HIPAA Authorization Form - Colorado

AUTHORIZATION TO USE OR DISCLOSE HEALTH INFORMATION

HIPAA and Colorado Records Request Companion

Read the instructions and complete every applicable field. A blank required
element can make an authorization defective under 45 C.F.R. § 164.508.

1. Individual Whose Information Is Requested

Do not place a Social Security number in this form unless the disclosing
organization requires it and supplies a secure process.

2. Person or Organization Authorized to Disclose

I authorize the following person, organization, or class of persons to use or
disclose the information described in Section 4:

Name or specific identification: [________________________________]

Address or location: [________________________________]

Department, provider, or class, if applicable: [________________________]

☐ One discloser only

☐ The specifically identified class above

“All providers” is not used unless the intended class is sufficiently specific
for the disclosing organizations to identify themselves.

3. Person or Organization Authorized to Receive

The information may be disclosed to:

If disclosure to more than one recipient is intended, list every recipient or
a sufficiently specific class and state whether each receives the same records.

4. Health Information Authorized

Describe the information in a specific and meaningful way.

Date or event range

From [DATE / EVENT] through [DATE / EVENT]

Selected records

☐ Entire designated record set for the period above, subject to exclusions
identified below

☐ Office or progress notes

☐ History and physical examinations

☐ Consultation reports

☐ Laboratory results

☐ Imaging reports

☐ Images or radiographic studies: [FORMAT / SPECIFIC STUDY]

☐ Operative or procedure reports

☐ Discharge summaries

☐ Medication list or prescription history

☐ Billing and payment records

☐ Immunization records

☐ Other specifically described information: [________________________]

Excluded information

[IDENTIFY RECORDS, DATES, PROVIDERS, OR SUBJECTS THAT MUST NOT BE DISCLOSED]

Do not use this ordinary form for psychotherapy notes. Under 45 C.F.R.
§ 164.508(a)(2) and (b)(3)(ii), psychotherapy notes generally require an
authorization and that authorization may be combined only with another
authorization for psychotherapy notes.

If the requested material may include substance-use-disorder records governed
by 42 C.F.R. Part 2, minor-consented care, sexually transmitted infection
records, genetic information, or another specially protected category, the
disclosing organization must determine whether this form is sufficient or a
separate consent, authorization, notice, or legal process is required.

5. Purpose

The purpose of this use or disclosure is:

☐ At my request

☐ Continuing care with [RECIPIENT]

☐ Insurance or benefit matter described as [________________________]

☐ Legal matter described as [________________________]

☐ Other: [SPECIFIC PURPOSE]

The statement “at my request” is selected only when that is the actual purpose.

6. Expiration Date or Event

This authorization expires on:

☐ [MM/DD/YYYY]

☐ Completion of the following event related to the individual or purpose:
[CLEARLY DESCRIBED EVENT]

An expiration date or event must be completed. Revocation is a separate right
under Section 8 and is not used as the form's only expiration event.

7. Required Understandings

7.1 Potential redisclosure

I understand that information disclosed under this authorization may be
redisclosed by the recipient and may no longer be protected by the HIPAA
Privacy Rule. Another law may still protect the information.

7.2 Conditioning

Select the statement that the disclosing covered entity has verified:

☐ The covered entity will not condition treatment, payment, enrollment in a
health plan, or eligibility for benefits on whether I sign this authorization.

☐ The covered entity may condition [RESEARCH-RELATED TREATMENT / PRE-
ENROLLMENT HEALTH-PLAN DETERMINATION / HEALTH CARE SOLELY TO CREATE PHI FOR A
THIRD-PARTY DISCLOSURE] on this authorization as permitted by 45 C.F.R.
§ 164.508(b)(4). The consequences of refusing are:
[________________________________]

Do not select the second statement without privacy-office or counsel approval.

7.3 Marketing or sale involving remuneration

☐ No marketing or sale of protected health information involving remuneration
is intended

☐ Marketing involving financial remuneration to the covered entity is
intended, and the required statement is: [________________________]

☐ Disclosure that is a sale of protected health information is intended, and
the required remuneration statement is: [________________________]

An authorization for marketing or sale must satisfy the additional statements
in 45 C.F.R. § 164.508(a)(3)-(4). Delete this subsection only after confirming
neither applies.

8. Right to Revoke

I may revoke this authorization at any time by a written revocation delivered
to:

Privacy office or designated person: [________________________________]

Address, email, portal, or other approved delivery route:
[________________________________]

The revocation will not affect action already taken in reliance on this
authorization. If this authorization was obtained as a condition of insurance
coverage, other law may preserve an insurer's right to contest a claim or the
policy. The covered entity's notice of privacy practices or written procedure
provides any additional revocation instructions: [LOCATION / REFERENCE].

9. Signature

By signing, I authorize the use or disclosure described above. I have had an
opportunity to read this form, and the completed form is written in plain
language to the extent practicable.

Individual

Signature: ______________________________________

Printed name: [________________________________]

Date: [__/__/____]

Personal representative, if applicable

Signature: ______________________________________

Printed name: [________________________________]

Date: [__/__/____]

Description of authority to act for the individual:
[PARENT / GUARDIAN / HEALTH-CARE AGENT / PERSONAL REPRESENTATIVE / OTHER,
INCLUDING LIMITS AND SUPPORTING DOCUMENT]

Supporting authority reviewed by: [NAME / ROLE / DATE]

A relationship label alone does not establish authority. The covered entity
must review the representative route and any exception under applicable law.

10. Covered-Entity Processing Record

This section documents processing; it is not an additional recipient contract.

Under C.R.S. §§ 25-1-801 and 25-1-802, a third person may request covered
Colorado facility or individual-provider records using a HIPAA-compliant
authorization, a valid subpoena, or a court order, with the statute's fee and
format rules. This authorization does not itself prove that every requested
item exists, belongs to the statutory patient record, must be produced without
review, or is subject to the same rule.

11. Defect and Special-Route Checklist

Return or escalate the form if:

☐ the individual, discloser, recipient, information, purpose, expiration, or
signature is blank or not specific enough

☐ the expiration date passed or event occurred

☐ the authorization is known to have been revoked

☐ material information is known to be false

☐ the form improperly combines an authorization with another document

☐ psychotherapy notes are included without the separate permitted form

☐ conditioning is inconsistent with 45 C.F.R. § 164.508(b)(4)

☐ a marketing or sale remuneration statement is missing

☐ the signer lacks verified authority or the authority excludes these records

☐ another confidentiality law requires a different or additional route

Individual's Copy

☐ A copy of the signed, completed authorization was provided to the individual
on [DATE] by [METHOD].

This authorization is complete only when every required field is filled and
the disclosing organization accepts it for the specific records and purpose.