HIPAA Authorization Characteristics
The Health Insurance Portability and Accountability Act (HIPAA) is a federal law that protects the privacy and security of individuals’ medical information. HIPAA requires covered entities, such as health care providers, health plans, and clearinghouses, to obtain authorization from individuals before disclosing their protected health information (PHI) for purposes other than treatment, payment, or health care operations.
A HIPAA authorization must meet certain characteristics in order to be valid. These characteristics are designed to ensure that individuals understand what they are authorizing and that they have a meaningful opportunity to consent to the disclosure of their PHI.
The following are the characteristics of a HIPAA authorization:
- It must be in writing. A HIPAA authorization cannot be oral or implied.
- It must be signed by the individual whose PHI is being authorized. The signature must be in ink or electronic form.
- It must be written in plain language that the individual can understand. The language must be clear and concise, and it should avoid legal jargon.
- It must specify the specific PHI that is being authorized to be disclosed. The authorization should identify the type of PHI, such as medical records, billing information, or genetic information.
- It must specify the purpose for which the PHI is being authorized to be disclosed. The authorization should state the specific purpose for which the PHI is being disclosed, such as for research, marketing, or sale.
- It must specify the recipient of the PHI. The authorization should identify the specific entity or person to whom the PHI is being authorized to be disclosed.
- It must be dated and signed by the individual whose PHI is being authorized. The date of the authorization should be no more than 36 months old.
Here are some questions that you may have about the characteristics of a HIPAA authorization:
- What if I don’t understand the authorization?
If you don’t understand the authorization, you should ask the covered entity to explain it to you. You should also be able to get a copy of the authorization to take home and review.
- What if I don’t want to sign the authorization?
You have the right to refuse to sign a HIPAA authorization. If you do refuse to sign, the covered entity may not be able to disclose your PHI for the purpose specified in the authorization.
- What if I want to revoke my authorization?
You have the right to revoke your authorization at any time. To revoke your authorization, you must notify the covered entity in writing. The covered entity must then stop disclosing your PHI for the purpose specified in the authorization.
HIPAA authorizations are an important part of protecting the privacy of individuals’ medical information. By understanding the characteristics of a HIPAA authorization, you can ensure that you are giving informed consent to the disclosure of your PHI.
