Authorization is defined under HIPAA as the granting of rights to access protected health information (defined below) (PHI). Authorization is required by HIPAA for disclosures or uses of PHI other than for treatment and related procedures and operations. Importantly, treatment cannot be conditioned on granting of an authorization. An authorization is a specific, detailed document requesting patient-subject permission for the use of covered PHI.