HIPAA (45 CFR Part 164)·§ 164.508(a)(2)·medium·Component: Privacy Rule

What this control requires

Authorization required: General rule. Except as otherwise permitted or required by this subchapter, a covered entity may not use or disclose protected health information without an authorization that is valid under this section. When a covered entity obtains or receives a valid authorization for its use or disclosure of protected health information, such use or disclosure must be consistent with such authorization. 164.508(a)(2) Authorization required: Psychotherapy notes. (i) Notwithstanding any provision of this subpart, other than the transition provisions in 164.532, a covered entity must obtain an authorization for any use or disclosure of psychotherapy notes, except: (i) To carry out the following treatment, payment, or health care operations: (A) Use by the originator of the psychotherapy notes for treatment; (B) Use or disclosure by the covered entity for its own training programs in which students, trainees, or practitioners in mental health learn under supervision to practice or improve their skills in group, joint, family, or individual counseling; or (C) Use or disclosure by the covered entity to defend itself in a legal action or other proceeding brought by the individual; and (ii) A use or disclosure that is required by 164.502(a)(2)(ii) or permitted by 164.512(a); 164.512(d) with respect to the oversight of the originator of the psychotherapy notes; 164.512(g)(1); or 164.512(j)(1)(i). 164.508(a)(3) Authorization required: Marketing. (i)Notwithstanding any provision of this subpart, other than the transition provisions in 164.532, a covered entity must obtain an authorization for any use or disclosure of protected health information for marketing, except if the communication is in the form of: (A) A face-to-face communication made by a covered entity to an individual; or (B) a promotional gift of nominal value provided by the covered entity. (ii) If the marketing involves financial remuneration, as defined in paragraph (3) of the definition of marketing at 164.501, to the covered entity from a third party, the authorization must state that such remuneration is involved. 164.508(a)(4) Authorization required: Sale of protected health information. (i) Notwithstanding any provision of this subpart, other than the transition provisions in 164.532, a covered entity must obtain an authorization for any disclosure of protected health information which is a sale of protected health information, as defined in 164.501 of this subpart. (ii) Such authorization must state that the disclosure will result in remuneration to the covered entity. 164.508(b)(1) Valid authorizations. (i) A valid authorization is a document that meets the requirements in paragraphs (a)(3)(ii), (a)(4)(ii), (c)(1), and (c)(2) of this section, as applicable. (ii) A valid authorization may contain elements or information in addition to the elements required by this section, provided, that such additional elements or information are not inconsistent with the elements required by this section. 164.508(b)(2) Defective authorizations. An authorization is not valid, if the document submitted has any of the following defects: (i) The expiration data has passed or the expiration event is known by the covered entity to have occurred; (ii) The authorization has not been filled out completely, with respect to an element described by paragraph (c) of this section, if applicable; (iii) The authorization is known by the covered entity to have been revoked; (iv) The authorization violates paragraph (b)(3) or (4) of this section, if applicable; (v) Any material information in the authorization is known by the covered entity to be false.
— HIPAA (45 CFR Part 164), § 164.508(a)(2)

In plain English

Authorization required: General rule. In practice, this means you can prove you general requirements-level controls on a defined cadence.

Why it matters

HIPAA non-compliance is a strict-liability matter: OCR civil monetary penalties are assessed per-record per-violation (up to USD 1.9 million per identical-violation calendar year as of 2024), and willful neglect can trigger criminal referral.

What an auditor looks for

HHS OCR investigators and SOC-2+HIPAA auditors look for the specific 45 CFR § citation, whether the safeguard is required vs addressable (and if addressable, the documented decision), the implementation specification, the workforce member responsible, and the records that show it runs.

Within Privacy Rule, the assessor will trace your implementation back to the catalogue reference (§ 164.508(a)(2)) and look for objective evidence on the latest two assessment cycles.

How to implement

Policy Management

Docs. Keep each policy in version-controlled Markdown alongside the code that implements it; ship a signed PDF snapshot at each annual review and link the SHA into the SoA.

Operational checklist

  • General. Document the trigger, the owner and the cadence.
  • Information. Document the trigger, the owner and the cadence.
  • Other. Document the trigger, the owner and the cadence.
  • Requirements. Document the trigger, the owner and the cadence.
  • Group. Document the trigger, the owner and the cadence.
  • Scope: requirements, management, policy, i, obtain, section, uses, b.

Evidence to collect

  • Policy Document. A signed and version-controlled policy / standard / procedure document.

Signed policy or standard documents the safeguard. Focus: Authorizations for uses and disclosures is required.

Common pitfalls

  • Policies that no engineer has read; the version in Confluence drifts from the version that's actually being enforced.

How it maps to other frameworks

Computed from shared tags, control component and key-operation subjects — handy when you are reconciling controls across an audit.

Related controls in HIPAA (45 CFR Part 164)

References

Topics: governance riskpolicy management