It is prudent to get an individual authorization. The mere fact that an individual receives services from a mental health provider does disclose PHI about the person. You do not need a Business Associate Agreement because you do not have a business relationship and the authorization covers the disclosure.
