Source: https://casetext.com/regulation/code-of-federal-regulations/title-45-public-welfare/subtitle-a-department-of-health-and-human-services/subchapter-c-administrative-data-standards-and-related-requirements/part-164-security-and-privacy/subpart-e-privacy-of-individually-identifiable-health-information/164508-uses-and-disclosures-for-which-an-authorization-is-required
Timestamp: 2020-06-01 21:19:29
Document Index: 266991157

Matched Legal Cases: ['§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164']

§ 164.508 Uses and disclosures for which an authorization is required, 45 C.F.R. § 164.508 | Casetext Search + Citator
(a) Standard: Authorizations for uses and disclosures - (1) Authorization required: General rule. Except as otherwise permitted or required by this subchapter, a covered entity may not use or disclose protected health information without an authorization that is valid under this section. When a covered entity obtains or receives a valid authorization for its use or disclosure of protected health information, such use or disclosure must be consistent with such authorization.
(3) Authorization required: Marketing. (i) Notwithstanding any provision of this subpart, other than the transition provisions in § 164.532, a covered entity must obtain an authorization for any use or disclosure of protected health information for marketing, except if the communication is in the form of:
(4) Authorization required: Sale of protected health information. (i) Notwithstanding any provision of this subpart, other than the transition provisions in § 164.532, a covered entity must obtain an authorization for any disclosure of protected health information which is a sale of protected health information, as defined in § 164.501 of this subpart. (ii) Such authorization must state that the disclosure will result in remuneration to the covered entity.
(b) Implementation specifications: General requirements - (1) Valid authorizations. (i) A valid authorization is a document that meets the requirements in paragraphs (a)(3)(ii), (a)(4)(ii), (c)(1), and (c)(2) of this section, as applicable.
(c) Implementation specifications: Core elements and requirements - (1) Core elements. A valid authorization under this section must contain at least the following elements:
(B) To the extent that the information in paragraph (c)(2)(i)(A) of this section is included in the notice required by § 164.520, a reference to the covered entity's notice.