Physician Practice

Q&A: Is written authorization needed to release patient PHI for TPO?

Physician Practice Insider, June 2, 2015

Q: It is my understanding that written authorization is required for the release of PHI even for treatment, payment, and operations (TPO) purposes. I believe this is true in New York state, but am unsure if it is also true nationally.

For instance, consider the patient who is in hospice and lacks ability to sign authorizations and consents due to deteriorated medical condition, but has not been deemed incapacitated. In this case, I am wondering whether the facility may release PHI for TPO purposes to caregivers who are relatives or friends but do not provide copies of properly executed healthcare proxies, living wills, or powers of attorney. Is the answer the same if incapacity has been declared and documented?
 
A: The federal HIPAA Privacy Rule does not require written authorization for the release of PHI for TPO.
If a patient is physically unable to sign an authorization but is mentally competent, he or she may sign with an "X" or give verbal consent in the presence of two witnesses who then document the patient's wishes.
 
If a patient lacks the capacity to make healthcare decisions, an agent designated in a healthcare proxy, living will, or power of attorney may make decisions on the patient's behalf, subject to limitations under state law and the specific legal document outlining the agent's powers.

Editor’s note: Mary D. Brandt, MBA, RHIA, CHE, CHPS, vice president of health information at the Central Texas Division of Baylor Scott & White Health in Temple, Texas, originally answered this question in Briefings on HIPAA.

Most Popular