HIPAA requires a signed patient authorization for release of any protected health information (PHI)except for certain circumstances. (Originally, HIPAA required a signed consent form which was replaced with the Notice of Privacy Practices requirement for normal operational use of PHI.) One broad category of exceptions is for TPO - "Treatment, Payment and healthcare Operations."
The core health care activities of “Treatment,” “Payment,” and “Health Care Operations” are defined in the Privacy Rule at 45 CFR 164.501.
“Treatment” generally means the provision, coordination, or management of health care and related services among health care providers or by a health care provider with a third party, consultation between health care providers regarding a patient, or the referral of a patient from one health care provider to another.
“Payment” encompasses the various activities of health care providers to obtain payment or be reimbursed for their services and of a health plan to obtain premiums, to fulfill their coverage responsibilities and provide benefits under the plan, and to obtain or provide reimbursement for the provision of health care.
“Health care operations” are certain administrative, financial, legal, and quality improvement activities of a covered entity that are necessary to run its business and to support the core functions of treatment and payment.
Even though HIPAA does not require a signed consent form for TPO, a clinic can optionally choose to require such a signed form prior to release.
Treatment
The provision, coordination, or management of health care and related services by one or more health care providers, including the coordination or management of health care by a health care provider with a third party; consultation between health care providers relating to a patient; or the referral of a patient for health care from one health care provider to another.