---
title: "When is patient authorization required before disclosing protected health information? Answer in under 100 words. Cite only eCFR (www.ecfr.gov) sources."
canonical: https://www.m-i-n-d.ai/minds/hipaa/when-hipaa-authorization-required
jurisdiction: "US Federal"
last_verified: 2026-08-27
license: CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/
attribution: "Source: MIND (m-i-n-d.ai)"
---

# When is patient authorization required before disclosing protected health information? Answer in under 100 words. Cite only eCFR (www.ecfr.gov) sources.

Under 45 CFR § 164.508, a covered entity must obtain a valid written authorization before using or disclosing protected health information (PHI) in three specific situations: (1) any use or disclosure of psychotherapy notes (with limited exceptions); (2) any use or disclosure of PHI for marketing, unless it is a face-to-face communication or a promotional gift of nominal value; and (3) any disclosure of PHI that constitutes a sale of PHI, as defined under § 164.502(a)(5)(ii).

## When Authorization Is Required

Under 45 CFR § 164.508, a covered entity must obtain a valid written authorization from the individual before using or disclosing protected health information (PHI) in the following circumstances:

1. **Psychotherapy Notes** (§ 164.508(a)(2)): Any use or disclosure of psychotherapy notes requires authorization, with narrow exceptions for use by the originator for treatment, training programs, or legal defense, and uses/disclosures required or permitted by §§ 164.512(a), (d), (g)(1), or (j)(1)(i).

2. **Marketing** (§ 164.508(a)(3)): Any use or disclosure of PHI for marketing requires authorization, except for face-to-face communications or promotional gifts of nominal value. If a third party provides remuneration for the marketing, the authorization must disclose that fact.

3. **Sale of PHI** (§ 164.508(a)(4)): Any disclosure of PHI that is a sale of PHI requires authorization. The authorization must state that the disclosure will result in remuneration to the covered entity.

## General Rule for Other Disclosures

Beyond the three specific categories above, covered entities are generally permitted to use or disclose PHI without individual authorization under the framework set out in 45 CFR § 164.502, including for treatment, payment, and health care operations (§ 164.506), as required by law (§ 164.512), and with the individual's agreement under § 164.510. Authorization under § 164.508 is the general baseline only for psychotherapy notes, marketing, and the sale of PHI.

## Sources

- [1] U.S. Government Publishing Office / Department of Health and Human Services — 45 CFR 164.508 — Uses and disclosures for which an authorization is required · https://www.ecfr.gov/current/title-45/section-164.508 · as of 2026-08-27
- [2] U.S. Government Publishing Office / Department of Health and Human Services — 45 CFR 164.502 — Uses and disclosures of protected health information — general rules · https://www.ecfr.gov/current/title-45/section-164.502 · as of 2026-08-27