Discover The 6 Requirements Of A Valid HIPAA Release Authorization In Kingston, New York

What is are the six core requirements of a valid HIPAA release authorization?

In order to be accepted by doctors and hospitals, a HIPAA release authorization must have six core requirements. A valid authorization must contain certain required statements:

Requirement #1: A description that identifies the requested information in a “specific and meaningful fashion” (45 C.F.R. section 164.508(c)(1)(i));

Requirement #2: The name or other specific identification of the person or entity authorized to make the requested information (45 C.F.R. section 164.508(c)(1)(ii));

Requirement #3: The name or other specific identification of the persons or entity to which the requested information may be disclosed (45 C.F.R. section 164.508(c)(1)(iii));

Requirement #4: A description of the purpose for which the information is requested (45 C.F.R. 164.508(c)(1)(iv)), i.e., the regulation considers the statement “at the request of the individual” is a sufficient description of the purpose when an individual initiates the authorization and does not, or elects not to, provide a statement of the purpose.

One core requirement of a HIPAA authorization that is often missing from form authorizations is a statement of the purpose for which the information is requested. (45 C.F.R. section 164.508(c)(1)(vi)). Adding a general purpose statement should suffice;

Requirement #5: An expiration date or expiration event that relates to the individual or the purpose for which the information is requested (45 C.F.R. section 164.508(c)(1)(v)); and

Requirement #6: A dated signature of the patient or the patient’s representative with a description of the representative’s authority to act on behalf of the patient. (45 C.F.R. section 164.508(c)(1)(vi)).

In addition to the six core elements, a valid HIPAA authorization must contain certain required statements. 45 C.F.R. section 164.508(c)(2). The language used in the authorization must be adequate to place you on notice of the following: (a) The right to revoke the authorization in writing (45 C.F.R. section 164.508(c)(2)(i)); and (b) The potential for the information to be further disclosed to others without the protection of the HIPAA regulations. It also helps to state on the authorization form that it is compliant with HIPAA.

What you can do to ensure you get a complete set of medical records

It is inevitable that you will get denials of valid requests due to misinformed administrators at hospitals and doctors’ offices and in many cases you will receive an incomplete set of the medical records. The authorization should request that the medical record administrator identify any record withheld with sufficient particularity to support a further effort to secure full disclosure should you believe it is necessary.

The medical records administrator should be asked to warrant under oath that all requested records have been fully disclosed or identified as withheld. This request could be ignored and there are no consequences if it is. But at least you have made your best effort to address this potential problem.

What can you do if the hospital still refuses to honor your HIPAA authorization?

Many medical records administrator (believe it or not) are sorely misinformed about HIPAA and are threatened by new authorization forms that are not on forms generated by the NYS Department of Health. When this happens, you should send a letter by certified mail to the medical records administrator with a specific warning that you intend to file a complaint with the Office of Civil Rights of the U.S. Department of Health and Human Services for its violation of HIPAA.

You might want to add a footnote at the bottom of your letter referencing a multi-million fine levied by the Office of Civil Rights for failing to comply with valid HIPAA authorizations against a hospital in Kentucky. This should get their attention.

Keep in mind that you are not alone. Hospitals and doctors routinely ignore HIPAA (out of ignorance and stupidity most of the time) and they will bank on the fact that you will not know your rights and just give up. Don’t give in to this nonsense! Be proactive in enforcing your rights. Seek a knowledgeable medical malpractice attorney right away.