When is a Covered Entity required to obtain an Authorization to use and disclose a patient’s Protected Health Information?

A covered health care provider must obtain an Authorization for uses and disclosures of PHI for:

1. Other than for Treatment, Payment, and Health Care Operations;

2. Psychotherapy notes; and

3. Marketing that is not face-to-face or includes a gift of more than nominal value.

4. Research, unless specifically waived by the IRB.

NOTE: A Covered Entity cannot require an individual to execute an Authorization as a condition of receiving treatment.

An Authorization, in order to be valid, must contain certain elements specified in the regulations. The University’s Authorization form is available on the HIPAA Privacy Forms – Clinics webpage.