HIPAA GENERAL OPERATING POLICY #11
VERIFICATION OF IDENTITY REQUIREMENTS
I. General
Prior to any permitted disclosure, a HCC must:
a. Except with respect to uses and disclosures requiring an opportunity for the individual to agree or object, verify the identity of a person requesting PHI and the authority of the person to have access to PHI, if the identity or authority are not known to the HCC; and
b. Obtain any documentation, statements, or representations, from the person requesting PHI when such documentation, statement or representation is a condition of disclosure.
II. Conditions
If disclosure is conditioned on particular documentation, statements, or representations from the person requesting PHI, a HCC may rely, if such reliance is reasonable, on documentation, statements or representations that on their face meet the applicable requirements.
III. Identity of Public Officials
A HCC may rely, if such reliance is reasonable, on any of the following to verify identity when the disclosure of PHI is to a public official or a person acting on behalf of the public official:
a. If the request is made in person, presentation of an agency badge, credentials or other proof of government status;
b. If the request is in writing, the request is on appropriate government letterhead; or
c. If the disclosure is to a person acting on behalf of the public official, a written statement on appropriate government letterhead that the person is acting under the government’s authority or other evidence or documentation of agency that establishes that the person is acting on behalf of the public official.
IV. Authority of Public Officials
A HCC may rely, if such reliance is reasonable, on any of the following to verify authority when the disclosure of PHI is to a public official or a person acting on behalf of the public official:
a. A written statement of the legal authority under which the information is requested or, if a written statement is impracticable, an oral statement of such legal authority;
b. If a request is made pursuant to legal process, warrant, subpoena, order, or other legal process issued by a grand jury or a judicial or administrative tribunal, is presumed to constitute legal authority.
V. Good Faith
The verification requirements are met if the HCC relies on the exercise of professional judgment in making a use or disclosure in accordance with the requirements for uses and disclosures requiring an opportunity for the individual to agree or object or acts on a good faith belief in making a disclosure in accordance with the requirements for uses and disclosures for which an authorization or opportunity to agree or object is not required.