HIPPA.com

A patients’ written authorization is required before the use or disclosure of health care information that is not for a "permissible purpose." Generally, this is information received for a purpose that is not treatment, payment or health care operations. For example, a written authorization is needed before a patient’s health information can be included on a list for marketing purposes. Unlike consents, a health care provider cannot refuse treatment if an authorization is not provided or is revoked.