HIPAA Authorization Form - District of Columbia

HIPAA AUTHORIZATION FOR USE AND DISCLOSURE OF PROTECTED HEALTH INFORMATION (DISTRICT OF COLUMBIA)

(Comprehensive - HIPAA Privacy Rule and D.C. Mental Health Information Act / HIV / SUD Overlay)

TABLE OF CONTENTS

1. Document Header
2. Definitions
3. Operative Provisions
4. D.C. Preemption Analysis and Special Categories
5. Required HIPAA Statements (45 C.F.R. § 164.508(c))
6. Revocation and Re-Disclosure
7. Execution Block

1. DOCUMENT HEADER

HIPAA AUTHORIZATION FOR USE AND DISCLOSURE OF PROTECTED HEALTH INFORMATION
Effective Date: [__/__/____]

This HIPAA Authorization ("Authorization") is executed by:

2. DEFINITIONS

"Authorization" - This HIPAA authorization form, including any appendices.

"Covered Entity" or "CE" - The health-care provider, health plan, or health-care clearinghouse identified above and subject to HIPAA (45 C.F.R. § 160.103).

"HIPAA" - The Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, and its implementing regulations at 45 C.F.R. Parts 160 and 164.

"Individual" - The subject of the PHI and signatory hereto (45 C.F.R. § 160.103).

"MHIA" - The District of Columbia Mental Health Information Act of 1978, D.C. Code § 7-1201.01 et seq.

"Mental Health Information" - As defined in D.C. Code § 7-1201.01(11), any written or oral information acquired in attending an Individual in a professional capacity that indicates or substantiates that an Individual is, has been, or will be a client.

"PHI" - Protected Health Information as defined at 45 C.F.R. § 160.103, including: [describe categories, dates of service, and providers].

"Recipient" - The person(s) or entity(ies) authorized to receive the PHI.

"SUD Records" - Substance use disorder records subject to 42 C.F.R. Part 2 and 42 U.S.C. § 290dd-2.

"Use" and "Disclose" - As defined in 45 C.F.R. § 160.103.

3. OPERATIVE PROVISIONS

3.1 Grant of Authorization

a. Authorized PHI - CE is authorized to Use and Disclose the PHI specifically described below:

b. Authorized Recipient(s) - [Recipient Name / Title / Address].

c. Specific Purpose(s) - PHI may be Used or Disclosed solely for: [e.g., continuity of care; legal proceeding Case No. ____; insurance underwriting; or "at the request of the Individual"].

d. Expiration - The earliest of:
(i) [__/__/____];
(ii) completion of the stated purpose; or
(iii) revocation per Section 6.

3.2 Conditions for Treatment and Payment

Per 45 C.F.R. § 164.508(b)(4), CE may not condition treatment, payment, enrollment, or eligibility on the execution of this Authorization, except as expressly permitted (e.g., research-related treatment, eligibility determinations for health plans, or where PHI is created solely for disclosure to a third party).

4. D.C. PREEMPTION ANALYSIS AND SPECIAL CATEGORIES

4.1 Mental Health Information (D.C. MHIA - More Stringent Than HIPAA)

The District of Columbia Mental Health Information Act, D.C. Code §§ 7-1201.01 to 7-1208.07, requires a specific, voluntary written authorization before mental health information may be disclosed. Per D.C. Code § 7-1202.02, the authorization must (i) specify the nature of the information to be disclosed; (ii) identify the persons authorized to disclose; (iii) identify to whom disclosure may be made; (iv) state the specific purposes; (v) advise the client of the right to inspect the record; and (vi) state that consent is subject to revocation.

☐ I AUTHORIZE disclosure of Mental Health Information consistent with the MHIA.
☐ I DO NOT authorize disclosure of Mental Health Information.

Individual Initials: [____]

4.2 Psychotherapy Notes (45 C.F.R. § 164.508(a)(2))

Psychotherapy notes require a separate authorization apart from other PHI.

☐ I AUTHORIZE disclosure of psychotherapy notes.
☐ I DO NOT authorize disclosure of psychotherapy notes.

Individual Initials: [____]

4.3 HIV / AIDS Information (D.C. Code § 7-1605)

D.C. Code § 7-1605 prohibits disclosure of identifying HIV/AIDS information except with prior written permission of the person or upon court order.

☐ I AUTHORIZE disclosure of HIV/AIDS testing, status, and treatment information.
☐ I DO NOT authorize disclosure of HIV/AIDS information.

Individual Initials: [____]

4.4 Substance Use Disorder Records (42 C.F.R. Part 2; D.C. Code § 7-3006)

SUD Records are protected by federal law (42 C.F.R. Part 2; 42 U.S.C. § 290dd-2) and by D.C. Code § 7-3006. Re-disclosure is generally prohibited without further consent.

☐ I AUTHORIZE disclosure of SUD Records subject to 42 C.F.R. Part 2.
☐ I DO NOT authorize disclosure of SUD Records.

Individual Initials: [____]

4.5 Genetic Information

Genetic information disclosure must be consistent with the Genetic Information Nondiscrimination Act (GINA), 42 U.S.C. § 2000ff et seq.

☐ I AUTHORIZE disclosure of genetic test results and related information.
☐ I DO NOT authorize disclosure of genetic information.

Individual Initials: [____]

5. REQUIRED HIPAA STATEMENTS (45 C.F.R. § 164.508(c))

5.1 Right to Revoke

I understand that I may revoke this Authorization at any time by submitting written notice to CE at the address below, except to the extent CE has already acted in reliance on this Authorization. Written revocations should be delivered to: [HIPAA Privacy Officer Address].

5.2 Re-Disclosure Warning

I understand that information disclosed pursuant to this Authorization may be re-disclosed by the Recipient and may no longer be protected by HIPAA. However, information protected by the D.C. MHIA, D.C. Code § 7-1605 (HIV), 42 C.F.R. Part 2, or D.C. Code § 7-3006 remains subject to those laws' independent re-disclosure restrictions even after disclosure.

5.3 No Conditioning

I understand that CE may not condition treatment, payment, enrollment, or eligibility on whether I sign this Authorization, except as permitted under 45 C.F.R. § 164.508(b)(4).

5.4 Compensation

CE will not receive any direct or indirect remuneration for the Use or Disclosure of the PHI authorized herein, except as expressly disclosed in this Authorization and permitted by 45 C.F.R. § 164.508(a)(4).

5.5 Voluntariness

I acknowledge that I am signing this Authorization voluntarily and that I have had an opportunity to ask questions about it.

6. REVOCATION AND RE-DISCLOSURE

6.1 Revocation Procedure

Written revocation must include:

• Individual's name and date of birth;
• A clear statement of revocation;
• Date and signature; and
• Delivery to [Privacy Officer Address] by mail, hand delivery, or secure electronic means.

6.2 Copy

I am entitled to a copy of this signed Authorization. Initials: [____]

7. EXECUTION BLOCK

IN WITNESS WHEREOF, the undersigned have executed this Authorization as of the Effective Date.

Individual / Patient

Signature: ________________________________

Printed Name: ____________________________

Date: [__/__/____]

Personal Representative (if applicable)

If signing on behalf of the Individual, identify legal authority (e.g., parent of minor, attorney-in-fact under durable power of attorney for health care, court-appointed guardian, executor of estate):

Authority / Relationship: __________________________________

Signature: ________________________________

Printed Name: ____________________________

Date: [__/__/____]

Witness (recommended for MHIA disclosures)

Signature: ________________________________

Printed Name: ____________________________

Date: [__/__/____]

Covered Entity Acknowledgment

By: ___________________________ Title: __________________

Printed Name: ____________________________

Date: [__/__/____]

SOURCES AND REFERENCES

• 45 C.F.R. § 164.508 — HIPAA authorization requirements
• D.C. Code § 7-1201.01 et seq. — Mental Health Information Act
• D.C. Code § 7-1202.01 — Disclosures by client authorization
• D.C. Code § 7-1202.02 — Form of authorization
• D.C. Code § 7-1605 — Confidentiality of HIV/AIDS records
• D.C. Code § 7-3006 — Substance abuse confidential records
• 42 C.F.R. Part 2 — Confidentiality of SUD records
• 42 U.S.C. § 290dd-2 — Federal SUD records confidentiality