HIPAA Glossary · Privacy Rule concepts
Authorisation
The signed, specific permission required for uses and disclosures beyond what the Privacy Rule permits.
Context
Required for marketing, most research, sale of PHI, psychotherapy note disclosures, and other uses outside TPO. Validity requirements at §164.508 are prescriptive: specific description of the information, who may use or disclose it, the recipient, purpose, expiration, and the individual's signature and date. Defective forms are void, which means the use was impermissible.
Related terms
- Sale of PHI — Receiving remuneration in exchange for PHI, prohibited without specific authorisation subject to narrow exceptions.
- TPO — The three purposes for which PHI may be used and disclosed without patient authorisation.
Where this fits
This is one of 50+ terms in the HIPAA Glossary. For how HIPAA is structured end-to-end, see the Security Rule guide and the Privacy Rule guide.