HIPAA PRIVACY RULE
Health Insurance Portability and Accountability Act
SAMPLE AUTHORIZATION FORM
Prior to the August 14, 2002 modification, a consent form was required for use or disclosure of protected health information for TREATMENT, PAYMENT OR HEALTH CARE OPERATION (“TPO”) purposes. The August 14, 2002 modification removed the Consent requirement for TPO purposes; see definitions of “treatment”, “payment” and “health care operations” at §164.501. Although the HIPAA Privacy Rule no longer requires a signed CONSENT to use and disclose protected health information for TPO purposes, a covered entity may use a CONSENT at its option.The identification of the person(s) or class of persons to whom the covered entity is authorized to make the use or disclosure.
An AUTHORIZATION is required for uses or disclosures other than for TPO purposes and for uses or disclosures other than permitted or required by the HIPAA Privacy Rule.A description of the information to be used or disclosed.
The authorization must be retained for at least six years from the date of its creation, or the date when it was last in effect, whichever is later.
A valid Authorization is required to have the following core elements:
(1) A description of the information to be used or disclosed.
(2) The identification of the person(s) or class of persons authorized to make the use or disclosure of the protected health information.
(3) The identification of the person(s) or class of persons to whom the covered entity is authorized to make the use or disclosure.
(4) A description of each purpose of the use or disclosure.
(5) An expiration date or event.
(6) The individual’s signature and date.
(7) If signed by a personal representative a description of his or her authority to act for the individual.
In addition to the core elements, the authorization must include the following statements:
(1) A statement that the individual may revoke the authorization in writing, and either a statement regarding the right to revoke, and instructions on how to exercise such right or, to the extent this information is included in the entity’s notice, a reference to the notice.
An exception to the general rule that the individual may revoke the authorization at any time in writing is where the covered entity has acted in reliance on the authorization.
(2) A statement that treatment (or if applicable: payment, enrollment, or eligibility for benefits) may not be conditioned on obtaining the authorization. In the exceptions where conditioning is permitted, a statement must be made regarding the consequences of refusing to sign the authorization.
With few exceptions, a health care professional may not condition the provision of treatment on the provision of an authorization. The exceptions are:
- A health care professional may condition the provision of research related treatment on provision of an authorization for the use or disclosure of protected health information for such research.
- A health care professional may condition the provision of health care that is solely for the purpose of creating protected health information for disclosure to a third party on provision of an authorization for the disclosure of the protected health information to such third party.
(3) A statement about the potential for the protected health information to be redisclosed by the recipient and no longer be protected by the federal privacy regulations.
A covered entity is permitted to include additional non-required elements so long as they are not inconsistent with the required elements.
SPECIAL RULE FOR PSYCHOTHERAPY NOTES
Although as a general rule an AUTHORIZATION is not required for use or disclosures for TPO purposes, in the case of psychotherapy notes a covered entity may not use or disclose psychotherapy notes for TPO without obtaining the individual’s authorization. The definition of psychotherapy notes at §164.501 is as follows:
Psychotherapy notes means notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual’s medical record. Psychotherapy notes excludes monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: Diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date.
However, covered entities may use and disclose psychotherapy notes without obtaining individual authorization to carry out its own limited treatment, payment, or health care operations as follows:
(1) Use by the originator of the psychotherapy notes for treatment;
(2) Use or disclosure for the covered entity’s own training programs for its mental health professionals, students and trainees; and
(3) Use or disclosure by the covered entity to defend itself in a legal action or other proceeding brought by the individual.
Other instances where psychotherapy notes may be used or disclosed without the individual’s authorization:
- §164.502(a)(2)(ii) When required by Secretary of HHS to investigate or determine the covered entity’s compliance with the privacy regulations.
- 164.512(a) Uses and disclosures required by law
- 164.512(d) Uses and disclosures with respect to health oversight activities authorized by law.
- 164.512(g)(1) Disclosures to coroners and medical examiners for purpose of identifying a deceased person, determining a cause of death, or other duties authorized by law.
- 164.512(j)(1)(i) Uses or disclosure (A) as necessary to prevent or lessen a serious imminent threat to the health or safety of a person or the public; and (B) is to a person reasonably able to prevent or lessen the threat, including the target of the threat.
OTHER FEDERAL LAWS
The Federal Confidentiality of Alcohol and Drug Abuse Patient Records statutes, 42 U.S.C. 290dd-3 and 42 U.S.C. 290ee-3, and implementing regulations at 42 CFR Part 2 establish confidentiality requirements for patient records that are maintained in connection with the performance of any “federally-assisted” specialized alcohol or drug abuse program. Alcohol or substance programs generally include programs that provide alcohol or drug abuse treatment, diagnosis or referral for treatment. The term “federally assisted” is broadly defined and includes federally conducted or funded programs, federally licensed or certified programs, and programs that are federal tax exempt.
There are some health care professionals who are subject to both the HIPAA rules and the Federal Alcohol and Drug Abuse Patient Records regulations. The Federal Alcohol and Drug Abuse Patient Records regulations require a specific form of written consent, that is somewhat different than the Authorization required under the HIPAA Privacy Rule. If a program is covered by both the HIPAA Privacy Rule and the Confidentiality of Alcohol and Drug Abuse Patient Records regulations, the program may use notice and authorization forms that include all the elements required by both regulations.
HIV and HIV Related Information, Article 27-F of the Public Health Law, 10 N.Y.C.R.R. Part 63 New York State statute and regulations enumerate the circumstances where confidential HIV related information may be disclosed. Among them, confidential HIV related information may be released to any person to whom disclosure is authorized pursuant to a release of confidential HIV related information that has been developed or approved by the New York State Department of Health. A copy of the NYSDOH developed “Authorization for Release of Confidential HIV Related Information” form is available on the NYSDOH website or NYSDOH regulations at 10 N.Y.C.R.R. §63.11.
SAMPLE AUTHORIZATION FORM