A HIPAA authorization form is required when a covered entity or business associate wants to use or disclose a patient’s protected health information (PHI) for purposes unrelated to treatment, payment, or healthcare operations.
Use of authorization forms
The uses of a HIPAA authorization form include:
- Marketing: According to the Department of Human and Health Services (HHS), “the [Privacy] Rule requires an individual’s written authorization before a use or disclosure of his or her protected health information can be made for marketing.” However, if communication involves face-to-face interactions or “a promotional gift of nominal value”, authorization forms are not required.
- Research: When researchers seek to access or use PHI for studies, an authorization form is needed unless an Institutional Review Board (IRB) grants a waiver.
- Sharing with third parties: If PHI is disclosed to a third party for purposes outside the scope of treatment, payment, or operations, such as employment background checks or legal proceedings, a signed authorization is mandatory.
- Psychotherapy notes: The use or disclosure of psychotherapy notes requires specific authorization, except in limited circumstances such as to defend a legal claim by the provider.
Read also: Sharing patient information with authorization
Elements of a HIPAA authorization form
A valid HIPAA authorization must include:
- A description of the information to be disclosed.
- The name of the person or entity authorized to make the disclosure.
- The name of the person or entity receiving the information.
- The purpose of the disclosure.
- An expiration date or event.
- A statement of the individual's right to revoke the authorization.
- A signature and date.
Tips/best practices
When handling HIPAA authorization forms, it is best practice to:
- Provide clear and complete information: Ensure the form includes all necessary details, such as the specific information being disclosed, the purpose, recipient, and expiration date, in a way that's easy for patients to understand.
- Document authorizations: Keep accurate records of all signed forms for audit purposes and secure storage.
- Respect revocations: Act promptly to stop further disclosures if a patient revokes their authorization and document the revocation.
See also: Collect patient data securely with Paubox Forms
FAQs
Does a healthcare provider need to get authorization for sharing PHI with other doctors?
Healthcare providers can share PHI for purposes of treatment without requiring a separate authorization form. This includes sharing information with other healthcare providers involved in a patient’s care. However, for uses outside treatment, such as research or marketing, authorization is needed.
Who is responsible for ensuring that a HIPAA authorization form is obtained?
It is the responsibility of the covered entity to obtain a HIPAA authorization before using or disclosing PHI for purposes not covered under treatment, payment, or healthcare operations.
Tshedimoso Makhene
