The second situation pertains to a covered entity asking an individual for authorization to disclose or use information for purposes other than treatment, payment, health care operations or as otherwise discussed above. In those circumstances in which the regulations require patient authorization before protected health information is disclosed, the regulations' intent is to ensure that an individual's authorization is truly voluntary. For instance, the regulations prohibit covered entities from conditioning treatment or payment on the individual agreeing to disclose information for other purposes. In addition, the necessary authorization must clearly and specifically describe the information to be disclosed. If an authorization is sought so that a covered entity may sell, barter, or otherwise exchange the information for purposes other than treatment, payment or health care operations, the covered entity must disclose this fact on the authorization form.
Any authorization granted by an individual is revocable.
The proposed regulations provide a model authorization form. The regulations afford individuals a number of basic rights with respect to their protected health information. First, individuals are permitted to inspect and obtain copies of such information. Second, individuals are required to receive written notice of information practices and security safeguards of the covered entity. Third, individuals would have the right to request an amendment or correction of protected health information that is inaccurate or incomplete.