HIPAA Privacy Rule 164.508: Authorization required for uses and disclosures not otherwise permitted

A covered entity must obtain a valid, specific written authorization meeting the core elements of 164.508(c) before using or disclosing PHI for purposes not otherwise permitted or required (for example most marketing, sale of PHI, and use of psychotherapy notes), and may not condition treatment, payment, enrollment or eligibility on the authorization except in the limited cases 164.508(b)(4) allows.