HIPAA Authorization: What You Need to Know to Protect Your Medical Privacy
Learn about HIPAA Authorization forms, why they matter for your healthcare privacy, and how to use them effectively regardless of your family or financial situation.
Introduction
A HIPAA Authorization is a legal document that gives healthcare providers permission to share your protected health information with specific people or organizations. Unlike the basic HIPAA privacy notices you routinely sign at doctor's offices, a HIPAA Authorization provides you with control over who can access your medical information beyond your direct healthcare providers. Whether you're married with children, single, or have significant assets to protect, understanding how to use HIPAA Authorizations effectively is crucial for maintaining privacy while ensuring your loved ones can help during medical emergencies.
Key Things to Know
- 1
HIPAA Authorizations are revocable at any time—you can change your mind about who has access to your information.
- 2
Without a HIPAA Authorization, healthcare providers may be legally prohibited from sharing your medical information, even with close family members.
- 3
Consider updating your HIPAA Authorization after major life events such as marriage, divorce, or when children reach adulthood.
- 4
Be specific about what information can be shared—you can exclude sensitive information like mental health records or genetic testing if desired.
- 5
Keep copies of your signed HIPAA Authorization with your other important documents and provide copies to your designated representatives.
- 6
A HIPAA Authorization works best when paired with other healthcare documents like an advance directive and healthcare power of attorney.
- 7
Different healthcare systems may have their own HIPAA Authorization forms, so you may need to complete multiple forms for different providers.
Key Decisions
HIPAA Authorization Requirements
Full legal name, date of birth, address, phone number, and other identifying information of the individual whose protected health information will be disclosed.
Include the patient's medical record number or other healthcare identifier if available.
Rhode Island Requirements for HIPAA Authorization
The HIPAA Authorization must be written in plain language and contain specific elements including a description of the information to be disclosed, the person authorized to make the disclosure, the person to whom the disclosure may be made, an expiration date, and a statement of the individual's right to revoke the authorization.
The authorization must include a description of the information to be used or disclosed, the name of the person(s) authorized to make the requested use or disclosure, the name of the person(s) to whom the covered entity may make the disclosure, an expiration date or event, and the signature of the individual and date.
The authorization must include statements about the individual's right to revoke the authorization in writing, the ability or inability to condition treatment on the authorization, and the potential for information to be redisclosed by the recipient and no longer protected by HIPAA.
Rhode Island's state law provides additional protections for health care information and requires specific authorization for the release of confidential health care information.
Rhode Island law defines 'confidential health care information' more broadly than HIPAA in some respects, covering all information relating to a patient's health care history, diagnosis, condition, treatment, or evaluation.
Rhode Island requires that authorizations for disclosure of confidential health care information be in writing and contain specific elements, including the nature of the information to be disclosed, the person making the disclosure, the person to whom disclosure will be made, the purpose of the disclosure, and the signature of the patient.
Under Rhode Island law, authorizations for the disclosure of health information are valid for a maximum of six months from the date of execution, unless otherwise specified in the authorization.
Rhode Island provides heightened protections for mental health information, requiring specific authorization for the release of psychotherapy notes and information related to mental health treatment.
Rhode Island law requires specific written authorization for the disclosure of HIV/AIDS test results and related information, with additional protections beyond standard health information.
Federal regulations provide additional protections for substance use disorder treatment records, requiring specific authorization elements for disclosure of such information.
Rhode Island law provides specific protections for genetic information and requires explicit authorization for the disclosure of genetic test results.
Rhode Island law contains specific provisions regarding the disclosure of health information for minors, particularly for sensitive services that minors can consent to without parental involvement.
HIPAA prohibits the sale of protected health information without specific authorization that states the disclosure will result in remuneration to the covered entity.
HIPAA requires specific authorization for use or disclosure of protected health information for marketing purposes, with the authorization stating if the marketing involves remuneration.
HIPAA generally prohibits combining authorizations with other documents, with certain exceptions, and requires clear delineation when multiple authorizations are combined.
Both HIPAA and Rhode Island law provide patients with the right to revoke an authorization at any time, though actions taken in reliance on the authorization prior to revocation may not be undone.
HIPAA requires that the covered entity must provide a copy of the signed authorization to the individual.
Rhode Island's Uniform Electronic Transactions Act allows for electronic signatures on HIPAA Authorizations, provided they comply with the requirements of the Act.
HIPAA prohibits conditioning treatment, payment, enrollment, or eligibility for benefits on an individual signing an authorization, with limited exceptions.
HIPAA provides individuals with the right to receive an accounting of disclosures of their protected health information made pursuant to an authorization.