Permitted Uses and Disclosures, Authorization, and Minimum Necessary
The permission map
Most disclosures occur for treatment, payment, and health care operations without authorization. Authorization is required for psychotherapy notes (separately from the rest of the record), marketing, sale of PHI, and any use or disclosure not otherwise permitted. Between those poles sit the permission categories: public health, abuse and neglect reporting, health oversight, judicial and administrative proceedings, law enforcement, coroners and funeral directors, organ donation, research, averting a serious threat, and specialized government functions - each with conditions and each limited to what the law requires or permits.
Minimum necessary
Minimum necessary governs uses, disclosures, and requests for payment and operations, and it applies internally: workforce access should be role-appropriate. It does not apply to disclosures to or requests by a provider for treatment, to the individual, pursuant to an authorization, or to HHS. Reasonable reliance on the requester's stated need protects a discloser acting in good faith.
Authorization quality
Core elements include a description of the PHI, who may disclose, who may receive, purpose, expiration, signature and date, plus statements about revocation, potential redisclosure, and conditioning. A defective authorization is no authorization - the resulting disclosure is an incident candidate.
Rule of thumb
Ask three questions: is there a permission category, is the amount limited, and is the documentation defensible? Worked example: a law enforcement request for records without a warrant, court order, or the specific statutory criteria should go to counsel rather than be fulfilled.