Before workers can perform certain activities, you must have a patient, or the patient's legally authorized representative, sign a written authorization form. As a general rule, authorizations are not required for workers' everyday activities. In particular, you don't need authorizations to do "treatment," "payment" and "health care operations" activities (TPO, discussed more below).
However, there are several fairly-common activities that you must get a patient authorization for, including:
- Using or disclosing patient information for most research purposes
- Using or disclosing patient information for several marketing purposes
- Using or disclosing patient information for several fundraising purposes
- Disclosing patient information to patients' attorneys
- Disclosing patient information to schools, under certain circumstances
- Most uses and disclosures of psychotherapy notes (i.e., notes a mental health therapist takes during counseling sessions that are stored apart from the patient's medical record)
These are the relatively common activities for which an authorization is required. If you ever do an uncommon (or "oddball") activity that you don't see mentioned in this HIPAA discussion, chances are you will need an authorization for that activity as well. For example, if you wanted to disclose news of a star athlete's injury to a TV news reporter, you would have to present the athlete (patient) with an authorization form that described this specific disclosure. The disclosure to the reporter would not be allowed unless the patient signed the authorization.
Some workers are already getting patient-signed permission forms for the activities above. Further, some of you are getting signed forms for other activities as well, such as releasing medical records to outside providers. None of these procedures will change much under HIPAA (though we may replace your permission form with an authorization form). If you are already getting written permission for an activity, keep it up: HIPAA does not remove any of our current patient permission and signature rules. Workers affected by HIPAA's authorization rules will receive additional training.