Departments & Programs,UW Hospital and Clinics,Compliance,Privacy,HIPAA,Protected Health Information (PHI)

Work Activities Requiring a Patient's Signed Authorization (Written Permission)

Work Activities Requiring a Patient's Signed Authorization (Written Permission) - Departments & Programs, UW Hospital and Clinics, Compliance, Privacy, HIPAA, Protected Health Information (PHI)


Before workers can perform certain activities, you must have a patient, or the patient's legally authorized representative, sign a written authorization form. As a general rule, authorizations are not required for workers' everyday activities. In particular, you don't need authorizations to do "treatment," "payment" and "health care operations" activities (TPO, discussed more below). 

However, there are several fairly-common activities that you must get a patient authorization for, including:

These are the relatively common activities for which an authorization is required. If you ever do an uncommon (or "oddball") activity that you don't see mentioned in this HIPAA discussion, chances are you will need an authorization for that activity as well. For example, if you wanted to disclose news of a star athlete's injury to a TV news reporter, you would have to present the athlete (patient) with an authorization form that described this specific disclosure. The disclosure to the reporter would not be allowed unless the patient signed the authorization. 

Some workers are already getting patient-signed permission forms for the activities above. Further, some of you are getting signed forms for other activities as well, such as releasing medical records to outside providers. None of these procedures will change much under HIPAA (though we may replace your permission form with an authorization form). If you are already getting written permission for an activity, keep it up: HIPAA does not remove any of our current patient permission and signature rules. Workers affected by HIPAA's authorization rules will receive additional training.