3.7 Authorized Uses and Disclosures

Any disclosure or use of PHI by a covered entity not for payment, treatment, healthcare operations, or as otherwise permitted/required by the Privacy Rule demands the individual’s express consent.

An authorization must always be expressed in detail in writing. It may permit the covered entity requesting the approval of a third party to use and disclose protected health information.

Furthermore, authorization must be written in clear language and include details about the data that will be shared or utilized.