Understanding the TPO Exception: Using PHI for Treatment, Payment, and Health Care Operations (45 CFR § 164.506)

HIPAA generally requires patient authorization before disclosing Protected Health Information (PHI), but one of the most important exceptions is known as the TPO exception. Under 45 CFR § 164.506, covered entities may use and disclose PHI for Treatment, Payment, and Health Care Operations without the patient’s written permission. While this flexibility is essential for daily operations, small practices must still understand what each category means, what limits apply, and how to document TPO disclosures properly. This article breaks down the TPO exception with real-world examples, case insights, and tools to avoid common compliance mistakes.

Can you refer a patient to a specialist without asking for written authorization? Can your billing team send records to the insurance provider without violating HIPAA?

Yes, in most cases, thanks to the TPO exception under HIPAA.

But misinterpreting what qualifies as TPO can easily lead to unauthorized disclosures, especially in small practices where staff wear multiple hats and documentation practices vary.

Understanding what’s permitted, and what isn’t, is critical to keeping patient trust and avoiding OCR investigations.

What Is the TPO Exception Under HIPAA?

Under 45 CFR § 164.506, a covered entity may use or disclose PHI without patient authorization if the use is for:

• Treatment: Providing, coordinating, or managing health care

• Payment: Billing, claims management, eligibility checks, or reimbursement

• Health Care Operations: Administrative, financial, legal, and quality improvement activities

These categories are narrowly defined and must be interpreted in context.

Examples of Permitted Uses:

• Submitting insurance claims

• Verifying insurance eligibility

• Coordination of benefits between insurers

• Collection activities or billing audits

Be careful: Disclosing full medical records when only minimal info is required may violate the minimum necessary standard.

What Are “Health Care Operations”?

This is the most misunderstood category. It includes:

• Quality assessment and improvement

• Reviewing provider performance

• Medical record audits

• Credentialing and training activities

• Business management and planning

• Legal, accounting, and compliance reviews

It does not include marketing, fundraising, or disclosures to employers.

Even when a use fits under TPO, it must still meet HIPAA’s minimum necessary rule and other procedural safeguards.

A family medicine clinic recently launched a promotional campaign to introduce a new wellness program aimed at patients with chronic health conditions. The clinic used its internal patient database to send targeted emails that included each recipient’s name, their age group, and the specific chronic condition the program was designed to address.

Unfortunately, the clinic did this without obtaining prior patient authorization or consent for using their protected health information (PHI) for marketing purposes. One patient, upon receiving the email, felt their privacy had been violated and filed a formal complaint with the Office for Civil Rights (OCR).

Key Findings from the OCR Investigation

• Activity did not qualify as Treatment, Payment, or Healthcare Operations (TPO): The emails were promotional in nature, aiming to encourage enrollment in a wellness program rather than to provide or coordinate care.

• The emails were classified as marketing: Because the communication was designed to promote a service, it fell under HIPAA’s marketing regulations, which require explicit patient authorization before PHI can be used.

• No valid authorization was obtained: The clinic failed to secure the necessary written consent from patients allowing the use of their PHI for marketing communications.

Outcome and Consequences

As a result of these violations, the clinic agreed to a $75,000 settlement with OCR. Additionally, the clinic committed to:

• Staff retraining focused on HIPAA privacy and marketing rules

• Revising internal policies and procedures related to PHI disclosures and patient communications

• Implementing safeguards to prevent future unauthorized uses of PHI

Lessons Learned

This case highlights the critical importance of understanding when patient information can be used for promotional activities. Using PHI without clear patient consent, even with the best intentions to improve health, can lead to significant legal and financial consequences.

Healthcare providers must clearly distinguish between communications that qualify as TPO and those considered marketing. When in doubt, always seek explicit patient authorization and document it thoroughly.

Do we have to document every TPO disclosure?

No. HIPAA does not require logging standard TPO uses. However, some practices choose to document them for internal tracking or when state law requires it.

Can we use TPO to share PHI with third-party vendors?

Only if the vendor qualifies as a Business Associate and there’s a valid Business Associate Agreement (BAA) in place. Otherwise, written authorization is required.

Can patients opt out of TPO disclosures?

Not in general. However, under § 164.522(a)(1)(vi), a patient may request restrictions on disclosures to health plans when paying out of pocket in full.

Is fundraising or marketing ever part of TPO?

No. Marketing and fundraising are not considered health care operations. You must obtain a specific HIPAA authorization to use PHI for those purposes.

• 45 CFR § 164.506 – TPO Exception Rule

• HHS FAQ on Treatment, Payment, and Health Care Operations

• Minimum Necessary Standard
  

The Treatment, Payment, and Healthcare Operations (TPO) exception is a cornerstone of HIPAA’s Privacy Rule that allows covered entities to use and disclose protected health information (PHI) without patient authorization for specific purposes. This exception is essential for ensuring that healthcare delivery remains efficient and lawful, allowing providers to coordinate care, handle billing, and manage practice operations without unnecessary administrative burdens.

However, the TPO exception must be understood and applied carefully. Misapplication can lead to inadvertent violations, regulatory fines, and damage to patient trust.

• Know the boundaries between treatment, payment, and operations:
  Treatment includes activities related to patient care coordination and management. Payment involves billing and collection activities. Operations cover a range of administrative, legal, and quality improvement functions. Understanding which activities fall under each category is critical.

• Do not assume that all internal practice activities qualify as healthcare operations:
  Just because an activity occurs within your practice does not automatically mean it is covered by the TPO exception. For example, marketing, fundraising, or non-healthcare-related legal matters require separate patient authorizations.

• Limit disclosures to the minimum necessary:
  Even within TPO, only the minimum amount of PHI needed to accomplish the intended purpose should be disclosed. This helps reduce risk and respects patient privacy.

• Always use Business Associate Agreements (BAAs) for third-party vendors:
  When disclosing PHI to external vendors who perform functions on your behalf (like billing companies or consultants), ensure that valid BAAs are in place to govern their handling of PHI and compliance obligations.

• Train your entire team to identify when TPO does not apply:
  Marketing communications, certain legal uses, and other activities fall outside the TPO exception and require patient consent. Staff should be able to recognize these scenarios to prevent unauthorized disclosures.

Mastering the nuances of the TPO exception allows your practice to maintain smooth operational workflows while protecting patient information. It reduces unnecessary paperwork and consent requests, but still upholds the highest standards of privacy and compliance.

In summary, a well-trained team and clear policies around TPO use not only keep your practice protected from regulatory risks but also foster trust and transparency with your patients.