Authorization to Disclose or Use Protected Health Information

Category: Privacy

Date: March 2003

Reviewed/Revised: April 2013

I. General Requirements

A department or division must have proper, written authorization from the individual (or the individual’s personal representative) before disclosing PHI, or requesting PHI for any purpose except to carry out payment activities or our health care operations or as permitted or required without authorization under Section III below. All departments and divisions must always act in strict accordance with an authorization.

1. An authorization is required for marketing or fundraising activities, except as included as a part of treatment, payment or health care operations.
2. An authorization is required for use and disclosure of psychotherapy notes except for the following uses:
   1. By the originator of the psychotherapy notes for treatment.
   2. In training programs in which students, trainees, or practitioners in mental health learn under supervision to practice or improve their skills in group, joint, family, or individual counseling.
   3. To defend a legal action or other proceeding brought by the individual.
3. An authorization is required for use and disclosure of PHI for purposes of research. All uses or disclosures of PHI for the purpose of research must be approved by the IRB. (See research policy.)
4. With very limited exceptions, the department or division is prohibited from conditioning treatment, payment, or eligibility for benefits or enrollment on obtaining an authorization. Furthermore, individuals, with limited exceptions, may revoke an authorization at any time.

There is no minimum necessary limitation on a use, disclosure or request of PHI (including psychotherapy notes) at the direction of the individual (or the individual's personal representative) pursuant to a valid authorization. 

II. Valid Authorization

The law dictates a specified set of core elements that a valid authorization must contain. These include:

• Specific information regarding the information to be disclosed;
• The person(s) to disclose the information;
• The person(s) to receive the information;
• The right to revoke the authorization (in writing).

In order to ensure that the authorization is valid it is preferred that the template Authorization to Use or Disclose Protected Health Information be used.

If the authorization is signed by the individual’s personal representative, be sure that the authorization shows the personal representative’s name and the relationship that gives the personal representative authority to act on the individual’s behalf.

The department or division must give the individual (or representative) a copy of the signed authorization. The signed authorization should be scanned into the patient's EHR or placed in the patient record.

III. Authorization is not required in the following situations:

Situations in which the department or division is NOT required to obtain the individual’s authorization to use or disclose PHI include:

1. Treatment, payment, and health care operations
2. Disclosures to the individual who is the subject of the information;
3. Uses and disclosures of PHI permitted requiring an opportunity for the individual to agree or object;
4. Required disclosures to the Secretary of Health and Human Services for enforcement of the rule;
5. Uses and disclosures as required by law as follows:
   1. For public health activities;
   2. About victims of abuse, neglect or domestic violence;
   3. For health oversight activities;
   4. For judicial and administrative proceedings;
   5. For law enforcement purposes;
   6. Those about decedents;
   7. For cadaveric organ, eye or tissue donation purposes;
   8. For limited research purposes only with IRB approval;
   9. To avert a serious threat to health or safety;
   10. For specialized government functions;
   11. For workers’ compensation.

IV. Defective Authorizations

An authorization that is incomplete, that you know contains false information, or that is not signed and dated is invalid. An authorization is not valid if it has any of the following defects:

1. The expiration date or event has passed
2. The authorization was not filled out completely
3. The authorization is revoked
4. The authorization lacks a required element
5. The authorization violates requirements regarding compound authorizations

V. Compound Authorizations 

An authorization for use or disclosure of PHI may not be combined with any other document to create a compound authorization except as follows:

1. Authorization for use and disclosures of PHI created for research that includes treatment
2. Authorization for a use or disclosure of psychotherapy notes may only be combined with another authorization for a use or disclosure of psychotherapy notes
3. Authorization, other than for psychotherapy notes, may be combined with another authorization except when a covered entity has conditioned the provision of treatment, payment, enrollment in the health plan, or eligibility for benefits on the provision of one of the authorizations 

VI. Prohibition on conditioning of authorizations

The department or division must not condition payment, enrollment, or benefits eligibility on an individual providing us with an authorization we request.

VII. Revocation of an authorization

An individual may revoke an authorization at any time by giving us written notice. The individual’s authorization is no longer valid once we receive the written revocation notice. A revocation will have no effect on actions taken prior to the revocation.

The department or division should coordinate all revocations with the Privacy Office to ensure all appropriate actions or notifications are made.

VIII. Documentation

The department or division must document and retain any signed authorization and revocation.