45 CFR 164.508 — HIPAA Privacy Rule: Uses and disclosures for which an authorization is required

What this rule requires your agency to do

• 1A covered entity may not condition treatment, payment, enrollment, or eligibility for benefits on obtaining an authorization, except in the three enumerated situations (§ 164.508(b)(4)).(45 CFR 164.508 — HIPAA Privacy Rule: Uses and disclosures for which an authorization is required)
• 2A covered entity must honor an individual's written revocation of an authorization, except to the extent it has already acted in reliance or other law provides an insurer contest right (§ 164.508(b)(5)).(45 CFR 164.508 — HIPAA Privacy Rule: Uses and disclosures for which an authorization is required)
• 3A valid authorization must contain the required core elements and required statements, be written in plain language, and a copy of the signed authorization must be provided to the individual; the entity must document and retain it (§ 164.508(c) and (b)(6)).(45 CFR 164.508 — HIPAA Privacy Rule: Uses and disclosures for which an authorization is required)
• 4A covered entity must obtain an authorization for any use or disclosure of PHI for marketing (except face-to-face communications or nominal-value promotional gifts), and must state in the authorization when financial remuneration is involved (§ 164.508(a)(3)).(45 CFR 164.508 — HIPAA Privacy Rule: Uses and disclosures for which an authorization is required)
• 5A covered entity must treat an authorization as invalid if it has any listed defect (expired, incomplete, revoked, prohibited combination, or known-false material information) (§ 164.508(b)(2)).(45 CFR 164.508 — HIPAA Privacy Rule: Uses and disclosures for which an authorization is required)
• 6A covered entity must obtain an authorization stating that remuneration will result before any disclosure of PHI that constitutes a sale of PHI (§ 164.508(a)(4)).(45 CFR 164.508 — HIPAA Privacy Rule: Uses and disclosures for which an authorization is required)
• 7A covered entity must obtain an authorization for any use or disclosure of psychotherapy notes, except in the specific treatment/oversight/legal circumstances enumerated (§ 164.508(a)(2)).(45 CFR 164.508 — HIPAA Privacy Rule: Uses and disclosures for which an authorization is required)
• 8A covered entity must obtain a valid authorization before using or disclosing PHI, except as otherwise permitted or required by the subchapter, and any use/disclosure must be consistent with that authorization (§ 164.508(a)(1)).(45 CFR 164.508 — HIPAA Privacy Rule: Uses and disclosures for which an authorization is required)