Authorization for Use or Disclosure of Protected Health Information

The Privacy Rule under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) establishes national standards to protect individuals medical records and other personal health information. A central component of these regulations is the control over who has access to "Protected Health Information" (PHI). While the law permits healthcare providers to share information for treatment, payment, and healthcare operations without specific patient permission, any other use or disclosure generally requires a valid authorization from the patient.

This document outlines the requirements, scope, and procedures regarding the authorization for use or disclosure of protected health information. It serves as a guide to understanding when an individual's written permission is mandatory and what elements constitute a legally compliant authorization form.

Under the HIPAA Privacy Rule, a "covered entity" (such as a doctor, hospital, or health plan) is prohibited from using or disclosing PHI for purposes other than treatment, payment, or health care operations, unless the covered entity obtains a written authorization from the individual. This authorization acts as a permission slip, giving the covered entity explicit consent to handle the data in a specific manner defined by the document.

For an authorization to be valid under HIPAA, it must contain specific core elements and statements required by 45 CFR 164.508(c). A generic or vague permission slip is not sufficient. If an authorization lacks any of these elements, the use or disclosure based on that document would be a violation of HIPAA regulations. Below are the mandatory components:

• A Meaningful Description of the Information: The authorization must specifically describe the information to be used or disclosed. It cannot simply state "medical records." It must be specific enough to inform the individual exactly what is being shared (e.g., "mental health records from January 1, 2023, to present").
• The Person Authorized to Make the Use or Disclosure: The form must clearly identify who is releasing the information. This is typically the healthcare provider or health plan holding the records (the covered entity).
• The Person Authorized to Receive the Information: The authorization must state who will receive the PHI. This could be another doctor, a researcher, an insurance company, a family member, or an employer.
• A Description of the Purpose: Each authorization must provide a description of the purpose for which the information will be used. However, if the covered entity is seeking authorization for its own use or disclosure, a statement such as "at the request of the individual" is sufficient.
• Expiration Date or Event: The authorization must include an expiration date or an expiration event (such as "upon conclusion of the research study"). If no expiration is provided, the authorization is invalid. It must relate to the purpose of the use or disclosure.
• Statement of Right to Revoke: The document must inform the individual of their right to revoke the authorization in writing. It must also explain any exceptions to this right (for example, if the information has already been disclosed based on the authorization) and the process for revocation.
• Statement of Ability to Refuse/Deny Treatment: The authorization must state clearly that the individual may refuse to sign the authorization. Crucially, it must also state that the covered entity will not condition treatment, payment, enrollment, or eligibility for benefits on the individual signing the authorization. There are very limited exceptions to this, generally involving research involving no more than minimal risk.
• Disclosure Risks: If the authorization is for a research study, the form must include a statement that the protected health information may be disclosed by the covered entity and may no longer be protected by the Privacy Rule.
• Signature and Date: The authorization must be signed and dated by the individual (or their personal representative). In cases where a personal representative signs, a description of their authority to act for the individual must be included.

While HIPAA allows for the flow of health information without patient consent for routine healthcare operations, there are specific scenarios where authorization is strictly required. These situations often involve sensitive information or uses of data that are not strictly necessary for the patient's immediate medical care.

Psychotherapy Notes

Psychotherapy notes are notes kept by a mental health professional documenting or analyzing the contents of a conversation during a private counseling session. These notes are kept separate from the medical record. HIPAA requires a specific authorization to use or disclose psychotherapy notes, even for treatment purposes. This offers an extra layer of privacy for mental health records. However, there are exceptions for uses by the originator of the notes, for certain training programs, or in response to a court order.

Marketing

Covered entities generally cannot use or disclose PHI for marketing purposes without an individual's authorization. "Marketing" is defined as making a communication about a product or service that encourages recipients of the communication to purchase or use the product or service. There are exceptions for face-to-face communications about health-related services or for filling prescriptions for a patient, but generally, if a hospital wants to sell patient lists to a third party for advertising, a valid authorization is mandatory.

Sale of PHI

A covered entity cannot sell PHI without an authorization. "Sale" is defined as the exchange of PHI for remuneration (money or anything of value) by the covered entity. This prohibition ensures that healthcare organizations do not monetize their patients' private medical data. Certain public health and law enforcement exceptions exist, but purely commercial transactions require explicit patient consent.

Research

When researchers wish to use PHI for a research study, they must generally obtain authorization from the participants. This is often integrated into the "Informed Consent" process for the study. However, if the research is conducted on "de-identified" data (data stripped of all personal identifiers), authorization is not required because it is no longer considered PHI. Alternatively, researchers can apply for a waiver of authorization from an Institutional Review Board (IRB) or Privacy Board if the research meets specific criteria (minimal risk, impracticability to obtain authorization, etc.).

It is equally important to understand when an authorization is not required, as this facilitates the efficient operation of the healthcare system. The Privacy Rule permits the use and disclosure of PHI without the individual's authorization for the following purposes:

• Treatment: A doctor can share information with a specialist to whom a patient has been referred. Pharmacists can fill prescriptions prescribed by another doctor.
• Payment: A hospital can submit claims to an insurance company, and the insurance company can share information with doctors to coordinate care or determine eligibility.
• Health Care Operations: Hospitals can share information with quality improvement teams to improve care, or with accreditation organizations to demonstrate compliance with standards.
• Public Health Activities: Doctors can report diseases to public health authorities (like the CDC) to track outbreaks or prevent the spread of infectious diseases.
• Law Enforcement: Under specific conditions, PHI can be disclosed to comply with court orders, subpoenas, or lawful requests by law enforcement officials.
• Organ and Tissue Donation: Information can be shared with organ procurement organizations to facilitate donation.
• Research (Waived): As mentioned above, if the research has been granted a waiver by an IRB, individual authorization is not needed.

Patients retain the right to revoke their authorization at any time, provided they do so in writing. The revocation must be submitted to the covered entity (or the business associate). Once revoked, the covered entity must cease all uses and disclosures described in the authorization, except to the extent that it has already taken action in reliance on the authorization. For example, if a disclosure was made to a researcher minutes before the revocation letter arrived, the covered entity is not liable for that prior disclosure.

Furthermore, the Privacy Rule requires that covered entities obtain satisfactory assurances from their "business associates" (third parties that perform services involving PHI on behalf of the covered entity) that the business associate will appropriately safeguard the information. If a covered entity discloses information to a third party based on a patient's authorization, but receives assurance that the third party will not redisclose the information further (or will only do so consistent with the authorization), the chain of protection is maintained.

Compound authorizations (which authorize multiple uses or disclosures) are permitted as long as a copy of the authorization is provided to the individual. The language used in authorization forms must be written in plain language, ensuring that the individual can understand the nature of the consent they are giving.

Conclusion

The authorization for use or disclosure of protected health information is a fundamental right granted to patients under HIPAA. It places the control of personal medical data back into the hands of the individual. By strictly adhering to the content requirementsensuring specificity regarding what is shared, with whom, and for what purposecovered entities empower patients to understand and manage their health information privacy. Understanding the distinction between permitted uses for treatment, payment, and operations, and the need for explicit authorization for other purposes, is essential for compliance and for maintaining the trust between patients and healthcare providers.