HIPAA Authorization: What You Need to Know to Protect Your Medical Privacy
Learn about HIPAA Authorization forms, why they matter for your healthcare privacy, and how to use them effectively regardless of your family or financial situation.
Introduction
A HIPAA Authorization is a legal document that gives healthcare providers permission to share your protected health information with specific people or organizations. Unlike the basic HIPAA privacy notices you routinely sign at doctor's offices, a HIPAA Authorization provides you with control over who can access your medical information beyond your direct healthcare providers. Whether you're married with children, single, or have significant assets to protect, understanding how to use HIPAA Authorizations effectively is crucial for maintaining privacy while ensuring your loved ones can help during medical emergencies.
Key Things to Know
- 1
HIPAA Authorizations are revocable at any time—you can change your mind about who has access to your information.
- 2
Without a HIPAA Authorization, healthcare providers may be legally prohibited from sharing your medical information, even with close family members.
- 3
Consider updating your HIPAA Authorization after major life events such as marriage, divorce, or when children reach adulthood.
- 4
Be specific about what information can be shared—you can exclude sensitive information like mental health records or genetic testing if desired.
- 5
Keep copies of your signed HIPAA Authorization with your other important documents and provide copies to your designated representatives.
- 6
A HIPAA Authorization works best when paired with other healthcare documents like an advance directive and healthcare power of attorney.
- 7
Different healthcare systems may have their own HIPAA Authorization forms, so you may need to complete multiple forms for different providers.
Key Decisions
HIPAA Authorization Requirements
Full legal name, date of birth, address, phone number, and other identifying information of the individual whose protected health information will be disclosed.
Include the patient's medical record number or other healthcare identifier if available.
Illinois Requirements for HIPAA Authorization
The HIPAA Authorization must be written in plain language and contain specific elements including a description of the information to be disclosed, the person authorized to make the disclosure, the person to whom the disclosure may be made, an expiration date, and a statement of the individual's right to revoke the authorization.
The authorization must include a description of the information to be used or disclosed, the name of the person(s) authorized to make the requested use or disclosure, the name of the person(s) to whom the covered entity may make the disclosure, an expiration date or event, and the signature of the individual and date.
The authorization must include statements about the individual's right to revoke the authorization in writing, the ability or inability to condition treatment on the authorization, and the potential for information to be redisclosed by the recipient and no longer protected by HIPAA.
For mental health records in Illinois, additional protections apply requiring specific authorization for the release of mental health treatment records, with explicit identification of the information to be disclosed.
Specific written authorization is required for disclosure of HIV/AIDS test results or related information, with the authorization specifically identifying that HIV/AIDS information may be disclosed.
Written authorization is required for disclosure of genetic testing information, with specific mention that genetic information will be released.
Special authorization requirements for substance abuse treatment records, requiring specific consent for these records to be released.
Requirements for protecting personal information, including health information, and notification requirements in case of breaches.
A statement that the covered entity will not receive remuneration from the recipient of the PHI unless specifically authorized by the individual.
If the authorization is for marketing purposes that involve remuneration, a statement that such remuneration is involved must be included.
Separate authorization is required for the use or disclosure of psychotherapy notes, with limited exceptions.
Patients have the right to access and obtain copies of their medical records, and authorizations must respect these rights.
An authorization for use or disclosure of PHI may not be combined with any other document to create a compound authorization, with certain exceptions.
A statement of the individual's right to revoke the authorization in writing, and the exceptions to the right to revoke and a description of how to revoke.
If a covered entity seeks an authorization from an individual, the covered entity must provide the individual with a copy of the signed authorization.
Illinois law provides additional protections for personal health information beyond federal HIPAA requirements, requiring specific authorization language.
Covered entities must make reasonable efforts to limit the information disclosed to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request.
Specific requirements for authorizations related to AIDS/HIV information, including explicit consent for each release of such information.
Provisions related to surrogate decision-makers and their access to protected health information when the patient is unable to provide authorization.
A statement that the covered entity may not condition treatment, payment, enrollment, or eligibility for benefits on whether the individual signs the authorization, with certain exceptions.