HIPAA Authorization Form - Alabama

ALABAMA AUTHORIZATION FOR USE OR DISCLOSURE OF PROTECTED HEALTH INFORMATION

Complete every applicable blank. An incomplete authorization, an expired authorization, or an authorization known to have been revoked may not be valid under 45 C.F.R. § 164.508.

1. Individual Whose Information Will Be Used or Disclosed

Full legal name: [________________________________]

Date of birth: [__/__/____]

Address: [________________________________]

Telephone or email: [________________________________]

Medical-record or account number, if used: [________________________________]

2. Person or Entity Authorized to Make the Use or Disclosure

I authorize the following person, provider, health plan, facility, or class of persons to use or disclose the information described below:

Name or specific class: [________________________________]

Address: [________________________________]

Telephone / fax / secure-delivery details: [________________________________]

3. Person or Entity Authorized to Receive the Information

The information may be disclosed to:

Name or specific class: [________________________________]

Address: [________________________________]

Telephone / fax / secure-delivery details: [________________________________]

4. Information Covered by This Authorization

Describe the information in a specific and meaningful way. Identify the record types, date range, providers, and any limits.

Records or information: [____________________________________________________________]

Date range: From [__/__/____] through [__/__/____]

Express exclusions or limits: [____________________________________________________________]

Alabama STI and HIV-Related Information

Alabama law makes medical records concerning sexually transmitted infections confidential and permits release of an individual's STI medical records on the patient's written consent. Alabama law separately requires confidentiality of HIV-related test results. Check one:

☐ Include STI records and HIV-related test results that fall within the specific description and date range above.

☐ Exclude STI records and HIV-related test results.

If neither box is checked, STI records and HIV-related test results are excluded from this authorization.

Records Requiring a Specialized Authorization or Consent

• This ordinary authorization does not authorize use or disclosure of psychotherapy notes. Use an authorization that covers only psychotherapy notes, or is combined only with another psychotherapy-notes authorization, as required by 45 C.F.R. § 164.508(b)(3)(ii).
• This form does not by itself establish compliance with 42 C.F.R. Part 2. If substance-use-disorder patient records or SUD counseling notes are involved, use a Part 2-compliant consent or addendum that satisfies 42 C.F.R. § 2.31.

5. Purpose of the Use or Disclosure

Describe each purpose. If the individual initiated the authorization and does not wish to state another purpose, "at the request of the individual" is sufficient under 45 C.F.R. § 164.508(c)(1)(iv).

Purpose: [____________________________________________________________]

6. Expiration

This authorization expires on the following date or upon the following event related to me or to the purpose of the authorization. Complete one:

☐ Expiration date: [__/__/____]

☐ Expiration event: [____________________________________________________________]

Revocation is addressed separately below and is not the expiration date or event.

7. Required Notices and Acknowledgments

7.1 Right to Revoke

I may revoke this authorization at any time by submitting a written revocation to:

Privacy office / contact: [________________________________]

Address or approved delivery method: [___________________________________________________]

My revocation will not affect action already taken in reliance on this authorization. If this authorization was obtained as a condition of insurance coverage, other law may allow the insurer to contest a claim or the policy.

7.2 Treatment, Payment, Enrollment, or Benefits

The person or entity seeking this authorization must check the applicable statement:

☐ Signing is not a condition of treatment, payment, enrollment in a health plan, or eligibility for benefits.

☐ Signing is permitted to be a condition because the authorization is for one of the limited circumstances allowed by 45 C.F.R. § 164.508(b)(4). The consequence of refusing to sign is: [________________________________]

7.3 Potential Redisclosure

I understand that information disclosed under this authorization may be redisclosed by the recipient and may no longer be protected by the HIPAA Privacy Rule.

7.4 Marketing or Sale of PHI

Check the applicable statement:

☐ The use or disclosure is not for marketing involving financial remuneration and is not a sale of PHI.

☐ The authorization is for marketing involving financial remuneration to the covered entity from a third party, and I understand that remuneration is involved.

☐ The disclosure is a sale of PHI, and I understand that the disclosure will result in remuneration to the covered entity.

8. Signature

I have read and understand this authorization. I authorize the use or disclosure described above.

Signature of individual: ____________________________________

Printed name: [________________________________]

Date signed: [__/__/____]

If Signed by a Personal Representative

Representative's signature: ____________________________________

Printed name: [________________________________]

Authority to act for the individual: [_____________________________________________________]

Date signed: [__/__/____]

9. Covered Entity Administrative Use

☐ All required fields were reviewed for completeness.

☐ The signer or representative's authority was verified under applicable policy and law.

☐ If the covered entity sought this authorization, a copy of the signed authorization was provided to the individual.

Date received: [__/__/____]

Received by: [________________________________]

Revocation received, if any: [__/__/____]

Retain the signed authorization as required by 45 C.F.R. §§ 164.508(b)(6) and 164.530(j). The HIPAA documentation-retention period is six years from creation or the date the document was last in effect, whichever is later.

Sources and References

• 45 C.F.R. § 164.508 — Uses and disclosures for which an authorization is required
• 45 C.F.R. § 164.530 — Administrative requirements
• 42 C.F.R. § 2.31 — Consent requirements
• Ala. Code § 22-11A-22 — Confidentiality and written consent for STI medical records
• Ala. Code § 22-11A-54 — Confidentiality of HIV-related test results