HIPAA Glossary · Privacy Rule concepts
TPO
Also: treatment, payment, and healthcare operations
The three purposes for which PHI may be used and disclosed without patient authorisation.
Context
The workhorse permission at §164.506. Treatment covers care coordination between providers; payment covers billing, eligibility, and claims; healthcare operations covers quality, training, credentialing, audits, and business planning. Most routine healthcare runs on TPO. Uses beyond TPO generally need either a specific permission in the rule or a signed authorisation.
Related terms
- Authorisation — The signed, specific permission required for uses and disclosures beyond what the Privacy Rule permits.
- Minimum necessary — The standard requiring uses, disclosures, and requests to be limited to the least PHI needed for the purpose.
Where this fits
This is one of 50+ terms in the HIPAA Glossary. For how HIPAA is structured end-to-end, see the Security Rule guide and the Privacy Rule guide.