The second situation pertains to when a covered entity asks an individual for authorization to disclose or use information for purposes other than treatment, payment, healthcare operations or as otherwise discussed above. In those circumstances in which the regulations require patient authorization before protected health information is disclosed, the regulations' intent is to ensure that an individual's authorization is truly voluntary. For instance, the regulations prohibit covered entities from conditioning treatment or payment on the individual agreeing to disclose information for other purposes. In addition, the necessary authorization must clearly and specifically describe the information to be disclosed. If an authorization is sought so that a covered entity may sell, barter, or otherwise exchange the information for purposes other than treatment, payment or healthcare operations, the covered entity must disclose this fact on the authorization form.
Any authorization granted by an individual is revocable.
The proposed regulations provide a model authorization form which is attached at the end of the regulations. Individual Rights One of the shortcomings of the regulations is that they do not create any separate cause of action for any individual who is harmed by the misuse of protected health information by a covered entity. Nevertheless, an individual may be entitled to a separate cause of action under appropriate state laws, or in the case of a business partner arrangement, pursuant to their third-party rights under the contract. The regulations do afford individuals a number of basic rights with respect to their protected health information. First, individuals are permitted to inspect and obtain copies of such information.