2.2 Patient Authorizations, Marketing Restrictions & Prohibition on Sale of PHI

Patient Authorizations, Marketing Restrictions & Prohibition on Sale of PHI

While routine healthcare operations, treatment, and payment flow freely under statutory exceptions, all non-routine, commercial, and third-party disclosures require express, voluntary, and informed written patient permission. Under the HIPAA Privacy Rule, this formal legal instrument is the HIPAA Authorization (45 CFR § 164.508).

Healthcare compliance officers must maintain rigorous quality control over authorization forms and workflows. The Privacy Rule strictly distinguishes between clinical consents and formal authorizations, establishes heightened safeguards for sensitive behavioral health documentation, and erects stringent barriers against the commercial exploitation and unauthorized sale of patient data.

+---------------------------------------------------------------------------------------------------+
|                         HIPAA AUTHORIZATION LEGAL FRAMEWORK                                       |
|                                  (45 CFR § 164.508)                                               |
|                                                                                                   |
|   +---------------------------------------+       +---------------------------------------+       |
|   |           6 CORE ELEMENTS             |       |         3 REQUIRED STATEMENTS         |       |
|   |         (45 CFR § 164.508(c)(1))      |       |        (45 CFR § 164.508(c)(2))       |       |
|   | 1. Meaningful description of PHI      |       | 1. Right to revoke in writing &       |       |
|   | 2. Name of entity authorized to share |       |    exceptions to revocation           |       |
|   | 3. Name of recipient / class          |       | 2. Non-conditioning of treatment,     |       |
|   | 4. Description of each purpose        |       |    payment, enrollment (with 3 narrow |       |
|   | 5. Expiration date or specific event  |       |    statutory exceptions)              |       |
|   | 6. Signature & date (with authority   |       | 3. Potential for re-disclosure by     |       |
|   |    of personal representative)        |       |    recipient without HIPAA protection |       |
|   +---------------------------------------+       +---------------------------------------+       |
+---------------------------------------------------------------------------------------------------+

---

1. Core Elements & Mandatory Statements of a Valid HIPAA Authorization

Under 45 CFR § 164.508(b)(2), an authorization is defective and void if it contains any of the following defects: (1) the expiration date has passed or expiration event is known to have occurred; (2) the form has not been filled out completely with respect to a required element; (3) the authorization is known to have been revoked; (4) the authorization violates compound authorization rules; or (5) any material information is known by the covered entity to be false.

The 6 Mandatory Core Elements (45 CFR § 164.508(c)(1))

1. Specific Description of Info: A specific and meaningful description of the information to be used or disclosed.
2. Authorized Discloser: The name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure.
3. Authorized Recipient: The name or other specific identification of the person(s), or class of persons, to whom the covered entity may make the requested use or disclosure.
4. Purpose Description: A description of each purpose of the requested use or disclosure. If the individual initiates the authorization, the statement "at the request of the individual" is legally sufficient.
5. Expiration Date / Event: An expiration date or an expiration event relating to the individual or the purpose of the disclosure (e.g., "upon conclusion of the clinical research trial" or "one year from signature").
6. Signature and Date: Signature of the individual and date. If signed by a personal representative, a description of the representative's legal authority to act on behalf of the individual (e.g., healthcare power of attorney, legal guardian, executor) must be documented.

The 3 Required Statutory Statements (45 CFR § 164.508(c)(2))

1. Revocation Notice: A statement of the individual's right to revoke the authorization in writing, and either the exceptions to revocation (e.g., the entity has taken action in reliance on the authorization, or authorization was obtained as a condition of obtaining insurance coverage where law grants insurer right to contest claims) and instructions on how to revoke.
2. Prohibition on Conditioning: A statement that the covered entity may not condition treatment, payment, enrollment in a health plan, or eligibility for benefits on the provision of an authorization, along with the three narrow statutory exceptions:
   • Clinical Research Trials: Conditioning research-related treatment on providing research authorization is permitted (45 CFR § 164.508(b)(4)(i)).
   • Health Plan Underwriting / Enrollment: A health plan may condition enrollment or eligibility on an authorization requested prior to enrollment for underwriting determinations (45 CFR § 164.508(b)(4)(ii)).
   • Third-Party Healthcare Creation: Healthcare provided solely for the purpose of creating PHI for disclosure to a third party (e.g., pre-employment drug screening, commercial driver physicals, life insurance exams) may be conditioned on signing the authorization (45 CFR § 164.508(b)(4)(iii)).
3. Re-Disclosure Risk: A statement alerting the individual that information disclosed pursuant to the authorization may be subject to re-disclosure by the recipient and no longer protected by the HIPAA Privacy Rule.

General Execution Rules

• Plain Language Mandate: The authorization must be written in plain language (45 CFR § 164.508(c)(3)).
• Copy to Individual: If a covered entity seeks an authorization from an individual, it must provide the individual with a copy of the signed authorization (45 CFR § 164.508(c)(4)).
• Prohibition on Compound Authorizations: An authorization cannot be combined with any other legal document (e.g., general clinical treatment consent or liability waiver) to create a "compound authorization," with narrow exceptions for clinical research protocols.

---

2. Psychotherapy Notes: Heightened Legal Protections

Psychotherapy notes occupy a uniquely protected tier within the HIPAA Privacy Rule architecture (45 CFR § 164.501 and § 164.508(a)(2)). Congress and HHS recognized that open, uninhibited communication between mental health professionals and patients requires absolute confidentiality.

+---------------------------------------------------------------------------------------------------+
|                         PSYCHOTHERAPY NOTES VS. GENERAL MEDICAL RECORD                            |
|                                    (45 CFR § 164.501)                                             |
|                                                                                                   |
|   PSYCHOTHERAPY NOTES (Heightened Protection)        GENERAL MEDICAL RECORD (Standard PHI)        |
|   +---------------------------------------------+    +------------------------------------------+ |
|   | - Notes recorded in any medium by a mental  |    | - Medication prescription and monitoring | |
|   |   health professional                       |    | - Counseling session start and stop times| |
|   | - Documenting/analyzing the contents of     |    | - Modalities and frequencies of treatment| |
|   |   conversation during a private counseling  |    | - Results of clinical tests (e.g. MMPI)  | |
|   |   session (individual, group, family)       |    | - Diagnosis, functional status, symptoms | |
|   | - MUST be maintained SEPARATE from the rest |    | - Treatment plan, prognosis, progress    | |
|   |   of the medical record                     |    |                                          | |
|   +---------------------------------------------+    +------------------------------------------+ |
|         Requires SEPARATE Standalone                     Accessible via Standard TPO &            |
|           Written Authorization                              Patient Right of Access              |
+---------------------------------------------------------------------------------------------------+

The Mandatory Separate Authorization Rule

A covered entity must obtain a standalone, separate authorization to use or disclose psychotherapy notes. It cannot be combined with an authorization for any other PHI.

Narrow Statutory Exceptions (No Authorization Required)

Psychotherapy notes may be used or disclosed without authorization in only 8 extremely limited circumstances:

1. Originator Use: Use by the originating mental health professional for ongoing treatment.
2. Clinical Training: Use by the covered entity in its own training programs for mental health students, trainees, or practitioners.
3. Entity Legal Defense: Use by the covered entity to defend itself in a lawsuit or formal legal proceeding brought by the patient.
4. HHS Enforcement: Disclosures to HHS OCR during a HIPAA compliance investigation or audit.
5. Required by Law: Uses or disclosures required by law under 45 CFR § 164.512(a).
6. Health Oversight: Oversight activities of the originator under 45 CFR § 164.512(d).
7. Coroners / Medical Examiners: Identifying a deceased individual under 45 CFR § 164.512(g)(1).
8. Serious and Imminent Threat: Averting a serious and imminent threat to health or safety under 45 CFR § 164.512(j).

Key Privacy Right Interaction: Psychotherapy notes are completely excluded from the patient's Right of Access under 45 CFR § 164.524(a)(1)(i). An individual has no statutory right to inspect or obtain copies of psychotherapy notes, and an entity's denial of access to psychotherapy notes is unreviewable.

---

3. Marketing Restrictions Under HIPAA (45 CFR § 164.501 & § 164.508(a)(3))

Under HIPAA, Marketing is defined as making a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.

+---------------------------------------------------------------------------------------------------+
|                             HIPAA MARKETING COMPLIANCE DECISION TREE                              |
|                                                                                                   |
|   Does the communication encourage purchase or use of a third-party commercial product/service?   |
|                                     |                                                             |
|                    +----------------+----------------+                                            |
|                    | YES                             | NO --> (Not marketing)                     |
|                    v                                                                              |
|   Is it a Face-to-Face communication OR a promotional gift of nominal value?                      |
|                    |                                                                              |
|         +----------+----------+                                                                   |
|         | YES                 | NO                                                                |
|         v                     v                                                                   |
|   [EXEMPT: No auth]     Does the covered entity receive FINANCIAL REMUNERATION from a third       |
|                         party in exchange for making the communication?                           |
|                               |                                                                   |
|                    +----------+----------+                                                        |
|                    | YES                 | NO                                                     |
|                    v                     v                                                        |
|            [REQUIRES WRITTEN     Is it a treatment communication or prescription refill           |
|             AUTHORIZATION        reminder where remuneration equals direct cost?                  |
|             DISCLOSING                |                                                           |
|             REMUNERATION]        +----+----+                                                      |
|                                  | YES     | NO                                                   |
|                                  v         v                                                      |
|                            [EXEMPT: Cost  [REQUIRES WRITTEN                                       |
|                             Recovery Only] AUTHORIZATION]                                         |
+---------------------------------------------------------------------------------------------------+

The General Rule & Remuneration Catalyst

• General Rule: All marketing communications require prior written patient authorization.
• Financial Remuneration Rule: If the marketing communication involves direct or indirect financial remuneration paid to the covered entity by a third party whose product/service is being promoted, the authorization must clearly state that financial remuneration is involved (45 CFR § 164.508(a)(3)(ii)).

Statutory Marketing Exceptions

1. Face-to-Face Communications: Direct in-person communications between a clinician and a patient (e.g., a physician handing a patient sample medication or discussing a brand-name surgical device during an office consult).
2. Promotional Gifts of Nominal Value: Inexpensive promotional items distributed by the entity (e.g., pens, calendars, tote bags bearing clinic branding).
3. Refill Reminders & Treatment Communications: Communications regarding currently prescribed drugs, biologics, or generic alternatives are exempt from authorization only if any financial remuneration received by the covered entity is reasonably related to the entity's actual cost of making the communication (e.g., direct costs of paper, printing, and postage—zero profit margin allowed).

---

4. Prohibition on the Sale of PHI (45 CFR § 164.502(a)(5)(ii) & § 164.508(a)(4))

Enacted under Section 13405(d) of the HITECH Act and codified in the 2013 Omnibus Final Rule, HIPAA strictly prohibits the Sale of PHI.

Definition of "Sale of PHI"

A sale of PHI occurs when a covered entity or business associate receives direct or indirect remuneration (financial or non-financial consideration) from or on behalf of the recipient of the PHI in exchange for the disclosure of PHI.

The Mandatory Authorization Mandate

A covered entity may not sell PHI without a valid authorization that expressly states that the disclosure will result in remuneration to the covered entity.

Statutory Exceptions to "Sale of PHI" (No Authorization Required for Cost Recovery)

---

5. Fundraising Communications (45 CFR § 164.514(f))

Covered entities and their institutionally related foundations may use or disclose limited PHI for fundraising purposes for their own benefit without prior patient authorization, provided they adhere to strict statutory boundaries.

Permitted Limited Data Elements

A covered entity may use or disclose only 6 specific data categories for fundraising:

1. Demographic information (patient name, address, phone number, email, age, gender, date of birth);
2. Dates of healthcare service provided;
3. Department of service (e.g., cardiology, pediatrics, orthopedics);
4. Treating physician name;
5. Outcome information (broad categories, such as treatment completed or deceased);
6. Health insurance status (e.g., commercial, Medicare, uninsured).

Strict Prohibition: Covered entities may never disclose clinical diagnosis, medical records, surgical notes, or specific diagnostic test results to fundraising staff or foundations without express written authorization.

Mandatory Clear & Conspicuous Opt-Out Requirements

• Every fundraising communication (letter, email, phone script) must provide a clear and conspicuous opportunity to opt out of future fundraising communications.
• The opt-out mechanism must be simple, free, and require no undue burden (e.g., a toll-free number, pre-paid return postcard, or single-click web link).
• The covered entity may not condition treatment or payment on the patient's fundraising opt-out choice and must maintain internal suppression lists to honor all opt-out requests prospectively.