WASHINGTON UNIVERSITY
HIPAA Privacy Policy #5
Procedure #5

Authorization Required for Uses and Disclosures of
Protected Health Information


Statement of Policy

Washington University and its member organizations (collectively, “Washington University” or “WU”) are committed to conducting business in compliance with all applicable laws, regulations, and WU policies. As part of this commitment, WU has adopted this policy to define the circumstances under which written Authorization is required to Use or Disclose an Individual’s Protected Health Information (“PHI”).

Scope of Policy

For Research Authorizations, see policy on Use or Disclosure of Protected Health Information in Research. For Psychotherapy Notes Authorizations, see policy on Use or Disclosure of Psychotherapy Notes. For Fundraising Authorizations, see policy on Use or Disclosure of Protected Health Information in Fundraising. For Media Relations Authorizations, see policy on Use or Disclosure of Protected Health Information in Media Relations.

Policy

1) When an Authorization is Required.

As a general rule, WU must obtain a specific, written Authorization from an Individual before Using or Disclosing the Individual’s PHI for all purposes other than Treatment, Payment or Health Care Operations or Uses and Disclosures required by law.


2) Authorization Requirements.

A valid Authorization must:

a) Be written in plain language and signed and dated by the Individual (or, if signed by the Individual’s representative, it must additionally state that person’s authority or relationship to the Individual);

b) Provide a specific and meaningful description of the PHI to be Used or Disclosed;

c) Identify WU and/or the class of entities or persons authorized to make the Use or Disclosure of the PHI;

d) Identify specifically the person or class of persons who will receive the PHI;

e) Describe each purpose of the Use or Disclosure;

f) Indicate the Authorization’s expiration date or event (can be a specific date or a specific time period or event period);

g) State that the Individual may refuse to sign the Authorization;

h) State that the Individual has the right to revoke the Authorization in writing, including instructions as to how and where the Individual can complete such a revocation and the exceptions to the right to revoke and reference the Notice of Privacy containing instructions on how to revoke;

i) State that WU cannot condition Treatment, Payment, enrollment in the Health Plan, or eligibility for benefits on the Individual agreeing to sign the Authorization; and

j) State that the PHI, once it is Used or Disclosed pursuant to the Authorization, may no longer be protected by the privacy regulations.

See Attachment A for an Authorization Form.

3) Procedural Requirements.

a) WU must document in writing any request for Authorization and retain any signed Authorization for a period of six (6) years from the date that the Authorization was last in effect (the expiration date); and

b) Must provide the Individual with a copy of the signed Authorization.


4) General Rule: Compound Authorizations Prohibited.

Generally, an Authorization cannot be combined into the same form with (i) the Covered Entity’s Notice of Privacy Practices, or (ii) any other form of written legal permission for Use or Disclosure of PHI.

Exception: An Authorization may be combined with another document giving permission to Use or Disclose PHI in the following situations:

a) Use/Disclosure of Psychotherapy Notes for multiple purposes may be combined into a single Authorization related strictly to Psychotherapy Notes. See WU HIPAA Policy on Use or Disclosure of Psychotherapy Notes;

b) An informed consent for research purposes.

5) General Rule: Prohibition on Conditioning Authorizations.

In general, WU is prohibited from conditioning Treatment, Payment or enrollment in a Health Plan or eligibility for benefits upon an Individual signing an Suthorization.

Exceptions:

a) WU may condition research-related Treatment on provision of an Authorization;

b) WU may condition Treatment to an Individual who is to be given Treatment at WU for the sole purpose of providing information to a third party (For example: insurance application pre-screening examinations) on the provision of an Authorization to Disclose the PHI to the third party;

c) A health plan may condition enrollment or eligibility for benefits on the provision of an Authorization if Authorization is for the purpose of determining eligibility for enrollment and is not for a Use or Disclosure of Psychotherapy Notes; or

d) A health plan may condition Payment of a claim for specified benefits on provision of an Authorization if Disclosure is necessary to determine payment of such claim and Authorization is not for Use or Disclosure of Psychotherapy Notes.

6) Revocation of Authorizations.

Individuals may revoke their Authorizations at any time, in writing.

Exceptions:

a) The Authorization was obtained as a condition of the Individual receiving insurance coverage;

b) WU has taken action in reliance upon the Authorization; or

c) The Authorization is necessary for research integrity and/or research reporting purposes.

7) Disclosure of Inpatient and Outpatient Psychiatric Records Pursuant to Authorization.

WU shall only Disclose inpatient and outpatient psychiatric records¹ or Psychotherapy Notes with a specific and valid Authorization or a valid court order.

8) Who May Sign the Authorization.

ADULTS

A competent, adult Individual should always sign the authorization to Use or Disclose his/her PHI. A person is competent if he/she has the general ability to understand the concept of Use or Disclosure of his/her medical information.

a) If the Individual is competent, but unable to sign the Authorization, the person witnessing the form may write in “Patient unable to sign due to _______________. Patient gave verbal permission.” and then witness the form.

b) If the Individual is not conscious, coherent or is not competent for whatever reason, another person must sign the Authorization:

i) INDIVDUALS UNDER COURT-ORDERED GUARDIANSHIP. If the representative has been appointed guardian by the court, the guardian may sign the Authorization on behalf of the Individual.

ii) AUTHORIZATION FROM RELATIVES. In those situations when the Individual is unconscious or unable to give his/her Authorization and does not have a court appointed guardian, WU may rely upon an Individual’s relatives to provide Authorization. Missouri and Illinois law recognize the following order as “next of kin” and this order should be followed whenever possible.

MINORS

a) If the Individual is under 18 and: is not pregnant; does not already have children; is not emancipated from his/her parents; and/or the Treatment at issue is not related to pregnancy, drug abuse, or venereal disease, then the minor’s parents (or other legal guardian or person standing in the place of the parents (i.e., grandparent or adult sibling)) may sign the Authorization on behalf of the minor Individual; or

b) If the Individual is under 18 and: is pregnant; has had a child; is emancipated from his/her parents; and/or the treatment at issue is related to pregnancy, drug abuse, or venereal disease, then the minor may sign the Authorization on behalf of him/herself.

i) Any parent may sign for his minor child in his legal custody;
ii) Any minor who has been lawfully married and any minor parent or legal custodian of a child may sign for himself, his child and any child in his legal custody;
iii) Any minor may sign for himself in case of:

iv) Any adult standing in loco parentis, whether serving formally or not, may sign for his minor charge in case of emergency as defined in section 431.063;
v) Any guardian of the person may sign for his ward;
vi) During the absence of a parent so authorized and empowered, any adult may sign for his minor brother or sister; or
vii) During the absence of a parent so authorized and empowered, any grandparent for his minor grandchild.
vii) “Absence” as used in (vi) and (vii) above shall mean absent at the time when further delay occasioned by an attempt to obtain consent may jeopardize the life, health or limb of the person affected, or may result in disfigurement or impairment of faculties.

c) Individuals Under Court-Ordered Guardianship. If the individual has been appointed a guardian by the court, the guardian may sign the Authorization on behalf of the Individual. The Authorization must state the guardian’s authority or relationship to the Individual.


Creation Date: November 22, 2002
Effective Date: April 14, 2003
Last Revision Date: February 21, 2003

¹ For this policy, inpatient psychiatric records shall mean all records involving an inpatient psychiatric admission (or an admission where the patientwas transferred at some point to an inpatient psychiatric unit). Outpatient psychiatric records shall mean treatment in an outpatient psychiatric program. Neither of these items includes clinic or medical practice psychiatric records. Clinic and medical practice psychiatric records are considered simple progress notes and are not considered Psychotherapy Notes.

ATTACHMENT A

Authorization
For the Use and Disclosure of
Protected Health Information

I authorize the use and/or disclosure of my protected health information as described below:

1. My authorization applies to the information described below. Only this protected health information may be used and/or disclosed pursuant to this authorization: ______________________________
____________________________________________________________________________
_____________________________________________________________________________
_____________________________________________________________________________
_____________________________________________________________________________
2. I authorize the following persons (and or class of persons) to make the authorized use and/or disclosure of the specified protected health information: ___________________________________ _____________________________________________________________________________
_____________________________________________________________________________
3. I authorize the following persons (or class of persons) to receive my protected health information:____________________________________________________________________
_____________________________________________________________________________
_____________________________________________________________________________
4. This authorization expires upon (insert date or event triggering expiration)._____________________________________________________________________________
5. I understand that once my protected health information is used and/or disclosed pursuant to this authorization, it may no longer be protected by the privacy regulations and may be subject to re-disclosure by the recipient(s).
6. I understand that I have a right to revoke this authorization at any time. My revocation must be in writing as described in the Notice of Privacy. I am aware that my revocation is not effective to the extent that I have authorized the use and/or disclosure of my protected health information and such use and/or disclosure has been relied upon by authorized recipients. I also understand that I may not revoke authorized use and/or disclosures obtained in connection with my receipt of insurance coverage.

* * * * *

THE FOLLOWING PARAGRAPHS APPLY IF AUTHORIZTION IS REQUESTED BY WASHINGTON UNIVERSITY FOR ITS OWN USE:

7. I understand that I do not have to sign this authorization and that my refusal to sign will not affect my abilities to obtain treatment from Washington University nor will it affect my eligibility for benefits. (OMIT #7 if the authorization applies to research-related activities, a health plan offering enrollment or eligibility benefits or specialized benefits pre-enrollment, or when Washington University is providing care solely for the purpose of creating PHI for disclosure to a third-party.)
8. My protected health information will be used or disclosed upon request for the following purposes (name and explain each purpose):_____________________________________________________________________ _____________________________________________________________________________
_____________________________________________________________________________
_____________________________________________________________________________
9. I understand that I have a right to inspect and copy my own protected health information to be used or disclosed in accordance with the Notice of Privacy.
10. I understand that Washington University will receive compensation for its use and/or disclosure of my protected health information. (OMIT #10 if not applicable).

* * * * *

INCLUDE FOLLOWING PARAGRAPHS (IN ADDITION TO PARAGRAPHS 1-6 ABOVE) IF AUTHORIZATION IS REQUESTED BY WASHINGTON UNIVERSITY FOR THE PURPOSES OF TREATMENT, PAYMENT OR HEALTH CARE OPERATIONS:

7. I understand that I do not have to sign this authorization and that my refusal to sign will not affect my abilities to obtain treatment from Washington University, nor will it affect my eligibility for benefits. (OMIT #7 if the authorization applies to a health plan offering eligibility for specialized benefits).
8. My protected health information will be used or disclosed upon request for the following purposes (name and explain each purpose):_____________________________________________________________________ _____________________________________________________________________________
_____________________________________________________________________________
_____________________________________________________________________________

I certify that I have received a copy of the authorization.


_____________________________      ______________________
Signature                                                     Date

______________________________
Name

________________________            _____________________________________               
Name of Personal Representative          Relationship to Individual