This policy outlines a set of procedures regarding covered entities obtaining authorization to use or disclose protected health information (PHI). The purpose of this policy is to comply with all applicable laws and regulations since HIPAA requires a covered entity to obtain authorization to use or disclose protected health information for all purposes not explicitly permitted under the regulations (45 CFR §164.508[b][4]; §164.508[c]; §164.508[d]).
This example is applied to all covered entities wherein a covered entity is defined as a firm or individual group that provides healthcare services that would use private health information.