HIPAA TPO: Treatment, Payment and Health Care Operations

TPO in HIPAA stands for treatment, payment and health care operations: under 45 CFR 164.506, a covered entity may use and disclose protected health information (PHI) for its own TPO without the patient's authorization. The rule reads: "A covered entity may use or disclose protected health information for its own treatment, payment, or health care operations" (eCFR). Marketing is a separate category that generally needs written authorization, and HHS says disclosing PHI to tracking vendors for marketing without one is impermissible (HHS). Curve Compliance strips PHI before data reaches an ad platform and signs a BAA on every plan.

Book a call. Curve Compliance sends your conversions to ad platforms server-side, and Curve's team does the setup. Book a call with Curve.

What TPO means: the three definitions

All three terms are defined in 45 CFR 164.501 (eCFR):

• Treatment. "the provision, coordination, or management of health care and related services by one or more health care providers," including consultations between providers and referrals (eCFR).
• Payment. What a health plan does "to obtain premiums or to determine or fulfill its responsibility for coverage and provision of benefits under the health plan," and what a provider or plan does "to obtain or provide reimbursement for the provision of health care." Examples in the rule include eligibility checks, billing, claims management, collection and utilization review (eCFR).
• Health care operations. "any of the following activities of the covered entity to the extent that the activities are related to covered functions," followed by a closed list (eCFR). HHS describes them as "certain administrative, financial, legal, and quality improvement activities of a covered entity that are necessary to run its business and to support the core functions of treatment and payment" (HHS).

The operations list covers quality assessment, care coordination, reviewing and training professionals, underwriting, legal services and audits, business planning, and business management such as customer service and grievances. HHS stresses that these activities "are limited to the activities listed in the definition" (HHS). A use that is not on the list is not operations just because it helps the business.

TPO examples

Section 164.506(c) covers your own TPO, any provider's treatment, the payment activities of the entity receiving the data, some operations of another covered entity that shares a relationship with the patient, and joint operations in an organized health care arrangement (eCFR). HHS gives these examples, quoted as written:

Category	HHS example	Why it is TPO
Treatment	"A primary care provider may send a copy of an individual's medical record to a specialist who needs the information to treat the individual." (HHS)	Coordinating care between providers
Treatment	"A hospital may send a patient's health care instructions to a nursing home to which the patient is transferred." (HHS)	A transfer of care
Payment	"A health care provider may disclose protected health information about an individual as part of a claim for payment to a health plan." (HHS)	Getting paid for care
Payment of another entity	A physician may send coverage information "to a laboratory who needs the information to bill for services it provided" (HHS)	The receiving entity's billing
Health care operations	"A health plan may use protected health information to provide customer service to its enrollees." (HHS)	Customer service is on the operations list

Two points apply to every row. Consent is optional: HHS says a covered entity "may voluntarily choose, but is not required, to obtain the individual's consent" for TPO, and a consent document cannot stand in for an authorization (HHS). And TPO uses must match your notice: "Any use or disclosure of protected health information for treatment, payment, or health care operations must be consistent with the covered entity's notice of privacy practices" (HHS). See the notice of privacy practices.

What is not TPO: marketing and sale of PHI

Section 164.506(a) excludes the uses that need an authorization under 164.508(a)(2) through (4): psychotherapy notes, marketing and the sale of PHI (eCFR). HHS puts the marketing rule simply: "the Rule requires an individual's written authorization before a use or disclosure of his or her protected health information can be made for marketing" (HHS). A sale of PHI needs an authorization that "must state that the disclosure will result in remuneration to the covered entity" (eCFR). Refill reminders, treatment communications and messages about your own services are carved out of the marketing definition, with limits when a third party pays (eCFR). For the definition, the carve-outs and what a valid authorization must contain, see HIPAA marketing authorization and ad tracking.

TPO and website tracking

Website analytics can sit inside operations. HHS's tracking bulletin says "a regulated entity may engage a technology vendor to perform such analysis as part of the regulated entity's health care operations," and that tracking technology vendors "are business associates if they create, receive, maintain, or transmit PHI on behalf of a regulated entity for a covered function" (HHS). Then a BAA is required: "Regulated entities must ensure that all tracking technology vendors have signed a BAA and that there is an applicable permission prior to a disclosure of PHI" (HHS). See what a business associate agreement is.

Ad targeting is a different purpose. HHS says "disclosures of PHI to tracking technology vendors for marketing purposes, without individuals' HIPAA-compliant authorizations, would constitute impermissible disclosures" (HHS). Listing the pixel in your privacy notice does not change that: "the Privacy Rule does not permit disclosures of PHI to a tracking technology vendor based solely on a regulated entity informing individuals in its privacy policy, notice, or terms and conditions of use that it plans to make such disclosures" (HHS). Curve's BAA Directory lists Meta and Google Ads as not signing one; see which ad platforms sign a BAA.

A federal court vacated one part of the bulletin on June 20, 2024, about IP addresses on unauthenticated pages, and HHS's notice says it "is evaluating its next steps in light of that order" (HHS). The court wrote that the vacatur "is not intended to, and should not be construed as, limiting the legal operability of other guidance" in the bulletin (opinion), and HHS's appeal was dismissed on September 4, 2024 (docket). The passages quoted here remain on the page. For the detail, see the bulletin annotated after AHA v. Becerra, and for what counts as PHI on a page, what counts as PHI on a website.

Minimum necessary still applies to payment and operations

TPO is not a blank check. A covered entity or business associate "must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request" (eCFR). HHS adds that "covered entities are not required to apply the minimum necessary standard to disclosures to or requests by a health care provider for treatment purposes" (HHS). So treatment disclosures are exempt, while payment and operations disclosures, including analytics a vendor runs for you, must be held to the minimum necessary. See the minimum necessary rule for ad tracking.

How Curve Compliance helps

Sending conversions to ad platforms serves advertising, so the safe setup keeps PHI out of what ad platforms receive. Curve Compliance signs a BAA on every plan, replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform.

Each platform receives only a fixed list of fields, events can use neutral names, and contact identifiers are off by default on Meta, Google Ads and TikTok. Event Logs show what Curve sent to each platform and what the platform accepted. Curve is SOC 2 Type II, and Curve's team does the setup, typically live in about a week. Where a use is unclear, talk to your counsel.

Sources, checked October 26, 2026: 45 CFR 164.506; 45 CFR 164.501; 45 CFR 164.502; 45 CFR 164.508; 45 CFR 160.103; HHS, Uses and Disclosures for Treatment, Payment, and Health Care Operations; HHS, Marketing; HHS, Use of Online Tracking Technologies; HHS, Covered Entities and Business Associates; HHS, HIPAA for Professionals; HHS, Model Notices of Privacy Practices; HHS, Security Rule NPRM fact sheet; Federal Register, 2024-30983; AHA v. Becerra opinion; AHA v. Becerra docket.

Frequently Asked Questions

What does TPO stand for in HIPAA?

TPO stands for treatment, payment and health care operations, the three purposes for which 45 CFR 164.506 lets a covered entity use and disclose PHI without the patient's authorization (eCFR).

What is TPO in health insurance?

For a health plan, payment covers collecting premiums and deciding coverage and benefits, and operations include underwriting, enrollment and customer service (45 CFR 164.501). HHS's example: "A health plan may use protected health information to provide customer service to its enrollees" (HHS).

What are the three covered entities under HIPAA?

Health care providers, health plans and health care clearinghouses. Providers count "only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard" (HHS). See what a HIPAA covered entity is.

What entity is not covered under HIPAA?

Any entity that is neither a covered entity nor a business associate. HHS says: "If an entity does not meet the definition of a covered entity or business associate, it does not have to comply with the HIPAA Rules" (HHS; 45 CFR 160.103). See what a business associate is.

What are the 5 basic rules of HIPAA?

HHS does not publish a list of five. Its HIPAA for Professionals page describes the Privacy Rule, the Security Rule, the Enforcement Rule and the Omnibus rule, which finalized the Breach Notification Rule, plus the transaction, code set and identifier standards that CMS enforces (HHS). See the HIPAA rules explained.

Is ad tracking part of health care operations?

Analytics a vendor runs on your behalf can be operations, which makes the vendor a business associate that needs a BAA (HHS). Sending PHI to an ad platform for marketing is not TPO, and HHS says it needs the patient's authorization.

Do I need patient consent to use PHI for TPO?

No. HHS says a covered entity "may voluntarily choose, but is not required, to obtain the individual's consent" for TPO (HHS). Marketing and sale of PHI need a signed authorization instead (eCFR).

What is the new HIPAA rule in 2026?

"As of February 16, 2026," HHS says, covered entities must include information about substance use disorder records in their notice of privacy practices (HHS). HHS published proposed Security Rule changes in the Federal Register on January 6, 2025 (Federal Register), and says "the current Security Rule remains in effect" while it works on them (HHS). See the new HIPAA rule in 2026.

Talk to Curve Compliance

Book a call. See what your site sends to ad platforms today and how Curve Compliance removes PHI before anything is sent to an ad platform, under the BAA it signs on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.