Use and Disclosure of Protected Health Information That Require Client’s Authorization

a. Authorizations

i. General Rule: Except as otherwise permitted or required by law, County of Sacramento will obtain a completed and signed

Authorization for release of protected health information from the client,

HIPAA Privacy Rule P&Ps Page 26 of 33 AS-100-03_UseandDisclosure_2013.docx

or the client’s personal representative, before using or disclosing protected health information to or from a third party.

A. The County of Sacramento uses the County of Sacramento HIPAA Forms 2099a, b, c and d for this purpose.

I. Form 2099a, "Authorization to Obtain Health Records":

Used to obtain records when a current treatment relationship is not established, or when a health plan or provider requires an authorization signed by the client, even if for TPO (Treatment, Payment or Operations).

II. Form 2099b, "Authorization to Release PHI":

Used to release records when a current treatment relationship is not established

III. Form 2099c, "Authorization to Release Health Records-Multi Disciplinary Team":

Used to release records to members of a Multi Disciplinary Team (MDT)

IV. Form 2099d, "Authorization to Release PHI, Client Initiated“:

Used when the client is requesting or initiating the release of health records. Example: client asks that their records be sent to their attorney or insurance company. Also: May be used to document verbal authorizations from a client to disclose their health information and/or to disclose information to family or friends.

B. County of Sacramento shall provide a copy of the completed, signed form to the client

C. The original completed and signed form shall be maintained in the HIPAA section of the client’s medical record or case record file.

D. Authorization forms shall be retained for 7 years.

ii. Authorizations can be initiated by either the County or the client.

iii. A signed authorization is required in the following situations:

A. Prior to an individual’s enrollment in a County of Sacramento administered health plan, if necessary for determining eligibility or enrollment;

B. For the use and disclosure of psychotherapy notes (for exception

HIPAA Privacy Rule P&Ps Page 27 of 33 AS-100-03_UseandDisclosure_2013.docx

see section 2. a. of this Policy);

C. For disclosures to an employer for use in employment-related determinations; and

D. For research purposes unrelated to the individual’s treatment.

E. For any purpose in which state or federal law requires a signed authorization

F. For marketing except if the communication is in the form of: face-to-face communication with the individual, or a promotional gift or nominal value provided by the County of Sacramento.

I. If the marketing involves financial remuneration to the County, an authorization is required to state that such remuneration is involved.

G. Sale of protected health information. An authorization is required for any disclosure involving the sale of protected health

information. See section 2. a. iv. of this Policy.

iv. Valid Authorization: County of Sacramento may obtain, use, or disclose confidential information only if the written authorization includes all the required elements of a valid authorization.

A. Uses and disclosures must be consistent with what the individual has authorized on a signed County of Sacramento authorization form.

B. An authorization must be voluntary. County of Sacramento may not require the individual to sign an authorization as a condition of providing treatment services, payment for health care services, enrollment in a health plan, or eligibility for health plan benefits, except:

I. Provisions of health care solely to create protected health information for disclosure to third party (e.g., life insurance physical or fitness of duty), prior to enrollment in a health plan if authorization is for the health plan’s eligibility or enrollment determinations; or if disclosure is needed to determine payment of claim.

C. County of Sacramento will not ask a client to sign an incomplete Authorization form. Authorizations shall be

completed only as needed and may not be partially completed

HIPAA Privacy Rule P&Ps Page 28 of 33 AS-100-03_UseandDisclosure_2013.docx

and signed by the client “just in case” there is a future need.

D. Forms are required to include the following:

I. The client’s name and identifiers in order to ensure the protected health information obtained or disclosed is for the correct individual.

II. The type of protected health information to be obtained or disclosed must be clearly described and must identify the information to be used or disclosed in a meaningful fashion (e.g., discharge summary, laboratory reports, clinical

assessments, the entire medical record).

III. An expiration date or event that relates to the client or the purpose of the use or disclosure. The County of Sacramento requires an expiration of no more than one year from the date the form is signed, and the date must be written on the form.

IV. The name or other specific identification of the person or class of persons authorized to make the requested use or disclosure (e.g., Dr. John Smith, my psychiatrist; the Kaiser health plan).

V. A description of each purpose of the requested use or

disclosure. The information may not be obtained or disclosed for any purpose other than what is indicated on the form.

A) If the client initiates the authorization, it is sufficient if the purpose indicates "at the request of the individual."

VI. The name or other specific identification of the person or class of persons to whom the covered component will obtain or disclose the protected health information.

VII. A statement advising that disclosed pursuant to the

authorization is subject to redisclosure by the recipient and no longer protected by the Privacy Rule.

VIII.The authorization must advise the individual of his right to revoke the authorization in writing and a description of how it may be revoked.

IX. The authorization must advise the individual that the County may not condition treatment, payment and/or enrollment in a health plan or eligibility for benefits on signing of authorization by client.

HIPAA Privacy Rule P&Ps Page 29 of 33 AS-100-03_UseandDisclosure_2013.docx