2. When is a Covered Entity required to obtain an Authorization to use and disclose a patientís Protected Health Information?
A covered health care provider must obtain an Authorization for uses and disclosures of PHI for:
1. Other than for Treatment, Payment, and Health Care Operations;
2. Psychotherapy notes; and
3. Marketing that is not face-to-face or includes a gift of more than nominal value.
4. Research, unless specifically waived by the IRB.
NOTE: A Covered Entity cannot require an individual to execute an Authorization as a condition of receiving treatment.
An Authorization, in order to be valid, must contain certain elements specified in the regulations. The University's Authorization form is available on the HIPAA Privacy Forms - Clinics webpage.
Return to FAQ List