To share PHI for purposes other than treatment, payment, or operations, what must a patient do?

• A. Complete a privacy notice
• B. Sign an authorization to release information
• C. Verbal consent is sufficient
• D. Informally notify the physician

Answer: (B)

When sharing Protected Health Information (PHI) for purposes outside of treatment, payment, or healthcare operations, it is mandated that a patient must sign an authorization to release information. This requirement ensures that the patient's rights are upheld and that they have given explicit consent for their health information to be shared with specified individuals or entities for particular reasons.

This process is part of the regulations established under the Health Insurance Portability and Accountability Act (HIPAA), which is designed to protect patient privacy. The signed authorization must detail what information can be disclosed, to whom it will be disclosed, and the purpose for the disclosure. This level of specificity helps to ensure that patients retain control over their private health information.

In contrast, completing a privacy notice does not constitute consent for information sharing; it is meant to inform patients about their rights and how their information will be used. Verbal consent, while potentially useful in certain contexts, is not adequate for disclosing PHI beyond the defined scopes. Informally notifying a physician does not fulfill the legal requirements set forth by HIPAA and lacks the formal specificity needed for such disclosures.