164.508    

7. AUTHORIZATION


164.508(a)(1)
   
7.1.
Authorization Requirement: Except as otherwise permitted or required under the privacy regulations, CE may not use or disclose PHI without a valid authorization, and may only use/disclose PHI consistent with such authorization.

164.508(a)(2)
   
 
7.1.1.
Psychotherapy notes: CE must obtain authorization for any use/disclosure of psychotherapy notes, except:
7.1.1.1.
For the following TPO:
7.1.1.1.1.
Use by originator of notes for treatment;
7.1.1.1.2.
Use/disclosure by CE for conducting its own counseling training programs in which students, trainees or practitioners in mental health learn under supervision to practice or improve their skills in group, joint, family or individual counseling; or
7.1.1.1.3.
Use/disclosure by CE to defend a legal action or other proceeding brought by the individual; and
7.1.1.2.
Use/disclosure: to Secretary of HHS regarding compliance; as required by law; for health oversight activities with respect to the oversight of the originator of notes; to coroners and medical examiners, or; to avert serious threat to health or safety.

164.508(a)(3)
   
7.2.
Authorization Required - Marketing:
7.2.1.
A CE must obtain an authorization for any use or disclosure of PHI for marketing, except of the communication is in the form of:
7.2.1.1.
A face-to-face communication made by a CE to an individual; or
7.2.1.2.
A promotional gift of nominal value provided by the CE.
7.2.2.
If the marketing involves direct or indirect renumeration to the CE from a third-party, the authorization must state that such renumeration was involved.

164.508(b)
   
7.3.
General Requirements for Authorization:
     
 
7.3.1.
Must meet requirements specified in ¶ 7.2.2 (marketing), ¶ 7.4 (core elements) and ¶ 7.5 (required statements);
 
7.3.2.
May contain additional elements or information, provided they are not inconsistent with required elements;
 
7.3.3
Authorizations with following defects are not valid:
7.3.3.1.
Expired date, or expiration event known by CE to have occurred;
7.3.3.2.
Incompletely filled out with regards to required core element (See ¶ 7.4);
7.3.3.3.
Known by CE to have been revoked;
7.3.3.4.
Violates restrictions on Compound authorizations ¶ 7.3.4 or Conditioning authorizations ¶ 7.3.5;
7.3.3.5.
Authorization is known by CE to contain false material information.

164.508(b)(3)
   
 
7.3.4.
Compound authorizations: Authorization may not be combined with any other document, including any other written legal permission from the individual, except as follows:
7.3.4.1.
Authorization for use/disclosure of PHI for a research study may be combined with any other written permission for the same research study, including another authorization for such research or consent to participate in such research;
7.3.4.2.
Authorization for use/disclosure of psychotherapy notes may only be combined with another authorization for use or disclosure of psychotherapy notes.
7.3.4.3.
Authorizations other than for use or disclosure of psychotherapy notes may be combined with any other such authorization, provided that the CE has not conditioned the provision of treatment, payment, enrollment in health plan, or eligibility for benefits on obtaining the authorization.

164.508(b)(4)
   
 
7.3.5.
Conditioning Authorization: CE may not condition provision of treatment, payment, enrollment in health plan, or eligibility for benefits on provision of authorization except:
7.3.5.1.
Provider may condition provision of research-related treatment on provision of an authorization for such research;
7.3.5.2.
Health plan may condition eligibility for benefits and enrollment in the health plan prior to an individual's enrollment if the authorization is not for use or disclosure of psychotherapy notes and is sought 1) for eligibility or enrollment determinations or 2) for its underwriting or risk-rating determinations;
7.3.5.3.
May condition the provision of health care that is solely for the purpose of creating PHI for disclosure to 3rd party on provision of an authorization for disclosure of the PHI to such 3rd party.

164.508(b)(5)
   
 
7.3.6.
Revocation: An individual may revoke an authorization at any time, in writing, except to the extent that CE has taken action in reliance thereon, or if authorization was obtained as a condition of obtaining insurance coverage and other law provides insurer right to contest claim under the policy or the policy itself.

164.508(b)(6)
   
 
7.3.7.
Documentation: CE must document and retain signed authorizations for period of six years from last effective date. [¶ 11.3.10.]

164.508(c)
   
7.4.
Core Elements: A valid authorization must contain at least the following elements:
7.4.1.
Description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion;
7.4.2.
Name of the person(s) or class of persons authorized to use or disclose the PHI;
7.4.3.
Name of the person(s) or class of persons to whom the CE is authorized to make the use or disclosure;
7.4.4.
Description of each purpose of the requested use/disclosure. Statement "at the request of the individual" is sufficient when an individual initiates the authorization and does not, or elects not to, provide a statement of purpose
7.4.5.
Expiration date or an expiration event that relates to the individual or the purpose of the use/disclosure. Statement "end of research study," "none," or similar language is sufficient if the authorization is for research, including the creation and maintenance of a research database or research repository.
7.4.6.
Signature of individual and date; If signed by personal representative, a description of the representative's authority to act for the individual;

164.508(c)(2)
   
7.5
Required Statements: In addition to the required elements, the authorization must contain statements adequate enough to place individual on notice of all of the following:
7.5.1.
Individual's right to revoke authorization in writing and either: 1) exceptions to the right to revoke and a description of how the individual may revoke; or 2) reference to the CE's privacy notice [see ¶ 4] if it contains the exceptions and description of how to revoke.
7.5.2.
The ability or inability to condition treatment, payment, enrollment or eligibility for benefits on the authorization by stating either
1) CE may not condition treatment, payment, enrollment or eligibility for benefits on whether individual signs authorization when the prohibition on conditioning authorizations applies [¶ 7.2.5] ; or
2) the consequences to the individual of a refusal to sign when, in accordance with ¶ 7.2.5, the CE can condition on failure to obtain such authorization.
7.5.3.
The potential for information disclosed pursuant to the authorization to be subject to redisclosure by recipient and no longer protected by the HIPAA privacy rules.

164.508(c)(3)
164.508(c)(4)
   
7.6
Additional Requirements
7.6.1.
Must be in plan language. (164.508(c)(3))
7.6.2.
Copy to the individual of signed authorization.
     
     

Table of Contents
| Index | HIPAA Statewide Project