.
  • An expiration date or event (e.g., "end of the research study").
  • Patient’s signature and date.

⭐ A patient can revoke authorization in writing at any time. The revocation is not effective for actions a Covered Entity has already taken in reliance on the prior authorization.

Exceptions - When No Means Go

HIPAA permits disclosure of Protected Health Information (PHI) without patient authorization in specific situations, primarily for public good and national priority purposes. The "minimum necessary" standard is paramount.

• TPO - Treatment, Payment, & Healthcare Operations
  • Sharing info with a specialist, billing insurance, or for quality assurance.
• Public Interest & Benefit Activities
  • Public Health: Reporting infectious diseases (e.g., TB, STIs).
  • Abuse & Neglect: Reporting suspected child or elder abuse to authorities.
  • Law Enforcement: Complying with a court order or warrant.
  • Health Oversight: For audits by agencies like CMS.
  • Serious Threat: To prevent imminent harm to a person or the public.

⭐ The minimum necessary rule requires disclosing the least amount of PHI needed to achieve the purpose. It does not apply to disclosures for treatment.

High‑Yield Points - ⚡ Biggest Takeaways

• Default Rule: Patient authorization is required for any use or disclosure of PHI not for Treatment, Payment, or Healthcare Operations (TPO).
• Psychotherapy Notes: Have stricter protection and require separate, specific authorization for most disclosures, including for TPO.
• Always Required: Authorization is mandatory for most marketing communications and any sale of PHI.
• Validity Requirements: Must be in plain language, include an expiration date, and detail the specific information to be disclosed.
• Right to Revoke: Patients can revoke authorization at any time in writing, which stops all future disclosures.