HIPAA Journal’s recent article entitled “What is HIPAA Authorization?” explains that the authorization form must be written in plain language so it can be easily understood. In addition, and as a minimum, the authorization form must have these components:
- Specific and meaningful information, including a description of the information that will be used or disclosed
- The name of the individual authorized to make the requested use or disclosure
- The name of the person or class of persons to whom information will be disclosed
- A description of the purpose of the requested use or disclosure
- A specific time frame for the authorization, including an expiration date; and
- A date and signature from the individual giving the authorization.
Statements must also be included on the HIPAA authorization to notify the individual of the right to revoke the authorization in writing and either:
- exceptions to the right to revoke and a description of how the right to revoke can be exercised; or
- the extent to which the information is included in the organization’s notice of privacy practices.
In addition, the statement included on the HIPAA authorization to notify the individual of the ability or inability to condition treatment, payment, enrollment, or eligibility for benefits on the authorization by stating either:
- that the covered entity may not condition treatment, payment, enrollment, or eligibility for benefits on whether the individual signs the authorization; or
- the consequences of a refusal to sign the authorization when the covered entity is permitted to condition treatment, enrollment in the health plan, or eligibility for benefits on a failure to obtain authorization.
The person giving consent must be provided with a copy of the authorization form for their records.
Reference: HIPAA Journal (Oct. 9, 2021) “What is HIPAA Authorization?”
