Answer: The HIPAA Privacy Rule expressly requires an authorization for uses or disclosures of protected health information for ALL marketing communications, except in two circumstances: When the communication occurs in a face-to-face encounter between the covered entity and the individual; or.

Under what circumstances is a HIPAA authorization?

A HIPAA authorization is consent obtained from an individual that permits a covered entity or business associate to use or disclose that individual's protected health information to someone else for a purpose that would otherwise not be permitted by the HIPAA Privacy Rule.

What is required on a HIPAA authorization?

The core elements of a valid authorization include: A meaningful description of the information to be disclosed. The name of the individual or the name of the person authorized to make the requested disclosure. The name or other identification of the recipient of the information.