HIPAA Authorization Form - Iowa

HIPAA AUTHORIZATION FOR USE AND DISCLOSURE OF PROTECTED HEALTH INFORMATION (IOWA)

(Compliant with 45 C.F.R. § 164.508 and Iowa State Law Overlays)

1. IOWA PREEMPTION AND CONTROLLING-LAW SUMMARY

HIPAA establishes a federal floor for the confidentiality of Protected Health Information ("PHI"). Iowa law in several areas is more stringent and therefore is not preempted under 45 C.F.R. § 160.203. The following Iowa overlays apply to this Authorization:

2. DOCUMENT HEADER

HIPAA AUTHORIZATION FOR USE AND DISCLOSURE OF PROTECTED HEALTH INFORMATION

Effective Date: [__/__/____]

a. Individual / Patient: [________________________________] ("Individual")
b. Covered Entity: [________________________________] ("CE")
c. Recipient(s): [________________________________] ("Recipient")

3. DEFINITIONS

"Authorization" - This HIPAA authorization form, including all appendices and amendments.

"Covered Entity" or "CE" - The Iowa health-care provider, health plan, or health-care clearinghouse identified above and subject to HIPAA.

"Disclose" / "Disclosure" - The release, transfer, provision of access to, or divulging of PHI outside CE, as used in 45 C.F.R. § 160.103.

"HIPAA" - The Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, and 45 C.F.R. Parts 160 and 164.

"Mental Health Information" - As defined in Iowa Code § 228.1, oral, written, or recorded information indicating the identity of an individual receiving professional services and relating to diagnosis, course, or treatment of mental or emotional condition.

"PHI" - Protected Health Information described in Section 4.1(a) below.

"SUD Records" - Records subject to 42 C.F.R. Part 2 and/or Iowa Code § 125.37.

4. OPERATIVE PROVISIONS (45 C.F.R. § 164.508 CORE ELEMENTS)

4.1 Grant of Authorization.

a. Specific and Meaningful Description of PHI. CE is authorized to Use and Disclose the following PHI: [________________________________].

b. Person(s) Authorized to Disclose. [________________________________].

c. Person(s) Authorized to Receive. Recipient: [________________________________].

d. Specific Purpose(s). PHI may be Used or Disclosed solely for: [________________________________]. If the Individual initiated the Authorization, the purpose may be stated as "at the request of the Individual."

e. Expiration Date or Event. This Authorization expires on the earliest to occur of: (i) [__/__/____]; (ii) completion of the purpose(s) in 4.1(d); or (iii) revocation under Section 5.

4.2 Right to Revoke. Individual may revoke this Authorization in writing at any time by delivering notice to CE at [________________________________]. Revocation is effective upon receipt, except to the extent CE or Recipient has already acted in reliance.

4.3 Re-Disclosure Warning. Information disclosed pursuant to this Authorization may be subject to re-disclosure by Recipient and may no longer be protected by HIPAA or Iowa law. Re-disclosure of substance use disorder records is prohibited without further written authorization under 42 C.F.R. § 2.32.

4.4 Conditioning Prohibition. Except as permitted by 45 C.F.R. § 164.508(b)(4), CE shall not condition treatment, payment, enrollment, or eligibility for benefits on execution of this Authorization.

4.5 Compensation / Remuneration. ☐ The Disclosure authorized herein will result in direct or indirect remuneration to CE from a third party. ☐ It will not.

5. IOWA SPECIAL-CATEGORY CONSENTS

The Individual must separately initial each category below to authorize Disclosure of that category. Categories not initialed are not authorized.

5.1 Mental Health and Psychological Information (Iowa Code ch. 228).
☐ I specifically authorize Disclosure of mental health information as defined in Iowa Code § 228.1, including diagnosis, course, and treatment of any mental or emotional condition.
Initials: [____]

5.2 HIV / AIDS Information (Iowa Code § 141A.9).
☐ I specifically authorize Disclosure of HIV-related test results, diagnoses, and treatment information. I acknowledge that Iowa law requires specific written consent and that a general medical authorization is insufficient.
Initials: [____]

5.3 Substance Use Disorder Records (42 C.F.R. Part 2; Iowa Code § 125.37).
☐ I specifically authorize Disclosure of records of identity, diagnosis, prognosis, or treatment of substance use disorder. I understand Federal law (42 C.F.R. Part 2) and Iowa Code § 125.37 prohibit further re-disclosure without my specific written authorization.
Initials: [____]

5.4 Psychotherapy Notes (45 C.F.R. § 164.508(a)(2)).
☐ I specifically authorize Disclosure of psychotherapy notes. This authorization is separate from any other PHI disclosure.
Initials: [____]

5.5 Genetic Information (GINA).
☐ I specifically authorize Disclosure of genetic test results and family medical history.
Initials: [____]

6. INDIVIDUAL RIGHTS NOTICE

a. Right to Refuse. I understand I do not have to sign this Authorization. My refusal will not affect my ability to receive treatment, except as permitted by 45 C.F.R. § 164.508(b)(4).

b. Right to Copy. I have the right to receive a copy of this signed Authorization.

c. Right to Inspect and Copy PHI. Under 45 C.F.R. § 164.524 and Iowa law, I have the right to inspect and obtain a copy of the PHI Disclosed.

d. Right to Revoke. I may revoke this Authorization at any time pursuant to Section 4.2.

e. Iowa Code § 622.10 Notice. If a legal action has commenced in which my physical or mental condition is at issue, my written consent (as expressed herein or otherwise) is required for release of medical records pursuant to Iowa Code § 622.10.

7. REPRESENTATIONS

7.1 Individual. Individual is of legal age and has full capacity, or is a personal representative duly authorized under Iowa law to execute this Authorization.

7.2 Covered Entity. CE will Use and Disclose PHI only as permitted herein and will maintain HIPAA-required administrative, physical, and technical safeguards (45 C.F.R. §§ 164.308-.312).

7.3 Recipient. Recipient shall maintain confidentiality of PHI consistent with HIPAA, Iowa Code ch. 228, Iowa Code § 141A.9, Iowa Code § 125.37, and 42 C.F.R. Part 2 (as applicable).

8. REMEDIES AND ENFORCEMENT

8.1 Default. Material breach of Sections 4-7, or violation of HIPAA or Iowa confidentiality law, constitutes an Event of Default.

8.2 Remedies. Available remedies include: (a) immediate termination of this Authorization; (b) injunctive relief limited to protecting PHI; (c) statutory damages under HIPAA (42 U.S.C. § 1320d-5) and Iowa law; (d) reasonable attorney fees to the prevailing party where authorized by law.

8.3 Limitation of Liability. Aggregate liability shall not exceed statutory damages and penalties expressly authorized by HIPAA and Iowa law. No Party shall be liable for incidental, consequential, or punitive damages except where statutorily mandated.

9. GENERAL PROVISIONS

9.1 Governing Law. This Authorization shall be governed by HIPAA and, to the extent not preempted, the laws of the State of Iowa.

9.2 Forum. Exclusive jurisdiction and venue shall lie in the state and federal courts located in [____________] County, Iowa.

9.3 Severability. If any provision is held invalid, it shall be reformed to the minimum extent necessary; the remainder shall remain in effect.

9.4 Counterparts; Electronic Signatures. This Authorization may be executed in counterparts, including by electronic signature pursuant to Iowa Code ch. 554D (Uniform Electronic Transactions Act).

9.5 Integration. This Authorization constitutes the entire agreement of the Parties concerning the subject matter.

10. EXECUTION

IN WITNESS WHEREOF, the Parties have executed this Authorization as of the Effective Date.

Individual / Patient

Covered Entity

Recipient (if signature required)

SOURCES AND REFERENCES

• 45 C.F.R. § 164.508 (HIPAA authorization requirements)
• 42 C.F.R. Part 2 (Substance use disorder confidentiality)
• Iowa Code ch. 228 (Disclosure of Mental Health and Psychological Information)
• Iowa Code § 141A.9 (HIV/AIDS confidentiality)
• Iowa Code § 125.37 (SUD treatment records confidentiality)
• Iowa Code § 622.10 (Physician-patient privilege; consent to release medical records)
• Iowa Code ch. 554D (Uniform Electronic Transactions Act)