An authorization to disclose Protected Health Information is frequently required from the patient in many circumstances. No authorization is needed if PHI is used for treatment, payment or healthcare operation purposes. It is also not required when another law requires the use or disclosure. It is important for all covered entities and business associates to know the exceptions.
Authorization to Disclose PHI Required
There are many circumstances when an authorization to disclose PHI is required. This should be obtained directly from the patient or their personal representative.
Disclosure to an attorney’s office, and to a life or disability insurance company is an example of when an authorization is needed.
An Authorization must be obtained to disclose medical records in certain circumstances. First, one is not required when a patient consents to participate in a research project. Secondly, it is not required when they request a transfer of medical records to another medical providers office.
Authorization Not Required
When there is a court order signed by a judge from a court with jurisdiction there is no need for an authorization to disclose Protected Health Information. A report of an infectious disease required by state law also does not require authorization. No authorization is required if PHI is disclosed for research if an IRB (Institutional Review Board) grants a waiver of authorization.
Requirements Permitting Use of Protected Health Information
The HIPAA compliant authorization permitting use of protected health information must contain certain elements. It is important to not forget to look at state law requirements. There are many states with laws that are more protective of PHI than the Federal HIPAA Rules. Organizations will require additional elements added to the authorization. It is necessary for the covered entity and/or business associate to determine which is most restrictive.
This is your HIPAA ABCs brought to you by HIPAA Associates. Contact us for more information on this important topic. Follow us on Facebook and Twitter.