Authorization for Release of Protected Health Information (HIPAA)
I, [Patient: full name], born [Patient: date of birth], of [Patient: address], telephone [Patient: phone] (the “Patient”), authorise the use and disclosure of my protected health information as described in this Authorization. This Authorization is made under the Standards for Privacy of Individually Identifiable Health Information at 45 CFR Parts 160 and 164 (the “Privacy Rule”), issued under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), and under the laws of the State of [Governing law (state)], and is intended to satisfy the requirements of 45 CFR §164.508.
1. Who May Disclose
I authorise [Provider or plan releasing the information], of [Provider: address], and its workforce, medical staff, business associates and records custodians (the “Provider”) to use and disclose my protected health information as described below. If the Provider has transferred my records to another custodian, that custodian is also authorised.
2. Who May Receive
The Provider may disclose the information to [Person or organisation receiving the information], my [Recipient: relationship to patient], of [Recipient: address], telephone [Recipient: phone] (the “Recipient”), and to the Recipient’s staff and advisers acting on the Recipient’s behalf in the purpose stated in Section 4. The Provider may disclose by any reasonable means, including in person, by telephone, by mail, by fax, by secure email or through a patient portal, and may confirm the Recipient’s identity before doing so.
3. Information Covered
3.1 Scope. The information covered by this Authorization is: [Information to be released]. Description of the records: [Description of records (or “All”)]. Date range: from [Records from (date)] to [Records to (date)]. The information includes, within that scope, my medical history, diagnoses, treatment and progress notes, test results, imaging, medication lists, immunisations, discharge summaries, correspondence and billing and insurance records.
3.2 Specially protected information. Federal and state law give extra protection to certain categories, which are released only if marked “Included” here: mental health treatment records: [Mental health records]; substance use disorder treatment records from a program covered by 42 CFR Part 2: [Substance use disorder treatment records]; HIV/AIDS test results and sexually transmitted infection information: [HIV/AIDS and sexually transmitted infection information]; genetic testing information: [Genetic testing information]. If any of these is included, I specifically consent to its disclosure, and I understand that the Provider may require a separate form under state law or 42 CFR Part 2.
3.3 Psychotherapy notes. Psychotherapy notes, as defined in 45 CFR §164.501, are: [Psychotherapy notes]. I understand that an authorization for psychotherapy notes may not be combined with an authorization for any other information; if I have chosen to include them, this Authorization covers psychotherapy notes only, and I will sign a separate authorization for other records.
4. Purpose
The purpose of this use and disclosure is: [Purpose of the disclosure]. Where the disclosure is made at my request, the Privacy Rule allows me to state “at the request of the individual” as the purpose, and I do so to the extent no other purpose is stated.
5. Expiration
This Authorization expires: [This authorization expires]. Expiration date: [Expiration date (or “None”)]. Expiration event: [Expiration event (or “None”)]. If I have chosen expiry on revocation, this Authorization remains in effect until the Provider receives my written revocation. Unless earlier revoked, an authorization for research may continue for the duration of the research. I understand that state law may limit the period for certain categories of information and that the Provider may ask me to renew it.
6. Right to Revoke
I may revoke this Authorization at any time by delivering a signed, dated written revocation to the Provider’s privacy officer or medical records department. Revocation takes effect when the Provider receives it. It does not apply to information the Provider has already used or disclosed in reliance on this Authorization, and, if this Authorization was obtained as a condition of obtaining insurance coverage, other law may give the insurer the right to contest a claim under the policy or the policy itself.
7. Conditions
I understand that the Provider may not condition my treatment, payment, enrolment in a health plan or eligibility for benefits on whether I sign this Authorization, except that a provider may condition research-related treatment on an authorization for that research, and a health plan may condition enrolment or eligibility on an authorization made before enrolment for underwriting or risk-rating purposes. I sign this Authorization voluntarily.
8. Redisclosure
I understand that once my information is disclosed to the Recipient under this Authorization, it may be redisclosed by the Recipient and may no longer be protected by the Privacy Rule, unless the Recipient is itself a covered entity or business associate required to protect it. Records protected by 42 CFR Part 2, if included, may not be redisclosed by the Recipient except as that Part permits, and this notice accompanies those records. I accept the risk of redisclosure in choosing the Recipient and the scope of information.
9. Payment for Disclosure
Whether the Provider will receive direct or indirect remuneration from the Recipient or a third party in exchange for this disclosure: [Will the provider receive payment from the recipient for this disclosure?]. The Provider may charge me or the Recipient a reasonable, cost-based fee for copies as the Privacy Rule and state law permit, which is not remuneration for this purpose.
10. Copy of This Authorization
I am entitled to a copy of this Authorization after I sign it, and I have received or will receive one. A photocopy, scan, fax or electronically signed copy of this Authorization is as valid as the original.
11. Personal Representative
If this Authorization is signed by a personal representative on my behalf, the representative’s name and the authority under which they sign (for example, parent of a minor, court-appointed guardian, agent under a health care power of attorney, or executor of an estate) is: [If signed by a personal representative: name and authority (or “Not applicable”)]. The Provider may ask to see the document that establishes that authority before releasing information.
12. Governing Law; Signature
This Authorization is governed by the Privacy Rule and, to the extent they are more protective, the laws of the State of [Governing law (state)]. If any provision is held invalid, the remaining provisions shall be given full effect. This Authorization may be signed electronically under the federal Electronic Signatures in Global and National Commerce Act, and the electronic execution record, timestamps and document fingerprints kept by the signing platform are evidence of execution. I sign this Authorization on the date shown in the execution record, having read and understood it.
Signatures
Patient (or personal representative)