AHIMA Professional Practice Experience Workbook

covered entity to use and disclose the individual’s PHI for a tissue bank, as long as the authorization makes clear that the individual may choose not to opt in to the tissue bank and that the choice will not impact treatment, payment, or benefits. However, there is an exception. This provision applies to all types of research studies except when the research involves the use or disclosures of psychotherapy notes. For research purposes, psychotherapy note authorizations may not be combined with any other authorization for use or disclosure of psychotherapy notes. l Psychotherapy notes: An authorization for the use or disclosure of psychotherapy notes may be combined with another authorization for the use or disclosure of psychotherapy notes. For example, an individual can complete an authorization that requests his psychotherapy notes be sent to his attorney and a second mental health professional. An authorization for psychotherapy notes must specifically identify psychotherapy notes when a general authorization or research authorization is executed. This can be indicated by the mark of a check box on the current form, or a separate form can be used. It is up to the covered entity whether the use of a separate form is preferred. l General Authorizations: In accordance with §164.508 of the privacy rule, an authorization for the disclosure of health information may be combined with another authorization. For example, a patient may request lab results be disclosed to two different family members (living in separate residences) on the same form. However, an authorization that conditions treatment, payment, enrollment, or eligibility for benefits on completion may not be combined with a general authorization because a general authorization is not conditioned. For example, an insurance company may not combine an authorization they require as a condition of enrolling in their plan with a general authorization to obtain copies of patient information following the approved enrollment. Marketing Authorizations The HITECH Omnibus Rule requires a valid authorization be obtained from an individual before the use or disclosure of PHI for marketing purposes involving financial remuneration. The authorization must also include a statement about any direct or indirect remuneration the covered entity has received or will receive from a third party. An authorization for marketing purposes can be included on the organization’s compliant HIPAA authorization form or a separate one may be created.

The following are exceptions to the marketing rule and do not require an authorization:

l Face-to-face communications from the covered entity to the individual l Gifts of nominal value provided by the covered entity

Refer to the Release of Information for Marketing or Fundraising Purposes practice brief for further requirements. Sale of Protected Health Information The HITECH Omnibus Rule does not permit a covered entity to directly or indirectly receive remuneration in exchange for PHI of an individual unless covered by a valid authorization. An authorization for this purpose must include a statement that the disclosure will result in remuneration to the covered entity. Note: The way remuneration is used pertaining to the sale of PHI is different than how is it used for marketing purposes. Remuneration here is defined to include both financial and nonfinancial benefits also known as in-kind benefits (i.e., laptops or iPads for the residency program).