Compliance & Legal
Treatment, Payment, and Health Care Operations (TPO)
The core purposes for which PHI can be used without separate patient authorization.
Treatment, Payment, and Health Care Operations (TPO) are the three core purposes for which the HIPAA Privacy Rule permits a covered entity to use and disclose protected health information (PHI) without obtaining a separate patient authorization.
Treatment covers providing care; payment covers billing and reimbursement; operations covers activities such as quality improvement, audits, and administration. Uses outside TPO generally require patient authorization. For what counts as PHI in the first place, see the 18 HIPAA identifiers.