 |
164.508
|
|
 |
|
|
 164.508(a)(1) |
|
 |
|
|
|
Authorization Requirement:
Except as otherwise permitted or required under the privacy regulations,
CE may not use or disclose PHI without a valid authorization, and
may only use/disclose PHI consistent with such authorization. |
|
 164.508(a)(2) |
|
 |
|
| |
7.1.1. |
Psychotherapy notes: CE must obtain
authorization for any use/disclosure of psychotherapy notes, except:
7.1.1.1. |
For the following TPO:
7.1.1.1.1. |
Use by
originator of notes for treatment; |
7.1.1.1.2. |
Use/disclosure by CE for conducting
its own counseling training programs in which students,
trainees or practitioners in mental health learn under
supervision to practice or improve their skills in group,
joint, family or individual counseling; or
|
7.1.1.1.3. |
Use/disclosure
by CE to defend a legal action or other proceeding brought
by the individual; and |
|
7.1.1.2. |
Use/disclosure: to Secretary of HHS
regarding compliance; as required by law; for health oversight
activities with respect to the oversight of the originator of
notes; to coroners and medical examiners, or; to avert serious
threat to health or safety. |
|
|

164.508(a)(3) |
|
 |
|
|
|
Authorization Required - Marketing:
|
7.2.1.
|
A CE must obtain an authorization for
any use or disclosure of PHI for marketing, except of the
communication is in the form of:
|
7.2.1.1.
|
A face-to-face communication made
by a CE to an individual; or
|
|
7.2.1.2.
|
A promotional gift of nominal
value provided by the CE.
|
|
|
7.2.2.
|
If the marketing involves direct or
indirect renumeration to the CE from a third-party, the
authorization must state that such renumeration was involved.
|
|
|
 164.508(b) |
|
 |
|
|
|
General Requirements for Authorization:
|
|
| |
|
 |
|
| |
|
Must meet requirements specified in ¶
7.2.2 (marketing), ¶ 7.4 (core elements) and ¶ 7.5 (required
statements);
|
| |
|
May contain additional elements
or information, provided they are not inconsistent with required elements;
|
| |
|
Authorizations with following defects
are not valid:
|
7.3.3.1.
|
Expired date,
or expiration event known by CE to have occurred; |
|
7.3.3.2.
|
Incompletely filled out with regards
to required core element (See ¶ 7.4);
|
|
7.3.3.3.
|
Known by CE
to have been revoked; |
|
7.3.3.4.
|
Violates restrictions on Compound authorizations
¶ 7.3.4 or Conditioning authorizations ¶ 7.3.5;
|
|
7.3.3.5.
|
Authorization
is known by CE to contain false material information. |
|
|
 164.508(b)(3) |
|
 |
|
| |
|
Compound
authorizations: Authorization may not be combined with any other
document, including any other written legal permission from the individual,
except as follows:
|
7.3.4.1.
|
Authorization for use/disclosure of PHI
for a research study may be combined with any other written
permission for the same research study, including another
authorization for such research or consent to participate
in such research;
|
|
7.3.4.2.
|
Authorization
for use/disclosure of psychotherapy notes may only be combined
with another authorization for use or disclosure of psychotherapy
notes. |
|
7.3.4.3.
|
Authorizations
other than for use or disclosure of psychotherapy notes may
be combined with any other such authorization, provided that
the CE has not conditioned the provision of treatment, payment,
enrollment in health plan, or eligibility for benefits on obtaining
the authorization. |
|
|
 164.508(b)(4) |
|
 |
|
| |
|
Conditioning Authorization: CE may not
condition provision of treatment, payment, enrollment in health
plan, or eligibility for benefits on provision of authorization
except:
|
7.3.5.1.
|
Provider may condition provision of research-related
treatment on provision of an authorization for such research;
|
|
7.3.5.2.
|
Health plan may condition eligibility
for benefits and enrollment in the health plan prior to an
individual's enrollment if the authorization is not for use
or disclosure of psychotherapy notes and is sought 1) for
eligibility or enrollment determinations or 2) for its underwriting
or risk-rating determinations;
|
|
7.3.5.3.
|
May condition the provision of health
care that is solely for the purpose of creating PHI for disclosure
to 3rd party on provision of an authorization for disclosure
of the PHI to such 3rd party.
|
|
|
 164.508(b)(5) |
|
 |
|
| |
|
Revocation: An individual may revoke
an authorization at any time, in writing, except to the extent that
CE has taken action in reliance thereon, or if authorization was
obtained as a condition of obtaining insurance coverage and other
law provides insurer right to contest claim under the policy or
the policy itself.
|
|
 164.508(b)(6) |
|
 |
|
| |
|
Documentation:
CE must document and retain signed authorizations for period of six
years from last effective date. [¶ 11.3.10.] |
|
 164.508(c) |
|
 |
|
|
|
Core Elements: A valid authorization
must contain at least the following elements:
|
7.4.1.
|
Description of the information to be used
or disclosed that identifies the information in a specific
and meaningful fashion;
|
|
7.4.2.
|
Name of the person(s) or class of persons
authorized to use or disclose the PHI;
|
|
7.4.3.
|
Name of the person(s) or class of persons
to whom the CE is authorized to make the use or disclosure;
|
|
7.4.4.
|
Description of each purpose of the requested
use/disclosure. Statement "at the request of the individual"
is sufficient when an individual initiates the authorization
and does not, or elects not to, provide a statement of purpose
|
|
7.4.5.
|
Expiration date or an expiration event
that relates to the individual or the purpose of the use/disclosure.
Statement "end of research study," "none,"
or similar language is sufficient if the authorization is
for research, including the creation and maintenance of a
research database or research repository.
|
|
7.4.6.
|
Signature of individual and date; If
signed by personal representative, a description of the representative's
authority to act for the individual;
|
|
|

164.508(c)(2) |
|
 |
|
|
7.5
|
Required Statements: In addition to the
required elements, the authorization must contain statements adequate
enough to place individual on notice of all of the following:
|
7.5.1.
|
Individual's right to revoke authorization
in writing and either: 1) exceptions to the right to revoke
and a description of how the individual may revoke; or 2)
reference to the CE's privacy notice [see ¶ 4] if it
contains the exceptions and description of how to revoke.
|
|
7.5.2.
|
The ability or inability to condition
treatment, payment, enrollment or eligibility for benefits
on the authorization by stating either
1) CE may not condition treatment, payment, enrollment or
eligibility for benefits on whether individual signs authorization
when the prohibition on conditioning authorizations applies
[¶ 7.2.5] ; or
2) the consequences to the individual of a refusal to sign
when, in accordance with ¶ 7.2.5, the CE can condition
on failure to obtain such authorization.
|
|
7.5.3.
|
The potential for information disclosed
pursuant to the authorization to be subject to redisclosure
by recipient and no longer protected by the HIPAA privacy
rules.
|
|
|

164.508(c)(3)
164.508(c)(4) |
|
 |
|
|
7.6
|
Additional Requirements
|
7.6.1.
|
Must be in plan language. (164.508(c)(3))
|
|
7.6.2.
|
Copy to the individual of signed authorization.
|
|
|
| |
|
 |
|
|
| |
|
 |
|
|