An "authorization" allows for the use and disclosure of PHI for purposes other than Treatment, Payment, and Healthcare Operations (TPO).