Standards for Privacy of Individually Identifiable Health Information. Final Privacy Rule Preamble.. Section 164.508 - Uses and Disclosures for Which Individual Authorization Is Required


Under this section, a covered entity will need to obtain a written authorization from an individual, before it uses or discloses protected health information of the individual if the use or disclosure is not otherwise permitted or required under the rule without authorization. The burden associated with these requirements is the time and effort necessary for a covered entity to obtain written authorization prior to the disclosure of individually identifiable health information. On an annual basis, we estimate that it will take 764,799 entities, an annual average burden per entity of one hour for a total annual burden of 764,799 burden hours.