HIPAA Authorization Form - Indiana

HIPAA AUTHORIZATION FOR USE AND DISCLOSURE OF PROTECTED HEALTH INFORMATION (INDIANA)

(Comprehensive - HIPAA, Indiana Mental Health Records Act, HIV Confidentiality, and Substance Use Disorder Protections)

1. PARTIES AND PURPOSE

Effective Date: [__/__/____]

This HIPAA Authorization ("Authorization") is executed by:

Purpose of Disclosure: [e.g., "continuity of care," "Social Security disability application," "litigation in Marion County Superior Court Cause No. ____," "at the request of the Patient"]

2. INDIANA PREEMPTION ANALYSIS

The following Indiana statutes impose requirements that operate alongside HIPAA and govern the corresponding categories of information disclosed pursuant to this Authorization:

3. SPECIFIC INFORMATION AUTHORIZED FOR DISCLOSURE

3.1 General Medical Records. Provider is authorized to use and disclose the following Protected Health Information ("PHI"):

[Describe categories, dates of service, and providers, e.g., "all medical records from 01/01/2020 through present, including physician notes, laboratory results, diagnostic imaging, discharge summaries, and billing records"]

3.2 Special Categories - Separate Initials Required. Disclosure of the following categories requires separate, specific initials to comply with Indiana law. If a category is NOT initialed, that category is NOT authorized for disclosure:

4. REQUIRED HIPAA ELEMENTS (45 C.F.R. § 164.508(c))

4.1 Specific and Meaningful Description of PHI. As set forth in Section 3 above.

4.2 Name of Person/Class Authorized to Make Disclosure. [Provider Name and its workforce members].

4.3 Name of Person/Class to Whom Disclosure May Be Made. [Recipient Name(s) or Class].

4.4 Description of Each Purpose. As set forth in Section 1 above. If "at the request of the Patient," that statement is sufficient under HIPAA.

4.5 Expiration Date or Event. This Authorization expires on the earliest of:

☐ Calendar date: [__/__/____]
☐ Event/condition: [Describe, e.g., "conclusion of disability proceeding"]
☐ One hundred eighty (180) days from the Effective Date (Indiana default for mental health records under Ind. Code § 16-39-2-5)

4.6 Right to Revoke. Patient may revoke this Authorization in writing at any time by delivering signed notice to:

[Provider Privacy Officer Name, Address]

Revocation is effective upon receipt, except to the extent that Provider has already acted in reliance on the Authorization. Patient acknowledges that this Authorization is subject to revocation at any time, except to the extent that action has been taken in reliance on the consent, as required by Ind. Code § 16-39-2-5.

4.7 Inability to Condition Treatment. Provider may NOT condition treatment, payment, enrollment, or eligibility for benefits on whether Patient signs this Authorization, except as permitted by 45 C.F.R. § 164.508(b)(4).

4.8 Re-Disclosure Warning. Information disclosed pursuant to this Authorization may be subject to re-disclosure by the Recipient and may no longer be protected by federal or Indiana privacy law. However: information protected by Ind. Code § 16-39-2 (mental health), Ind. Code § 16-41-8 (HIV), Ind. Code § 16-41-2-3 (communicable disease), and 42 C.F.R. Part 2 (substance use disorder) may NOT be re-disclosed without further specific written consent of the Patient.

5. INDIANA MENTAL HEALTH RECORDS REQUIREMENTS (IC § 16-39-2-5)

For disclosure of mental health records, this Authorization specifies:

6. RIGHT TO RECEIVE A COPY

Patient is entitled to receive a signed copy of this Authorization. ☐ Copy provided to Patient.

7. SIGNATURES

Patient

Signature: ________________________________________________

Printed Name: ____________________________________________

Date: [__/__/____]

Personal Representative (if applicable)

Signature: ________________________________________________

Printed Name: ____________________________________________

Authority / Relationship: __________________________________

Date: [__/__/____]

Witness (recommended for mental health and HIV disclosures)

Signature: ________________________________________________

Printed Name: ____________________________________________

Date: [__/__/____]

8. SOURCES AND REFERENCES

• 45 C.F.R. § 164.508 (HIPAA authorization requirements)
• 45 C.F.R. § 160.203 (preemption of contrary state law)
• Ind. Code § 16-39-2-5 (written request for release of mental health records)
• Ind. Code § 16-39-2-6 (disclosure without patient's consent; exceptions)
• Ind. Code § 16-41-8 (Communicable Disease: Confidentiality Requirements)
• Ind. Code § 16-41-2-3 (Reporting of HIV and AIDS cases)
• 42 C.F.R. Part 2 (federal substance use disorder confidentiality)
• 42 U.S.C. § 1320d-5 (HIPAA civil penalties)

This Authorization is intended to satisfy HIPAA and applicable Indiana privacy statutes. Counsel should review for fitness to the specific transaction and patient population before use.