Patient authorization is not necessary if a disclosure is made for purposes of treatment, securing payment, or in accordance with the operations of a health care provider. If PHI is to be disclosed for other purposes, the patient's written authorization is mandatory.