When is patient authorization required before disclosing protected health information? Answer in under 100 words. Cite only eCFR (www.ecfr.gov) sources.

When Authorization Is Required

Under 45 CFR § 164.508, a covered entity must obtain a valid written authorization from the individual before using or disclosing protected health information (PHI) in the following circumstances:

1. Psychotherapy Notes (§ 164.508(a)(2)): Any use or disclosure of psychotherapy notes requires authorization, with narrow exceptions for use by the originator for treatment, training programs, or legal defense, and uses/disclosures required or permitted by §§ 164.512(a), (d), (g)(1), or (j)(1)(i).

2. Marketing (§ 164.508(a)(3)): Any use or disclosure of PHI for marketing requires authorization, except for face-to-face communications or promotional gifts of nominal value. If a third party provides remuneration for the marketing, the authorization must disclose that fact.

3. Sale of PHI (§ 164.508(a)(4)): Any disclosure of PHI that is a sale of PHI requires authorization. The authorization must state that the disclosure will result in remuneration to the covered entity.

General Rule for Other Disclosures

Beyond the three specific categories above, covered entities are generally permitted to use or disclose PHI without individual authorization under the framework set out in 45 CFR § 164.502, including for treatment, payment, and health care operations (§ 164.506), as required by law (§ 164.512), and with the individual's agreement under § 164.510. Authorization under § 164.508 is the general baseline only for psychotherapy notes, marketing, and the sale of PHI.