SESK: Stuff Everyone Should Know · sesk.info/hipaa-tpo-no-authorization
Does a hospital need a patient's signed authorization to use PHI for treatment, payment or health care operations?
No, TPO uses are permitted without it.
- Yes, for every use
- No, these uses are permitted without authorization ✔
- Only for treatment
Why: A covered entity may use or disclose PHI for its own treatment, payment and health care operations without the patient's authorization. It may ask for consent, but HIPAA doesn't require it.
Huh, didn't know that: Consent can never stand in for an authorization when the rule requires one.
Why did the employee bring a ladder to the office? The job was on the next level.
Like this card?
References
Answer: No, these uses are permitted without authorization. A covered entity may use or disclose PHI for its own treatment, payment and health care operations without the patient's authorization. It may ask for consent, but HIPAA doesn't require it.
- 45 CFR 164.506 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.506
A covered entity may use or disclose protected health information for its own treatment, payment, or health care operations.
Checked 2026-10-10. - 45 CFR 164.506 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.506
shall not be effective to permit a use or disclosure of protected health information when an authorization, under § 164.508, is required
Checked 2026-10-10.
Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.
More stuff everyone should know
Work SkillsA hospital sends a claim to a patient's insurer to get paid. Which HIPAA category is that?Work SkillsA hospital uses real charts to review how well its nurses perform. Which HIPAA category is that?Work SkillsDoes HIPAA protect patient information that is spoken out loud, or only paper and computer records?
That's stuff everyone should know.