Skip to Content

A Summary of the Proposed HIPAA Regulations Implementing HITECH
Uses Requiring Individual Authorization

Uses Requiring Individual Authorization


As noted above, a CE must obtain an individual’s written authorization for any use or disclosure of PHI that is not otherwise permitted or required by the Privacy Rule.38 A valid authorization must contain language that identifies the information to be used or disclosed; the individual’s authorization to release and receive information; the purposes for disclosing the requested PHI; the expiration date or event; the individual’s right to revoke the authorization; and other restrictions.39



  • 38. Id. at § 164.508.
  • 39. Id. at § 164.508(a)(3)(ii), (c)(1)-(2).