Authorization to Use or Disclose Health Care Information
Purpose: To provide a procedure for obtaining patient authorization for the use or
disclosure of protected health information (PHI) when required by law.
Policy:
1. In general, patient health care information should be released pursuant to a valid patient
authorization. Examples of when a valid patient authorization is needed include the use or
disclosure of:
 PHI for marketing,1
 Psychotherapy notes,2
 Some research purposes,3
 Legal requests,
 Life insurance requests,
 PHI to others not involved in patient care.
2. An authorization is not required for uses or disclosures of PHI for:
 Treatment,
 Health care operations, and
 When permitted or required by law.4
3. In Washington State, written patient permission is required to use or disclose PHI for
payment purposes. Use the Assignment of Benefits or a similar form for this purpose. 5
4. In general, a valid authorization must be honored as written.6
1
s. 164.508(a)(3): An authorization for the practice/health care facility to even use PHI for marketing purposes is required except if the
communication is in the form of a face-to-face communication with the patient or if the communication is in the form of a promotional gift of
nominal value to the patient.
2
s. 164.501 & 164.508(a)(2): Psychotherapy notes are notes recorded by a mental health professional documenting or analyzing the contents of
conversation during a counseling session—that are separated from the rest of the individual’s medical record. An authorization to use or
disclose psychotherapy notes is required except if used by the originator of the notes for treatment, to a person or persons reasonably able to
prevent or lessen the threat (including the target of the threat), if you believe in good faith that the use or disclosure is necessary to prevent or
lessen a serious and imminent threat to the health or safety of a person or the public; if the notes are to be used in the course of training
students, trainees, or practitioners in mental health; to defend a legal action or any other legal proceeding brought forth by the patient; when
used by a medical examiner or coroner; for health oversight activities of the originator; or when required by law.
3
s. 164.512(i): An authorization is required except if the covered entity can document affirmatively that a valid waiver of the authorization has
been approved by an IRB or a Privacy Committee.
4
s. 164.506, 164.512 & RCW 70.02.050: Authorizations are not required for any treatment purposes. Authorizations are also not required for the
health care operations of the covered entity (e.g., administrative, legal, financial, or actuarial services) or, under certain circumstances, for the
health care operations of another covered entity (e.g., requests for credentialing and quality-improvement purposes). Further, authorizations are
not required when the use or disclosure is permitted or required by law.
5
RCW 70.02.030(6) Do not use an Authorization to Use or Disclose Health Care Information form for this purpose because Washington State
law, not HIPAA, controls written permissions for payment, for which there are no time limits.
6
RCW 70.02.030 and 70.02.090: There are a few rare exceptions. See the policy on Patient Access to Health Information.
Policy effective date:_04/14/03 Revision date(s):_04/08/03__
Primary Responsible Party:
Privacy Officer, Medical Records Clerk, and Admissions Staff
Other Responsible Party:
All staff should have general knowledge and be able to direct questions/concerns appropriately
Procedure:
1. When a request is made to disclose PHI:
a. Determine if an authorization is needed to release the PHI. See Policy Statements 1,
2, and 3 above.
b. Ask the patient or legally authorized representative to complete and sign the
Authorization to Use or Disclose My Health Care Information form. If the authorization
is from an outside entity, see step 2 in this procedure to determine its validity.
i. Generally, a legally authorized representative is one of the following in order of
priority:
1. Legal guardian
2. Durable power of attorney for health care
3. Spouse
4. Children of the patient who are at least eighteen years of age
5. Birth or adoptive parent
6. Adult siblings (all must agree.)
ii. For deceased patients an executor of the estate has priority over other legally
authorized representatives.
c. Ask for verification of the identity and the authority of the individual if warranted (if the
identity or the authority of the individual is not known to the practice/health care
facility).
d. Advise when the request will be processed. Written, valid authorizations must be
honored no later than 15 working days from the date received.7
e. Provide a copy of the completed and signed authorization form to the patient if:
1. The patient requests, or
2. If the practice/health care facility is asking the patient to sign the
authorization.
2. Review the authorization for validity. A copy of a valid authorization is as binding as the
original. The following elements must be present and be honored:
a. A description of the information to be used or disclosed.8
b. The name of the entity authorized to release the information (e.g., the name of the
practice/health care facility).
c. The name (or title) and institutional affiliation (if any) of the recipient(s).
7
RCW 70.02.080: If the practice/health care facility is not able to honor the request for access because the information is in use or unusual
circumstances have delayed the handling of the request, the patient must be informed in writing of the reasons for the delay and the earliest
date, not later than 21 working days after receiving the request, when the information will be available.
8
s. 164.508(b)(3)(ii): (See also footnote 4) A valid authorization for psychotherapy notes must specifically identify that psychotherapy notes are
the subject of disclosure/use and the authorization for psychotherapy notes may not specify any other records to disclose/use. You may utilize
the Authorization to Use or Release Health Care Information form; however, you must not combine the request with any other request for record
use or disclosure. Simply check “other” and indicate “psychotherapy notes” in the section labeled “You may use or disclose the following health
information.”
d. A description of each purpose for the disclosure/use (e.g., patient request, research,
or marketing). The authorization must mention remuneration, if any, for marketing
purposes.
e. One of the following must be specified: an expiration date (a specific date—e.g.,
January 1, 20059) OR 90 days from the date signed OR when the following event
occurs—but not longer than 90 days from the date signed (e.g., “when adoption of our
child is final”).10
f. Signature and date (time is optional but may be beneficial in dealing with revocations
of authorizations). (See 1[b][i] in this procedure for a list of legally authorized
representatives able to sign on behalf of the patient.)
g. A statement regarding the individual’s right to revoke the authorization, the exceptions
to their right to revoke the authorization, and how they may revoke the authorization. 11
h. A statement regarding the ability or inability to condition health care treatment,
payment, enrollment, or eligibility for benefits on the authorization.12
i. A statement that the information may be subject to re-disclosure and may no longer
be protected by federal or state privacy laws.
j. The form must be in plain language.
k. A description of the representative’s authority to act for the individual and/or
relationship to the individual if signed by a representative.
l. The authorization may not be combined with any other document that would create a
compound authorization.13
3. Process the request:14
a. Honor the request as written. Information pertaining to HIV (AIDS virus), STDs,
psychiatric disorders, mental health, or drug and/or alcohol use may not be
disclosed/used unless specified by the patient or legally authorized representative on
the form.
b. The request may not be processed if:
1. All required elements are not present,
2. The authorization has expired,
3. There is knowledge that the authorization has been revoked (see the Revocation of
Authorization to Use or Disclose Information form and policy/procedure),
4. There is knowledge that material information on the authorization is false, or
5. The individual making the request is not authorized.
c. Make copies, redact any PHI not authorized in the disclosure/use request from the
photocopies (e.g., HIV, AIDS virus, and STDs). You may wish to include a copy of the
following language: “We have enclosed all the information we are permitted by law to
disclose to you pursuant to the patient’s or legally authorized representative’s valid
authorization.”
d. Prepare a statement for PHI copy fees.15
RCW 70.02.030(6): “None,” “end of the research study,” or any date range (e.g., 120 days) is not permissible under Washington State law.
RCW 70.02.030(6): Generally, no health care information relating to future care that occurs more than 90 days after signing the authorization
may be disclosed. The exceptions to this are for authorizations given pursuant to an agreement with a treatment or monitoring program or
disciplinary authority or third-party payors.
s. 164.508(c)(1)(v): If using an expiration event, that event must relate to the individual or the purpose of the use or disclosure.
11
If the authorization form does not contain this element, to be valid the entity must include this information in its Notice of Privacy Practices
AND they must refer to their “Notice of Privacy Practices” in their “Authorization to Release Health Care Information” form. See also the
Revocation of Authorization for (practice/health care facility) to Use or Disclose Health Care Information.
12
164.508 (b)(4)(iii): You may condition the provision of health care on the signing of an authorization when the health care is solely for the
purpose of creating PHI for disclosure to a third party (e.g., an Independent Medical Exam, an exam to obtain life insurance) or as a condition of
taking part in a research study.
13
s. 164.508(b)(3)(i): However, an authorization for purposes of a research study may be combined with any other type of written permission for
the same research study (e.g., informed consent to participate in research or research protocols).
14
If there is a concern about honoring an authorization, consult the practice/health care facility’s legal counsel and/or malpractice carrier.
9
10
e. Record on the authorization and the Accounting Log for Protected Health Information
(PHI) Disclosures form [see Documenting of and Accounting for Disclosures of
Protected Health Information (PHI)] the appropriate elements showing that the
request was fulfilled.
Internal References:
Documenting of and Accounting for Disclosures of Protected Health Information (PHI) Policy
Revocation of Authorization for [Practice/Health Care Facility] to Use or Disclose Health Care
Information Policy
Minimum Necessary Requirements for the Use and Disclosure of Protected Health Information
(PHI) Policy
Responding to Requests to Access and/or Copy Protected Health Information (PHI) Policy
External References:
RCW 70.02
RCW 70.02.010(12) and WAC 246.08.400—Reasonable fee
45 CFR Sections 164.506, 164.508, 164.512 and 164.524
15
s. 164.524(c)(4) & RCW 70.02.010(12) & WAC 246.08.400: HIPAA and Washington State law limit the amount that may be charged for
duplication and searching services to a reasonable cost-based fee (which may include a clerical/labor fee). When editing of the record is
required by statute and is done by the provider personally, Washington State law allows the provider to charge the usual and customary charge
for a basic office visit—as a result of the HIPAA Privacy Rule, individuals must agree to these charges in advance. Washington State Dept. of
Health discourages charging a fee in cases of financial hardship. Refusing to provide copies of records for treatment purposes is unethical.