HIPAA GENERAL OPERATING POLICY #6
AUTHORIZATIONS
I. For any use or disclosure of PHI that requires an authorization by the individual, only an approved University Authorization Form may be used and no additions, deletions or modifications may be made without the approval of the University of Maine System Privacy Official. If the University's Health Care Component (HCC) seeks an authorization from an individual for use or disclosure of PHI, the HCC must provide the individual with a copy of the signed authorization. If the Authorization is signed by a personal representative, then it must include a description of the representative's authority to act for the individual. An Authorization to disclose may not extend longer than 30 months.
II. Defective Authorizations
An authorization is not valid if it has any of the following defects:
a. The expiration date has passed or the expiration event is known by the HCC to have occurred;
b. The authorization has not been filled out completely with respect to a required element, if applicable;
c. The authorization is known by the HCC to have been revoked;
d. The authorization is a prohibited compound or conditioned authorization;
e. Any material information in the authorization is known by the HCC to be false.
III. Compound Authorizations
An authorization for use or disclosure of PHI may not be combined with any other document to create a compound authorization, except as follows:
a. An authorization for the use or disclosure of PHI for a research study may be combined with any other type of written permission for the same research study, including another authorization for the use or disclosure of PHI for such research or a consent to participate in such research, but both must be signed separately.
b. An authorization for the use or disclosure of psychotherapy notes may only be combined with another authorization for the use or disclosure of psychotherapy notes.
c. An authorization, other than an authorization for the use or disclosure of psychotherapy notes, may be combined with any other such authorization, except where the HCC has conditioned the provision of treatment, payment, enrollment in the health plan, or eligibility for benefits on the provision of one of the authorizations.
IV. Prohibition on Conditioning Authorizations
A HCC may not condition the provision to an individual of treatment, payment, enrollment in the health plan, or eligibility for benefits on the provision of an authorization, except:
a. A covered health care provider may condition the provision for research-related treatment on the provision of an authorization for the use or disclosure of PHI for such research:
b. A health plan may condition enrollment in the health plan or eligibility for benefits on the provision of an authorization requested by the health plan prior to enrollment, if the authorization is sought for the health plan's eligibility or enrollment determinations relating to the individual or for its underwriting or risk rating determinations and the authorization is not for a use or disclosure of psychotherapy notes.
c. A HCC may condition the provision of health care that is solely for the purpose of creating PHI for disclosure to a third party on the provision of an authorization for the disclosure of the PHI to such third party.
V. Revocation of Authorizations
An individual may revoke an authorization at any time, provided that the revocation is in writing, except to the extent that the HCC has taken action in reliance thereon. A revocation of authorization must be retained with the authorization and the individual's health care information.
Revised 9/04/03