AhaBulb: Stuff Everyone Should Know · ahabulb.com/hipaa-tpo-no-authorization
Does a hospital need a patient's signed authorization to use PHI for treatment, payment or health care operations?
No, TPO uses are permitted without it.
- Yes, for every use
- No, these uses are permitted without authorization ✔
- Only for treatment
Why: A covered entity may use or disclose PHI for its own treatment, payment and health care operations without the patient's authorization. It may ask for consent, but HIPAA doesn't require it.
Huh, didn't know that: Consent can never stand in for an authorization when the rule requires one.
Why did the employee bring a ladder to the office? The job was on the next level.
Like this card?
References
Answer: No, these uses are permitted without authorization. A covered entity may use or disclose PHI for its own treatment, payment and health care operations without the patient's authorization. It may ask for consent, but HIPAA doesn't require it.
- 45 CFR 164.506 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.506
A covered entity may use or disclose protected health information for its own treatment, payment, or health care operations.
Checked 2026-10-11. - 45 CFR 164.506 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.506
shall not be effective to permit a use or disclosure of protected health information when an authorization, under § 164.508 , is required
Checked 2026-10-11.
Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.
More stuff everyone should know
Healthcare Privacy (HIPAA)What does a covered entity generally need before disclosing a patient's psychotherapy notes?Healthcare Privacy (HIPAA)A drug company pays a clinic to mail its patients ads for a new product. What does the clinic need?Healthcare Privacy (HIPAA)Can a covered entity sell patients' PHI to a data company without the patients' authorization?
That's stuff everyone should know.