Departments & Programs,UW Hospital and Clinics,Compliance,Privacy,HIPAA,Privacy Rule

Know What Work Activities Require Patient Permission

Know What Work Activities Require Patient Permission - Departments & Programs, UW Hospital and Clinics, Compliance, Privacy, HIPAA, Privacy Rule


HIPAA has specific rules for workers who deal with patient information all the time. One rule says that workers- especially clinical staff - must get patients' permission to do certain activities. 

Work Activities That Require Written Permission (Authorization) 

There are certain activities that workers cannot do with patient information, unless the patient signs a special HIPAA authorization form. Workers must get a patient's HIPAA authorization before doing the following activities:

If you perform these activities, you will need to get patient authorizations. Some of you are currently getting signed forms for other activities as well, however. And this brings up an important point about HIPAA. HIPAA sets a minimum standard for patient privacy. If state law or UW Health's own policies require us to do more for patients, then we must do more. If you are already getting written permission for an activity, keep it up: HIPAA does not remove any of our current patient permission and signature rules. 

Workers affected by HIPAA's written permission rules will receive additional training. 

Work Activities That Require Spoken Permission (i.e., Patient Must be Given a Chance to Object) 

There are certain activities that workers cannot do unless you get the patient's spoken permission. The patient must be given a chance to object to the activity, i.e., a chance to say yes or no.

Please contact your supervisor or a HIPAA Privacy Officer if you have questions about the activities above that require permission (authorizations, or chance to object).