What is the difference between “consent” and “authorization” under the HIPAA Privacy Rule?
The Privacy Rule permits, but does not require, a covered entity voluntarily to obtain patient consent for uses and disclosures of PHI for treatment, payment and health care operations (TPO). Covered entities that do so have complete discretion to design a process that best suits their needs. By contrast, an “authorization” is required by the Privacy Rule for uses and disclosures of PHI not otherwise allowed by the Rule. Where the Privacy Rule requires patient authorization, voluntary consent is not sufficient to permit a use or disclosure of PHI unless it also satisfies the requirements of a valid authorization. An authorization is a detailed document that gives covered entities permission to use PHI for specified purposes, which are generally other than TPO, or to disclose PHI to a third party specified by the individual. An authorization must specify a number of elements, including a description of the PHI to be used and disclosed, the person authorized to make the use or disclosure
The Privacy Rule permits, but does not require, a covered entity voluntarily to obtain patient consent for uses and disclosures of protected health information for treatment, payment, and health care operations. Covered entities that do so have complete discretion to design a process that best suits their needs. By contrast, an “authorization” is required by the Privacy Rule for uses and disclosures of protected health information not otherwise allowed by the Rule. Where the Privacy Rule requires patient authorization, voluntary consent is not sufficient to permit a use or disclosure of protected health information unless it also satisfies the requirements of a valid authorization. An authorization is a detailed document that gives covered entities permission to use protected health information for specified purposes, which are generally other than treatment, payment, or health care operations, or to disclose protected health information to a third party specified by the individual. An
Related Questions
- By establishing new waiver criteria and authorization requirements, hasn t the HIPAA Privacy Rule, in effect, modified the Common Rule?
- v Authorizations What is the difference between "consent" and "authorization" under the HIPAA Privacy Rule?
- What is the difference between "consent" and "authorization" under the HIPAA Privacy Rule?
