HIPAA Allows the Use and Disclosure of PHI for Treatment, Payment, and Health Care Operations (TPO) Without the Patient's Consent or Authorization: True — With Three Limits Worth Knowing

True. HIPAA permits a covered entity to use and disclose protected health information for treatment, payment, and health care operations without the patient's consent or authorization. That permission is built into the Privacy Rule at 45 CFR 164.506, which describes TPO as the core activities a hospital, clinic, or insurer may perform with PHI as part of ordinary care delivery and payment. The statement in the keyword is accurate as written, but the permission has boundaries: state law can be stricter, psychotherapy notes sit outside the TPO shortcut, and the 2024 reproductive health care privacy rule added an attestation requirement for certain requests. This article explains what TPO actually covers, where the exceptions bite, and how to handle the edge cases that trip up compliance teams.

What 45 CFR 164.506 Actually Permits Under the Privacy Rule

The Privacy Rule, issued by the Department of Health and Human Services to implement the Health Insurance Portability and Accountability Act of 1996, treats TPO as the everyday permission that keeps care moving. Section 164.506(a) states that a covered entity may use or disclose PHI for its own treatment, payment, or health care operations activities. The same section allows disclosure to another covered entity for that entity's treatment, payment, or certain operations, provided both have or have had a relationship with the patient and the information relates to that relationship. No consent form, no authorization, and no written permission is required for these routine uses.

The three categories are defined narrowly enough to give compliance officers something to test. Treatment means providing, coordinating, or managing health care and related services, including consultation between providers and referrals. Payment covers activities like eligibility checks, billing, claims management, and utilization review. Health care operations includes quality assessment, practitioner training, business planning, and certain administrative activities. HHS's 2003 guidance accompanying the original Privacy Rule stated that these categories were deliberately drawn to cover most routine health care activity.

The permission is not absolute. Section 164.506(b) frames the TPO allowance as a "may," not a "must," and covered entities can adopt stricter internal policies that require opt-in consent for certain TPO uses. Hospitals in states with stricter informed-consent laws — California's Confidentiality of Medical Information Act and Washington's My Health My Data Act are examples — routinely layer consent requirements on top of HIPAA's floor. HIPAA is the minimum standard, not the ceiling.

One detail compliance teams often miss: the TPO permission applies to covered entities, which means health plans, clearinghouses, and providers who transmit claims electronically. A patient-facing fitness app that collects heart rate data is not a covered entity, so the TPO allowance does not apply to it. That distinction matters when patients ask why a hospital can share data with an insurer but a consumer wearable cannot share with a physician without a signed release.

The Three TPO Categories, Defined With Realistic Examples

Treatment covers a broad range, and the definition in 45 CFR 164.501 includes coordination and consultation with other providers. A primary care physician faxing a cardiologist the results of a recent stress test is treatment. So is a hospital pharmacist reviewing a medication list against a new prescription, or a telehealth clinician sending notes to the patient's in-person physician for follow-up. The permission also covers sharing PHI with the patient's family members or caregivers when they are involved in the patient's care, though good practice is to verify the patient's wishes first.

Payment includes eligibility determination, coverage review, claims submission, and claims management. When a clinic sends an insurer the diagnosis codes and procedure codes behind a claim, that is payment, and it does not require authorization. So is a health plan's review of a prior authorization request for a CT scan, or a billing office's back-and-forth with a patient's secondary insurer to coordinate benefits. The scope also extends to fraud and abuse detection and compliance programs, though the entity must satisfy the conditions in 45 CFR 164.502(j).

Health care operations is the broadest and most misunderstood category. It covers quality assessment and improvement, practitioner credentialing and review, training programs, licensing, business planning and development, and certain customer service activities. A hospital's quality committee reviewing surgical outcomes is in operations territory. So is a health system's compliance audit of claims data, or a clinician's certification training that uses de-identified case summaries. The 2024 reproductive health rule tightened this category indirectly — operations uses that involve reproductive health care requests from law enforcement now require attention to the attestation requirement covered later.

The table captures what a 300-person clinic actually needs to know at the front desk. The most common failure case is confusing psychotherapy notes with the rest of the mental health record. A therapist's session notes are segregated under 45 CFR 164.508(a)(2) and require a separate authorization even for treatment and payment purposes. The rest of the mental health record — diagnoses, medication lists, discharge summaries — flows under TPO like any other medical record.

Why the Common "True False" Test Answer Is True — and Where It Gets Tested

Exam questions on this topic almost always format the statement as a true/false question because the answer is unambiguously true under federal law. HIPAA's TPO permission has been part of the Privacy Rule since it took effect on April 14, 2003. The core structure has not changed, though it has been amended several times: the HIPAA Omnibus Rule in 2013, the reproductive health care privacy rule finalized in April 2024, and the reproductive health care rule's compliance date of December 23, 2024 for most provisions. A test-taker answering "true" is correct on federal law.

The statement gets tested in real clinics when a patient asks staff to stop sharing data with a specialist or health plan. Patients do have a right to request restrictions on disclosures to a health plan for payment or operations under 45 CFR 164.522(a), but the covered entity is not required to agree — except in one specific case. If the patient has paid out of pocket in full for an item or service, the covered entity must honor a request to restrict disclosure to the health plan for payment or operations purposes. That right was reinforced in the HITECH Act of 2009 and remains one of the few mandatory restrictions in the Privacy Rule.

The other test comes from state law. States that require patient consent before sharing certain categories of PHI — HIV status in some jurisdictions, mental health records in others, reproductive health information in most — have stricter rules that survive HIPAA. Compliance staff have to know which state laws apply to which facility and which data category. A hospital operating in three states may end up with three different consent workflows for what looks like the same TPO disclosure.

A less obvious boundary: HIPAA's TPO permission applies to disclosures among covered entities for the recipient's own TPO, and to business associates working under a business associate agreement. It does not authorize selling PHI for marketing, unless the patient signs an authorization that meets 45 CFR 164.508. Two decades of enforcement actions from HHS's Office for Civil Rights have centered on sales, marketing, and unauthorized research disclosures rather than routine TPO.

The Three Limits That Turn the True Statement Into a Compliance Exercise

First, the psychotherapy notes exclusion. Notes a mental health professional records to document or analyze the contents of a counseling session are held to a higher standard than the rest of the patient's record. They require a separate authorization for nearly every use or disclosure, including treatment and payment. Sharing them with the patient is permitted, and certain other narrow exceptions apply, but the practical effect is that therapists' session notes sit outside the TPO umbrella entirely.

Second, the marketing and sale restrictions. A hospital that accepts payment from a pharmaceutical company to send patients promotional materials is engaged in marketing, which requires an authorization that meets the specific content requirements in 45 CFR 164.508(c). The law's exceptions for face-to-face communications and $10-or-less gifts in 45 CFR 164.501 are narrow, and OCR has repeatedly said that the "gift" exception must not become a loophole for larger promotional arrangements.

Third, the 2024 reproductive health care privacy rule. The final rule, published in the Federal Register on April 26, 2024, prohibits the use or disclosure of PHI for criminal, civil, or administrative investigations of persons seeking, obtaining, providing, or facilitating reproductive health care that is lawful in the jurisdiction where it was provided. For TPO requests that could fall under this prohibition, the recipient of the request must obtain an attestation signed by the requesting party. Covered entities and business associates have to check whether an attestation is required before responding, and that extra step can slow disclosures that look routine on the surface.

A fourth limit, sometimes forgotten: minimum necessary. Section 164.502(b) requires covered entities to make reasonable efforts to limit PHI to the minimum necessary to accomplish the purpose, except for treatment disclosures and certain other categories. Payment and operations disclosures are subject to minimum necessary even though they do not require authorization. A billing office that sends an insurer the entire chart instead of the claim-relevant documentation has not violated the TPO permission but may have violated the minimum necessary standard.

How Consent, Authorization, and Notice of Privacy Practices Differ

Consent, authorization, and notice are three different legal tools, and mixing them up causes most of the confusion around this topic. Consent is a general permission that some states and some provider policies require before certain TPO uses — HIPAA does not mandate it, but many facilities ask for it anyway because state law or institutional policy wants the documentation. Authorization is a HIPAA-specific written permission required for uses and disclosures outside TPO: marketing, sale of PHI, most research uses, and psychotherapy notes. Notice of Privacy Practices is the plain-language document under 45 CFR 164.520 that tells patients how the entity may use their PHI; it is not a consent or an authorization.

Treating a signed Notice of Privacy Practices as consent is one of the most common operational errors in clinics. The Notice informs; it does not authorize anything. If a patient signs it at the front desk, that signature acknowledges receipt, not permission. Front-desk staff need scripts that distinguish the two, especially when patients believe they have "opted out of sharing" by signing a form. Under federal law, only the paid-in-full restriction is mandatory, and everything else depends on the entity's willingness to agree.

Authorization, meanwhile, has strict content requirements. Section 164.508(c) requires a description of the information, the purpose of the use or disclosure, an expiration date or event, the right to revoke, and a statement about the potential for redisclosure. If any of these elements are missing, the authorization is invalid and the disclosure is not protected. Compliance audits frequently find expired authorizations still being relied on — a failure mode that is easy to prevent with a workflow that flags expirations.

Consent forms vary widely by state. Texas, for example, requires consent for certain disclosures that HIPAA allows without it. Florida, New York, and California each layer additional requirements around mental health, HIV, and reproductive health data. A national telehealth company serving patients in 40 states cannot assume one consent workflow covers everyone; the actual governing rule is often the state where the patient resides, not the state where the clinician sits.

A Step-by-Step Review for Compliance Teams Facing a TPO Request

Use this sequence when someone asks whether a proposed use or disclosure of PHI qualifies for the TPO permission without an authorization. It reflects the way compliance officers in hospital systems typically structure the review, though each organization's process should be documented in its own policies.

1: Confirm the entity is a covered entity and the recipient is also a covered entity, or the recipient is a business associate acting under a business associate agreement. If the recipient is a consumer app, a marketing agency outside the BAA, or an unrelated third party, the TPO permission does not apply. 2: Identify which TPO category the disclosure falls under — treatment, payment, or health care operations — and document the specific activity (for example, coordination of care, claims management, quality assessment). If the activity does not fit one of the three definitions in 45 CFR 164.501, stop and treat the request as requiring an authorization. 3: Check the data category for exclusions. Psychotherapy notes require separate authorization. Marketing and sale of PHI require authorization unless an exception applies. Reproductive health care data requested by law enforcement, or in connection with a criminal or civil investigation, requires attestation under the 2024 rule. 4: Apply minimum necessary. For treatment, the standard does not apply as strictly; for payment and operations, send only the information reasonably necessary for the stated purpose. 5: Test the request against state law. A state health privacy statute, a state reproductive health statute, or a state mental health confidentiality law may be stricter than HIPAA. If stricter, follow the state rule. 6: If the patient has paid out of pocket in full for the item or service and has requested a restriction on disclosure to a health plan for payment or operations, honor the restriction. 7: Document the review: the purpose, the category, the recipient, the data elements, and the minimum-necessary analysis. Documentation protects the entity in an OCR inquiry and helps the next reviewer.

Failure handling: if any step reveals uncertainty — for example, the recipient's status as a covered entity is unclear, or the request involves reproductive health data near a jurisdiction boundary — pause the disclosure and route the question to privacy counsel. The cost of delaying a response is almost always lower than the cost of an impermissible disclosure, and the 2024 rule's attestation requirement makes "no attestation, no disclosure" the safer default.

Where State Law and the 2024 Reproductive Health Rule Override the Baseline

HIPAA sets the floor, and states are free to set ceilings above it. The preemption rule in 45 CFR 160.203 provides that a state law more stringent than HIPAA survives preemption, while a state law that is less protective is preempted. In practice, that means a hospital in a state with strict HIV confidentiality rules has to follow the state rule even for a TPO disclosure that HIPAA would allow. The state law, not the federal baseline, governs the interaction.

The 2024 reproductive health rule added a federal overlay that operates in the opposite direction to most state privacy law. The rule's purpose was to protect patients traveling across state lines for reproductive health care that is lawful where provided. The prohibition on disclosure for certain law enforcement and investigative purposes applies regardless of state law, and the attestation requirement applies to any request that could fall within the prohibited category. An insurer, a provider, or a business associate receiving such a request must obtain and review the attestation before releasing PHI. The rule's compliance date was December 23, 2024, with a later deadline for certain Notice of Privacy Practices updates.

The interaction between state and federal rules is a common source of confusion. A state law that permits a disclosure HIPAA prohibits is preempted; a state law that prohibits a disclosure HIPAA permits is not. That asymmetry means compliance officers must check both, not just the federal rule. A useful rule of thumb: HIPAA permits more than most states do, and the 2024 rule prohibits more than many states do in one specific area, so the effective rule is the stricter of the two for each category of data and each category of request.

Numbers around enforcement are harder to pin down than they look. OCR's public enforcement data shows settlements that vary widely by case size, and the annual reports do not break out TPO-specific cases separately from other privacy violations. The pattern across high-profile settlements is that impermissible disclosures for marketing, sale, or unauthorized research drive most penalties, while TPO disclosures per se are rarely the basis for enforcement. That pattern supports the true answer in the keyword: TPO is a permission, and the enforcement risk lives in the periphery.

Common Misconceptions That Produce the Wrong Answer on Exams and in Practice

The most frequent wrong answer in training comes from the belief that HIPAA requires a signed consent form for every disclosure. It does not. Consent is a state-law and institutional-practice overlay, not a federal TPO requirement. Front-desk staff who insist on consent before sharing records with a specialist are working from memory of a different clinic's policy or a state-specific rule, not the federal Privacy Rule.

A second misconception: that the TPO permission covers everything except psychotherapy notes. It does not cover marketing, sale of PHI, most research uses, or the disclosure of reproductive health data in the prohibited circumstances. The permission is broad but bounded, and treating it as unlimited is the failure mode that OCR's enforcement actions target.

A third: that patients can revoke consent for TPO at will. Under federal law, the only mandatory restriction is the paid-in-full restriction for health plan disclosures. Other restriction requests are requests, not vetoes. Patients who believe otherwise often escalate complaints to OCR, but the regulation does not give them the right they think they have. Good practice is to explain the distinction clearly at the point of request.

A fourth, more subtle: that business associates can use PHI for their own purposes under the TPO umbrella. They cannot. A business associate's permission to use PHI is defined by the business associate agreement and by the TPO activities of the covered entity. A vendor that uses hospital data to build its own analytics product outside the BAA scope has exceeded the TPO permission, even if the underlying data came from routine treatment.

What the True Answer Means in Day-to-Day Operations for Providers and Insurers

For a 200-bed community hospital, the practical effect of the TPO permission is that most of the day's PHI movement does not require paperwork. A patient admitted through the emergency department has their chart shared with the hospitalist team, the consulting cardiologist, the pharmacy, and the billing office — all under treatment or payment. The insurer receives claims data and prior authorization responses without a signed authorization. Quality committees review case data for operations purposes. The permission keeps care moving, and the hospital's privacy office works to keep the boundaries intact.

For a health insurer, TPO covers enrollment, eligibility, claims processing, and care management. It also covers fraud investigation, though the conditions in 45 CFR 164.502(j) apply and legal review is often prudent. The insurer's privacy office tracks state-level variation in consent requirements, particularly in states with reproductive health data statutes or mental health confidentiality laws that reach beyond HIPAA.

For patients, understanding the TPO permission helps explain what an authorization form is actually for. When a patient signs an authorization — for research participation, for release of records to an attorney, for marketing communications — they are consenting to something outside the routine TPO scope. When they sign a Notice of Privacy Practices at the front desk, they are acknowledging receipt of a document, not authorizing future disclosures. The distinction is worth explaining at the point of care because patients who understand it are less likely to file complaints over routine TPO activity.

The permission also defines what business associates can and cannot do with data. A billing vendor, a cloud storage provider working under a BAA, and an EHR vendor with a BAA are all covered by the TPO permission to the extent their activities fall within the covered entity's TPO activities. A vendor that uses the data for its own marketing or product development outside the BAA has acted outside the permission, and the covered entity may be accountable for the disclosure.

FAQ

Does HIPAA require a patient's consent for treatment, payment, and health care operations?

No. HIPAA's Privacy Rule at 45 CFR 164.506 explicitly permits the use and disclosure of PHI for these three purposes without the patient's consent or authorization. The statement in the keyword is true as written under federal law. State law can add stricter consent requirements, and covered entities often adopt their own policies that go beyond the federal minimum. Compliance officers should confirm both the federal baseline and the applicable state rules before relying on the permission.

What's the difference between consent, authorization, and a Notice of Privacy Practices?

An authorization is the written permission HIPAA requires for uses and disclosures outside TPO — marketing, sale of PHI, most research, and psychotherapy notes. Consent is a general permission some states and institutions require for certain TPO uses; HIPAA itself does not mandate it. The Notice of Privacy Practices, required by 45 CFR 164.520, is a disclosure document that informs patients how their PHI may be used; it is not a consent or an authorization, even when a patient signs an acknowledgment of receipt at the front desk.

Can a patient refuse to let a provider share information with a health plan for payment?

Generally no, except in one specific circumstance. Under 45 CFR 164.522(a), patients can request restrictions on disclosures, but the covered entity is not required to agree. However, if the patient has paid out of pocket in full for the item or service and requests a restriction on disclosure to the health plan for payment or operations, the covered entity must honor the request. That restriction was reinforced by the HITECH Act and remains a mandatory consent exception.

Do psychotherapy notes fall under TPO?

No. Psychotherapy notes are segregated from the rest of the medical record under 45 CFR 164.501 and require a separate authorization for nearly every use or disclosure, including treatment and payment. The rest of the mental health record — diagnoses, medication lists, assessments — falls under TPO. The distinction matters because practices that treat psychotherapy notes as part of the ordinary record risk unauthorized disclosures. Front-desk staff should be trained to flag notes labeled as psychotherapy notes for privacy review.

How does the 2024 reproductive health care privacy rule change routine TPO disclosures?

The rule, published in the Federal Register on April 26, 2024, prohibits the use or disclosure of PHI for certain criminal, civil, or administrative investigations of reproductive health care that is lawful where provided. For TPO requests that could fall within the prohibited category, the recipient must obtain an attestation from the requesting party. Covered entities and business associates need to check whether an attestation is required before responding. Compliance dates for most provisions were December 23, 2024, though some Notice of Privacy Practices updates have later deadlines.

Can a hospital share PHI with a marketing partner without authorization?

No. Marketing under HIPAA requires an authorization that meets the content requirements in 45 CFR 164.508(c). The TPO permission does not cover marketing, sale of PHI, most research uses, or psychotherapy notes. Two narrow exceptions exist: face-to-face communications and gifts of $10 or less, both defined in 45 CFR 164.501. OCR has repeatedly warned that the gift exception must not be used as a loophole for larger promotional arrangements, and enforcement actions have targeted unauthorized marketing disclosures.

Does the TPO permission apply to business associates?

Only to the extent the business associate's activities fall within the covered entity's own TPO activities and are defined in the business associate agreement. A business associate cannot use PHI for its own purposes under the TPO umbrella. A vendor that uses hospital data to build a product outside the BAA scope has exceeded the permission, and the covered entity may be accountable. Business associate agreements should clearly describe the permitted uses and disclosures so both parties understand the boundary.

This article is general educational information about HIPAA's Privacy Rule and does not constitute legal advice or a compliance certification. Privacy rules vary by jurisdiction and by the specific facts of each situation, and the 2024 reproductive health care privacy rule continues to generate interpretive questions. Consult a qualified health care attorney or privacy officer licensed in your jurisdiction before relying on any analysis in your own compliance program.