HIPAA Authorization
Under HIPAA, Authorization has a very specific definition and is found in the HIPAA Privacy regulation at 45 Code of Federal Regulations 164.508. Authorization is the permission you give your doctor or a hospital to use your confidential medical information for "unusual reasons". Unusual reasons refer to the use and disclosure beyond what is needed for payment for medical services or the sharing of your medical information by your primary care doctor with a specialist.
An authorization is something your health care provider will ask of you and not something you will initiate. An authorization is a simple premise mdash; under an authorization you must grant permission to use your confidential medical information. The HIPAA Privacy regulation outlines the content in all HIPAA authorization forms and you must sign this form, though your different health care providers may have different formats. The most important elements of the authorization form are:
- Your specific medical information that will be used;
- The name of who will be using your medical information;
- A description of the purpose or the use of your medical information;
- The expiration date on the use of your medical information; and
- How you may revoke your permission to use your medical information.
The reasons for authorized use of your medical information are not those uses found in the HIPAA Privacy Notice of Privacy Practices [NPP] that your doctor's office or a hospital service gives you. NPP uses are for the common and traditional uses of your confidential medical information, including sharing with medical specialists and offices, sharing with your health plan, or with public health registries if you have a communicable disease such as the flu.
Your authorized permission is for very unusual reasons, such as marketing, or the sharing of your information in the hand written psychotherapy notes of your mental health provider.
For example, if your hospital wants to market specific services to you they may need to ask your permission to share your medical information with a business that is not a health care entity. You may say 'NO' to this use of your medical information. Plus, you are protected under HIPAA if you say no. Your hospital, doctor, or health plan may not place conditions on your care or services based on your Authorization preferences.
Release of Information Form
It is important to remember that a HIPAA Authorization is not a release of information. A Release of Information is not something you find in any of the HIPAA regulations. It existed long before there were any HIPAA privacy and security regulations.
A Release of Information is a document used for the traditional and common types of releases of confidential medical information to individuals and business that are not usually part of healthcare. Unlike an Authorization Form, a Release of Information is something that you have to ask for from your doctor or hospital. A Release of Information form is most often used when you ask your doctor to send your child's medical information to school for sports teams, or to summer camp. It is also used when you want to move your medical records to a new doctor if you move or are choosing a new doctor or dentist.
HIPAA does not permit Authorizations to be joined with any other type of document so any document that your doctor or hospital presents you with should not be headed AUTHORIZATION / RELEASE Form. You need to ask questions about a form that is not clear so that you are aware what your information is being used for, and who will be using the information prior to signing.
Also, you may be confused by the Release of Information [ROI] department or office you find in a hospital. While it has the same title as the form and does do traditional release of information to schools, camps and specialists, it is also performs additional tasks such as obtaining patient consent, certifying medical records, and deciding what information can be released.
Remember... for any unusual uses of your confidential medical information you must be asked for your specific written permission to use it.