Image from Pixabay
As a health care provider, your job entails recording and handling personal medical information. You are responsible for keeping this information private and protecting your patients. However, there are situations where sharing a patient’s medical records with another health care provider is necessary. Here is everything you need to know about filling out a HIPAA authorization form.
What Is A HIPAA Authorization Form?
HIPAA stands for Health Insurance Portability and Accountability Act. This act was originally passed in 1996. Among many other things, this act established standards to make electronic health care transactions safer.
The HIPAA Privacy Rule went into effect in 2003 to protect the electronic medical records of patients and their privacy. This rule defines when health care providers can share personal medical information without requesting authorization from patients and defines when patients need to give written consent to have their personal data shared.
Who Is Covered Under The HIPAA Privacy Rule?
Health care providers are legally obligated to observe this rule. It also extends to health plan providers and health care clearinghouses. This category includes entities that process data, such as billing services.
The rule also extends to business associates of the entities listed above. An entity that provides a service such as processing or analyzing data, billing, accounting, or a legal service would have to follow the HIPAA Privacy Rule. It is important to find out which category you fall into and whether or not you have to follow this rule.
What Can You Do Under The HIPAA Privacy Rule?
The purpose of the rule is to protect patients’ privacy while allowing health care professionals to share medical records when it is in the best interest of the patient to do so.
The HIPAA Privacy Rule grants rights to patients. Patients can get a copy of their medical record at any time and ask for corrections to be made if there are errors.
A patient’s medical record can be shared with another entity that is legally required to follow the HIPAA Privacy Rule if the patient signs an authorization form.
Note that the HIPAA Privacy Rule states that medical professionals should share the information that is necessary and withhold the rest of the records. It is important to assess each situation carefully and to determine which information needs to be shared.
In Which Cases Should You Fill Out A HIPAA Authorization Form?
You can obtain a patient’s authorization to share their medical records or parts of their records by having them sign an authorization form in certain situations.
The HIPAA Privacy Rule doesn’t cover health information that can’t be tied to an individual. Data about a condition or a treatment plan can be shared as long as the patient’s name and other personal information have been removed from the record.
It is common for medical professionals to share information about diagnosis and treatments for research or statistical purposes. There is no need to obtain an authorization from the patient to do so, but the data that is shared shouldn’t include a patient’s name, address, age, and other demographic information. However, these records can include information about employment and education.
There are other scenarios in which a medical provider or other entity covered by the HIPAA Privacy Rule can share a patient’s medical records without their written authorization:
- A patient can request and obtain their medical records without filling out a HIPAA authorization form.
- Information can be shared between two providers who are providing a treatment to the same patient.
- A health care provider can release medical records to a health plan provider and other entities as an insurance claim are processed.
- Personal information can be used for certain internal operations, such as assessing quality, administrative tasks, or for evaluating a staff member.
Note that you should only share the information that is necessary for these scenarios. In a lot of cases, there is no need to share a patient’s entire medical history to process an insurance claim, issue a bill, or communicate with another health care provider.
Other Exceptions To The HIPAA Privacy Rule
There are other scenarios in which a patient doesn’t need to fill out a HIPAA authorization form. If there isn’t enough time to fill out a form or if the patient is physically unable to fill out a form, you can obtain verbal consent for sharing personal health information.
You need to explain what information will be shared, who will have access to it, and make sure the patient understands they can object to having their information shared.
If a patient is not conscious, you should do what is in their best interest. Use an ethical approach and only share the information that is needed to provide the best care possible at the moment.
A medical professional will be obligated to release medical records with personal information if they are legally required to do so, for instance, if a court order is issued. Law enforcement can also request information about the victim of a crime, and a practitioner can reach out to law enforcement and release medical records to notify the police of a suspected crime.
It is also possible to release personal medical information if it is in the best interest of public health to do so. This applies to scenarios where sharing medical information could stop a disease from spreading.
There are cases where doctors can release a patient’s personal medical records to their employer. This applies to scenarios where a workers compensation claim is processed, or if the patient is receiving treatment due to a work-related injury and OSHA violation.
Medical professionals can legally share personal medical information with authorities if they suspect abuse, neglect, or domestic violence.
If a patient is deceased, medical professionals can share their personal medical records to help with organ donation, or for sharing information with a funeral home or with the coroner’s office.
How To Fill Out A HIPAA Authorization Form
You can find HIPAA authorization templates online or easily create a form from scratch. If you are a patient, the medical professional who will release your records should provide you with a form.
If you work for a medical practice, hospital, or any other entity, make sure you customize the form with the name of the organization you work for at the top of the form.
Here is a breakdown of the different fields you will find on a HIPAA authorization form.
The first section of the form should include details about how the transfer of information. You need to insert the name of the person or entity who is releasing the records as well as the name of the recipient.
The purpose of the second section is to specify the period covered by the authorization. You will also need to include details regarding the information that is released.
Remember that you should only release the information that is needed at the moment. The patient can check a box to indicate that they authorize their entire medical record to be released.
They can also check a box to indicate that they authorize a portion of their records to be released, and choose which information will be excluded. Section II can indicate that sensitive information such as mental health records, HIV or AIDS status, or drug use treatment will be excluded.
The patient can also check the ‘other’ box and indicate which information will be excluded from the records.
This section describes how the information should be used. There is no need to fill out any fields, but the patient should understand how the recipient is allowed to use the information received.
Indicate when the authorization expires. Once the authorization expires, the recipient of the personal health information will no longer be allowed to use it. Don’t allow entities and people to keep using this data for any longer than they need to.
The purpose of this section is to state that the patient understands they can revoke this authorization in writing at any time. Make sure the patient reads this section and understands their rights.
This section states that the patient is aware they don’t need to fill out and submit the form to become eligible for treatment.
This section explains that the recipient of the medical records might end up using the information in ways that aren’t covered by the HIPAA Privacy Rule. It is important that the patient understands who is covered under the HIPAA Privacy Rule and that some people or entities don’t have to follow these rules.
The patient or their legal representative will need to sign and date the form.
It is important to discuss the form; the patient needs to understand they can refuse to fill out the form and that they can revoke the authorization at any time. They should also be aware of the limitations of the HIPAA Privacy Rule and that the information might end up being shared with other entities not covered under this rule.