What is a HIPAA authorization?
A HIPAA authorization is a signed, written permission from a patient that allows a use or disclosure of their protected health information (PHI) not otherwise permitted by HIPAA. Treatment, payment, and healthcare operations do not need one. Marketing and most sales of PHI do.
What the buyer is really asking
A HIPAA authorization is a patient's written permission for a use of PHI that treatment, payment, or operations do not already cover. As a business associate you usually act on the covered entity's instructions and do not collect authorizations yourself. Say which role you play and how you would honor a revoked authorization.
Other ways buyers ask it
Every one of these wants the same answer:
- “Describe your process for HIPAA authorizations.”
- “How do you track patient authorizations for use or disclosure of PHI?”
- “How do you handle a revoked HIPAA authorization?”
Evidence to have ready
- The BAA section on permitted uses and disclosures
- An authorization tracking procedure, if you collect them directly
How Tyrvar answers this
Tyrvar treats every wording above as one question. You write the answer once, attach the evidence, and revisit it when your setup changes. Each buyer gets that approved answer no matter how their questionnaire words it. If you have not answered it yet, Tyrvar flags the question for you and does not make something up. Try it on your own questionnaire.