HIPAA Authorization Form - Idaho

HIPAA AUTHORIZATION FOR USE AND DISCLOSURE OF PROTECTED HEALTH INFORMATION (IDAHO)

(Comprehensive - HIPAA Privacy Rule and Idaho Mental Health / HIV / SUD Overlay)

TABLE OF CONTENTS

1. Document Header
2. Definitions
3. Operative Provisions
4. Idaho Preemption Analysis and Special Categories
5. Required HIPAA Statements (45 C.F.R. § 164.508(c))
6. Revocation and Re-Disclosure
7. Execution Block

1. DOCUMENT HEADER

HIPAA AUTHORIZATION FOR USE AND DISCLOSURE OF PROTECTED HEALTH INFORMATION
Effective Date: [__/__/____]

This HIPAA Authorization ("Authorization") is executed by:

2. DEFINITIONS

"Authorization" - This HIPAA authorization form, including any appendices.

"Covered Entity" or "CE" - The health-care provider, health plan, or health-care clearinghouse identified above and subject to HIPAA (45 C.F.R. § 160.103).

"HIPAA" - The Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, and its implementing regulations at 45 C.F.R. Parts 160 and 164.

"Individual" - The subject of the PHI and signatory hereto (45 C.F.R. § 160.103).

"Mental Health Records" - Certificates, applications, records, and reports made for the purpose of Title 66, Chapter 3, Idaho Code, that directly or indirectly identify a patient, former patient, or individual whose involuntary assessment, detention, or commitment is being sought, as governed by Idaho Code § 66-348.

"PHI" - Protected Health Information as defined at 45 C.F.R. § 160.103.

"Recipient" - The person(s) or entity(ies) authorized to receive the PHI.

"SUD Records" - Substance use disorder records subject to 42 C.F.R. Part 2 and 42 U.S.C. § 290dd-2.

"Use" and "Disclose" - As defined in 45 C.F.R. § 160.103.

3. OPERATIVE PROVISIONS

3.1 Grant of Authorization

a. Authorized PHI - CE is authorized to Use and Disclose the PHI specifically described below:

b. Authorized Recipient(s) - [Recipient Name / Title / Address].

c. Specific Purpose(s) - PHI may be Used or Disclosed solely for: [e.g., continuity of care; legal proceeding Case No. ____; insurance underwriting; or "at the request of the Individual"].

d. Expiration - The earliest of:
(i) [__/__/____];
(ii) completion of the stated purpose; or
(iii) revocation per Section 6.

3.2 Conditions for Treatment and Payment

Per 45 C.F.R. § 164.508(b)(4), CE may not condition treatment, payment, enrollment, or eligibility on the execution of this Authorization, except as expressly permitted (e.g., research-related treatment, eligibility determinations for health plans, or where PHI is created solely for disclosure to a third party).

4. IDAHO PREEMPTION ANALYSIS AND SPECIAL CATEGORIES

4.1 Mental Health Records (Idaho Code § 66-348)

Under Idaho Code § 66-348, mental health hospitalization records may be disclosed only with the consent of the patient, the patient's attorney-in-fact for mental health care, or the patient's legal guardian, or as otherwise permitted by statute or court order.

☐ I AUTHORIZE disclosure of Mental Health Records under Idaho Code § 66-348.
☐ I DO NOT authorize disclosure of Mental Health Records.

Individual Initials: [____]

4.2 Psychotherapy Notes (45 C.F.R. § 164.508(a)(2))

Psychotherapy notes require a separate authorization apart from other PHI.

☐ I AUTHORIZE disclosure of psychotherapy notes.
☐ I DO NOT authorize disclosure of psychotherapy notes.

Individual Initials: [____]

4.3 HIV / AIDS Information (Idaho Code §§ 39-602, 39-610)

Idaho Code § 39-602 designates HIV among diseases subject to mandatory reporting, and Idaho Code § 39-610 governs the use and disclosure of HIV/HBV reporting information by the Department of Health and Welfare. Identifying HIV reporting information is generally protected from disclosure except for specified public-health purposes.

☐ I AUTHORIZE disclosure of HIV/AIDS testing, status, and treatment information.
☐ I DO NOT authorize disclosure of HIV/AIDS information.

Individual Initials: [____]

4.4 Substance Use Disorder Records (42 C.F.R. Part 2 - Federal Floor)

Idaho follows the federal floor for SUD records confidentiality. SUD Records are protected by 42 C.F.R. Part 2 and 42 U.S.C. § 290dd-2. Re-disclosure is generally prohibited absent further consent.

☐ I AUTHORIZE disclosure of SUD Records subject to 42 C.F.R. Part 2.
☐ I DO NOT authorize disclosure of SUD Records.

Individual Initials: [____]

4.5 Hospital Records and Peer Review (Idaho Code § 39-1392b)

I acknowledge that hospital peer review and quality-improvement records are independently privileged under Idaho Code § 39-1392b and that the privilege belongs to the hospital, not the Individual; nothing in this Authorization purports to waive that privilege.

Individual Initials: [____]

4.6 Genetic Information

Genetic information disclosure must be consistent with the Genetic Information Nondiscrimination Act (GINA), 42 U.S.C. § 2000ff et seq.

☐ I AUTHORIZE disclosure of genetic test results and related information.
☐ I DO NOT authorize disclosure of genetic information.

Individual Initials: [____]

5. REQUIRED HIPAA STATEMENTS (45 C.F.R. § 164.508(c))

5.1 Right to Revoke

I understand that I may revoke this Authorization at any time by submitting written notice to CE at the address below, except to the extent CE has already acted in reliance on this Authorization. Written revocations should be delivered to: [HIPAA Privacy Officer Address].

5.2 Re-Disclosure Warning

I understand that information disclosed pursuant to this Authorization may be re-disclosed by the Recipient and may no longer be protected by HIPAA. Information protected by Idaho Code § 66-348 (mental health), Idaho Code §§ 39-602 / 39-610 (HIV reporting), and 42 C.F.R. Part 2 (SUD) remains subject to those laws' independent re-disclosure restrictions even after disclosure.

5.3 No Conditioning

I understand that CE may not condition treatment, payment, enrollment, or eligibility on whether I sign this Authorization, except as permitted under 45 C.F.R. § 164.508(b)(4).

5.4 Compensation

CE will not receive any direct or indirect remuneration for the Use or Disclosure of the PHI authorized herein, except as expressly disclosed and permitted by 45 C.F.R. § 164.508(a)(4).

5.5 Voluntariness

I acknowledge that I am signing this Authorization voluntarily and that I have had an opportunity to ask questions about it.

6. REVOCATION AND RE-DISCLOSURE

6.1 Revocation Procedure

Written revocation must include:

• Individual's name and date of birth;
• A clear statement of revocation;
• Date and signature; and
• Delivery to [Privacy Officer Address] by mail, hand delivery, or secure electronic means.

6.2 Copy

I am entitled to a copy of this signed Authorization. Initials: [____]

7. EXECUTION BLOCK

IN WITNESS WHEREOF, the undersigned have executed this Authorization as of the Effective Date.

Individual / Patient

Signature: ________________________________

Printed Name: ____________________________

Date: [__/__/____]

Personal Representative (if applicable)

If signing on behalf of the Individual, identify legal authority (e.g., parent of minor, attorney-in-fact under durable power of attorney for health care under Idaho Code § 39-4501 et seq., court-appointed guardian under Idaho Code § 15-5-301 et seq., personal representative of estate):

Authority / Relationship: __________________________________

Signature: ________________________________

Printed Name: ____________________________

Date: [__/__/____]

Witness (recommended for mental health disclosures)

Signature: ________________________________

Printed Name: ____________________________

Date: [__/__/____]

Covered Entity Acknowledgment

By: ___________________________ Title: __________________

Printed Name: ____________________________

Date: [__/__/____]

SOURCES AND REFERENCES

• 45 C.F.R. § 164.508 — HIPAA authorization requirements
• Idaho Code § 66-348 — Disclosure of mental health hospitalization records
• Idaho Code § 39-602 — Designation of venereal/reportable diseases including HIV
• Idaho Code § 39-610 — Disclosure of HIV/HBV reporting information
• Idaho Code § 39-1392b — Hospital peer review record confidentiality
• 42 C.F.R. Part 2 — Confidentiality of SUD records
• 42 U.S.C. § 290dd-2 — Federal SUD records confidentiality