Consent, Authorization, and Minimum Necessary
Consent Versus Authorization
Consent and authorization are distinct. Consent is a general permission for treatment, payment, and healthcare operations and is governed largely by state law and organizational policy. Authorization is a specific, detailed permission for uses or disclosures not otherwise permitted-such as marketing or sale of PHI-and must contain core elements: a description of the information, who may disclose and receive it, the purpose, an expiration date or event, signature and date, and statements about the right to revoke and the potential for redisclosure. Authorizations must be plain language and a copy given to the individual.
Minimum Necessary
Minimum necessary requires reasonable efforts to limit PHI to the least amount needed for the purpose. It applies to most uses, disclosures, and requests, but not to treatment disclosures, disclosures to the individual, disclosures made under a valid authorization, or disclosures required by law. Organizations should identify the workforce roles that need access and establish routine and non-routine disclosure protocols.
Traps Candidates Miss
- A compound authorization has special rules; authorizations for psychotherapy notes cannot be combined with others in the same document.
- Revocation must be honored except to the extent action has already been taken in reliance.
- A deficient authorization is not a valid authorization-missing elements invalidate it.
- Minimum necessary is not "minimum possible"; it is a reasonable standard.
Rule of Thumb
Use authorization when the purpose is not TPO and not a permitted public-interest disclosure. Use minimum necessary as a filter for everything except the enumerated exceptions.
Worked Example
A researcher requests identifiable records for a study without IRB approval. Because research without a waiver requires authorization, the request should be denied or routed to obtain IRB or privacy board approval-minimum necessary alone does not authorize the disclosure.