As just discussed, workers need to get patients' permission to do certain activities. However, there are many, many activities you can do with patient information that don't require permission.
Workers Don't Need Permission to Do Everyday Health Care Activities (Also Called "TPO")
Workers - especially clinical staff - should know HIPAA doesn't require patient permission for many everyday health care activities. HIPAA says that no patient permission is needed for you to perform the everyday functions of "Treatment," "Payment," and "health care Operations," which are together called "TPO."
- Treatment. You don't need permission to use or disclose patient information if you are treating a patient, or making arrangements to treat a patient.
- Payment. You don't need permission to use or disclose patient information if you are creating bills, or coordinating billing with patients, health insurance companies, and others.
- Health Care Operations. You don't need permission to use or disclose patient information if you are doing "operational" activities like training medical students, preventing fraud and abuse, meeting licensing and accreditation requirements, and reviewing how well clinical workers did their jobs (i.e., quality assurance).
HIPAA does not require permission for these everyday "TPO" activities. But once again, if you are already getting written permission for an activity - even a TPO activity - you must keep it up. Workers involved with TPO will receive additional HIPAA training.
Workers Don't Need Permission to Do Certain Activities that Benefit the Public
In addition to everyday/TPO activities, there are other activities workers can do without getting patients' permission. No patient permission is needed for the following activities, which all benefit the public.
- Public health activities, like arranging organ donations, reporting medical product defects, and reporting statistics like disease rates.
- Disclosures to authorities, like police or courts, when required by law.
- Disclosures for certain employment or workers' compensation purposes.
It is important for workers - especially clinical staff - to know that these activities don't require permission. Please contact your supervisor or a HIPAA Privacy Officer if you have questions about TPO activities or activities that benefit the public (i.e., activities that don't require patient permission).