Uses Requiring Individual Authorization
As noted above, a CE must obtain an individual’s written authorization for any use or disclosure of PHI that is not otherwise permitted or required by the Privacy Rule.38 A valid authorization must contain language that identifies the information to be used or disclosed; the individual’s authorization to release and receive information; the purposes for disclosing the requested PHI; the expiration date or event; the individual’s right to revoke the authorization; and other restrictions.39
.png)