5. When is a covered entity required to obtain an authorization to use and disclose a patient’s protected health information?
A covered health care provider must obtain an authorization for uses and disclosures of PHI for:
1. Uses and disclosures other than for treatment, payment, and health care operations;
2. Psychotherapy notes; and
3. Marketing.
A covered entity cannot require an individual to execute an authorization as a condition of receiving healthcare treatment. An authorization, in order to be valid, must contain certain elements specified in the regulations. The University is in the process of developing a prototype authorization form.
Return to FAQ List
|
YOU ARE HERE : HOME / HIPAA Frequently Asked Questions / FAQ 5
