Analysis by the AHIMA Policy and Government Relations Team
Uses and Disclosures for Which an Authorization Is Required
Standard: Authorizations for Uses and Disclosures
Authorizations Required: General Rule
The Rule states (§164.508) that except as otherwise permitted or required by [the Rule], a covered entity may not use or disclose PHI without an authorization that is valid under this section. When a covered entity obtains or receives a valid authorization for its use or disclosure of PHI, such use or disclosure must be consistent with such authorization.
Authorizations required: Psychotherapy Notes
Notwithstanding any other provision of this section, other than the transition provisions provided for in the Rule’s section Transition Provisions, a covered entity must obtain an authorization for any use or disclosure of psychotherapy notes, except:
- To carry out the following treatment, payment, or healthcare operations, consistent with consent requirements in Consent for Uses or Disclosures to Carry Out Treatment, Payment, or Health Care Operations:
- Use by originator of the psychotherapy notes for treatment;
- Use or disclosure by the covered entity in training programs in which students, trainees, or practitioners in mental health learn under supervision to practice or improve their skills in group, joint, family, or individual counseling; or
- Use or disclosure by the covered entity to defend a legal action or other proceeding brought by the individual, and a use or disclosure that is required or permitted with respect to the oversight of the originator of the psychotherapy notes.
Specifications: Core Elements and Requirements
Core Elements
A valid authorization must contain at least the following elements:
- A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion;
- The name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure;
- The name or other specific identification of the person(s), or class of persons, to whom the covered entity may make the requested use or disclosure;
- An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure;
- A statement of the individual’s right to revoke the authorization in writing and the exceptions to the right to revoke, together with a description of how the individual may revoke the authorization;
- A statement that information used or disclosed pursuant to the authorization may be subject to redisclosure by the recipient and no longer be protected by this rule;
- Signature of the individual and date; and
- If the authorization is signed by a personal representative of the individual, a description of such representative’s authority to act for the individual.
Plain Language Requirement
"The authorization must be written in plain language."
Specifications: Authorizations Requested by a Covered Entity for Its Own Uses and Disclosures
If an authorization is requested by a covered entity for its own use or disclosure of PHI that it maintains, the covered entity must comply with the following requirements:
- The authorization for the uses or disclosures described in this paragraph must, in addition to meeting the requirements for "core elements and requirements" [above], contain the following elements:
- For any authorization to which the "prohibition on conditioning" [see below] of this section applies, a statement that the covered entity will not condition treatment, payment, enrollment in the health plan, or eligibility for benefits on the individual’s providing authorization for the requested use or disclosure;
- A description of each purpose of the requested use or disclosure;
- A statement that the individual may inspect or copy the PHI to be used or disclosed as provided in the Rule’s Access of Individuals to Protected Health Information and refuse to sign the authorization; and
- If use or disclosure of the requested information will result in direct or indirect remuneration to the covered entity from a third party, a statement that such remuneration will result.
- A covered entity must provide the individual with a copy of the signed authorization.
Authorizations Requested by a Covered Entity for Disclosures by Others
If an authorization is requested by a covered entity for another covered entity to disclose PHI to the covered entity requesting the authorization to carry out treatment, payment, or healthcare operations, the covered entity requesting the authorization must comply with the following requirements:
- The authorization for the disclosures described in this paragraph must, in addition to meeting the requirements of "core elements and requirements" [above], contain the following elements:
- A description of each purpose of the requested disclosure;
- Except for an authorization on which payment may be conditioned [see conditioning below], a statement that the covered entity will not condition treatment, payment, enrollment in the health plan or eligibility for benefits on the individual’s providing authorization for the requested use or disclosure; and
- A statement that the individual may refuse to sign the authorization.
- A covered entity must provide the individual with a copy of the signed authorization.
Specification: Authorizations for Uses and Disclosures of PHI Created for Research that Includes Treatment of the Individual
Except as otherwise permitted for research, a covered entity that creates PHI for the purpose, in whole or part, of research that includes treatment of individuals must obtain an authorization for the use or disclosure of such information. Such authorization must be for uses and disclosures not otherwise permitted or required…meet the requirements of "core element and requirements" "valid authorizations" and contain:
- A description of the extent to which such PHI will be used or disclosed to carry out treatment, payment, or healthcare operations;
Optional Procedure
An authorization may be in the same document as:
- A consent to participate in the research;
- A consent to use or disclose PHI to carry out treatment, payment, or healthcare operations, or
- A notice of privacy practices.
Specifications: General Requirements
Valid Authorizations
A valid authorization is a document that contains the required elements listed above. A valid authorization may contain elements or information in addition to the elements required by this section, provided that such additional elements or information are not inconsistent with the elements that are required.
Defective Authorization
An authorization is not valid, if the document submitted has any of the following defects:
- The expiration date has passed or the expiration event is known by the covered entity to have occurred;
- The authorization has not been filled out completely, with respect to an element described in this section above;
- The authorization is known by the covered entity to have been revoked;
- The authorization lacks an element required by this section above;
- The authorization violates the "compound authorization" requirements [below], if applicable; and
- Any material information in the authorization is known by the covered entity to be false.
Compound Authorizations
An authorization for use or disclosure of PHI information may not be combined with any other document to create a compound authorization, except as follows:
- An authorization for the use or disclosure of PHI created for research that includes treatment of the individual may be combined as permitted by [this Rule];
- An authorization for a use or disclosure of psychotherapy notes may only be combined with another authorization for a use or disclosure of psychotherapy notes;
- An authorization under this section, other than an authorization for a use or disclosure of psychotherapy notes may be combined with any other such authorization under this section except when a covered entity has conditioned the provision of treatment, payment, enrollment in the health plan, or eligibility for benefits…on the provision of one of the authorizations.
Prohibition on Conditioning of Authorizations
A covered entity may not condition the provision to an individual of treatment, payment, enrollment in the health plan, or eligibility for benefits on the provision of an authorization, except:
- A covered healthcare provider may condition the provision of research-related treatment on provision of an authorization under this discussion [above];
- A health plan may condition enrollment in the health plan or eligibility for benefits on provision of an authorization requested by the health plan prior to an individual’s enrollment in the health plan, if:
- The authorization sought is for the health plan’s eligibility or enrollment determinations relating to the individual or for its underwriting or risk rating determinations; and
- The authorization is not for a use or disclosure of psychotherapy notes.
- A health plan may condition payment of a claim for specified benefits on provision of an authorization…if :
- The disclosure is necessary to determine payment of such claim and the authorization is not for a use or disclosure of psychotherapy notes.
- A covered entity may condition the provision of healthcare that is solely for the purpose of creating PHI for disclosure to a third party on provision of an authorization for the disclosure of the PHI to such third party.
Revocation of Authorizations
An individual may revoke an authorization provided under this section at any time, provided that the revocation is in writing, except to the extent that the covered entity has taken action in reliance thereon or if the authorization was obtained as a condition of obtaining insurance coverage, other law provides the insurer with the right to contest a claim under the policy.
Documentation
A covered entity must document and retain any signed authorization under these requirements as required by the Rule’s section on Documentation.
Go to next section, Uses and Disclosures Requiring an Opportunity for the Individual to Agree or to Object .
Go to previous section, Consent for Use or Disclosures to Carry Out Treatment, Payment, or Health Care Operations.
Go to document index.