HIPAA Authorization Form - Kansas

HIPAA AUTHORIZATION FOR USE AND DISCLOSURE OF PROTECTED HEALTH INFORMATION (KANSAS)

(Compliant with 45 C.F.R. § 164.508 and Kansas State Law Overlays)

1. KANSAS PREEMPTION AND CONTROLLING-LAW SUMMARY

HIPAA establishes a federal floor for the confidentiality of Protected Health Information ("PHI"). Kansas law in several areas is more stringent and therefore is not preempted under 45 C.F.R. § 160.203. The following Kansas overlays apply to this Authorization:

2. DOCUMENT HEADER

HIPAA AUTHORIZATION FOR USE AND DISCLOSURE OF PROTECTED HEALTH INFORMATION

Effective Date: [__/__/____]

a. Individual / Patient: [________________________________] ("Individual")
b. Covered Entity: [________________________________] ("CE")
c. Recipient(s): [________________________________] ("Recipient")

3. DEFINITIONS

"Authorization" - This HIPAA authorization form, including all appendices and amendments.

"Covered Entity" or "CE" - The Kansas health-care provider, health plan, or health-care clearinghouse identified above and subject to HIPAA.

"Disclose" / "Disclosure" - The release, transfer, provision of access to, or divulging of PHI outside CE, as used in 45 C.F.R. § 160.103.

"HIPAA" - The Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, and 45 C.F.R. Parts 160 and 164.

"Patient" - A person who consults, is examined, or is interviewed by treatment personnel, as used in K.S.A. § 65-5601.

"PHI" - Protected Health Information described in Section 4.1(a).

"SUD Records" - Records subject to 42 C.F.R. Part 2 and/or K.S.A. § 65-5603.

"Treatment Personnel / Treatment Facility" - As defined in K.S.A. § 65-5601, including community mental health centers, community service providers, and psychiatric hospitals.

4. OPERATIVE PROVISIONS (45 C.F.R. § 164.508 CORE ELEMENTS)

4.1 Grant of Authorization.

a. Specific and Meaningful Description of PHI. CE is authorized to Use and Disclose the following PHI: [________________________________].

b. Person(s) Authorized to Disclose. [________________________________].

c. Person(s) Authorized to Receive. Recipient: [________________________________].

d. Specific Purpose(s). PHI may be Used or Disclosed solely for: [________________________________]. If the Individual initiated the Authorization, the purpose may be stated as "at the request of the Individual."

e. Expiration Date or Event. This Authorization expires on the earliest to occur of: (i) [__/__/____]; (ii) completion of the purpose(s) in 4.1(d); or (iii) revocation under Section 5.

4.2 Right to Revoke. Individual may revoke this Authorization in writing at any time by delivering notice to CE at [________________________________]. Revocation is effective upon receipt, except to the extent CE or Recipient has already acted in reliance.

4.3 Re-Disclosure Warning. Information disclosed pursuant to this Authorization may be subject to re-disclosure by Recipient and may no longer be protected by HIPAA or Kansas law. Re-disclosure of substance use disorder records is prohibited without further written authorization under 42 C.F.R. § 2.32. Unauthorized re-disclosure of HIV/AIDS information may constitute a class C misdemeanor under K.S.A. § 65-6002.

4.4 Conditioning Prohibition. Except as permitted by 45 C.F.R. § 164.508(b)(4), CE shall not condition treatment, payment, enrollment, or eligibility for benefits on execution of this Authorization.

4.5 Compensation / Remuneration. ☐ The Disclosure authorized herein will result in direct or indirect remuneration to CE from a third party. ☐ It will not.

5. KANSAS SPECIAL-CATEGORY CONSENTS

The Individual must separately initial each category below to authorize Disclosure of that category. Categories not initialed are not authorized.

5.1 Mental Health / Treatment Facility Records (K.S.A. § 65-5601 et seq.).
☐ I specifically authorize Disclosure of confidential communications and records relating to my mental, alcohol, drug-dependency, or emotional condition, including records of any treatment facility, treatment personnel, or community mental health center.
Initials: [____]

5.2 HIV / AIDS Information (K.S.A. § 65-6002).
☐ I specifically authorize Disclosure of HIV-related test results, diagnoses, and treatment information. I acknowledge that Kansas law makes unauthorized disclosure of such information a class C misdemeanor and that this authorization is the specific written consent required.
Initials: [____]

5.3 Substance Use Disorder Records (42 C.F.R. Part 2; K.S.A. § 65-5603).
☐ I specifically authorize Disclosure of records of identity, diagnosis, prognosis, or treatment of substance use disorder. I understand 42 C.F.R. Part 2 and K.S.A. § 65-5603 prohibit further re-disclosure without my specific written authorization.
Initials: [____]

5.4 Psychotherapy Notes (45 C.F.R. § 164.508(a)(2)).
☐ I specifically authorize Disclosure of psychotherapy notes. This authorization is separate from any other PHI disclosure.
Initials: [____]

5.5 Genetic Information (GINA).
☐ I specifically authorize Disclosure of genetic test results and family medical history.
Initials: [____]

5.6 Peer Review / Risk Management Records (K.S.A. § 65-4922).
☐ I acknowledge that peer-review and risk-management records held by a Kansas medical care facility remain confidential and privileged under K.S.A. § 65-4922 and are generally not subject to release under a HIPAA authorization. This Authorization does not waive that statutory privilege except to the extent expressly stated here: [________________________________].
Initials: [____]

6. INDIVIDUAL RIGHTS NOTICE

a. Right to Refuse. I do not have to sign this Authorization. My refusal will not affect my ability to receive treatment, except as permitted by 45 C.F.R. § 164.508(b)(4).

b. Right to Copy. I have the right to receive a copy of this signed Authorization.

c. Right to Inspect and Copy PHI. Under 45 C.F.R. § 164.524 and Kansas law, I have the right to inspect and obtain a copy of the PHI Disclosed.

d. Right to Revoke. I may revoke this Authorization at any time pursuant to Section 4.2.

e. Kansas Anti-Discrimination Notice. Under K.S.A. § 65-6002, information regarding AIDS or HIV cases shall not be used in any manner that would lead to discrimination against me in employment, medical care, housing, education, transportation, or other goods or services.

7. REPRESENTATIONS

7.1 Individual. Individual is of legal age and has full capacity, or is a personal representative duly authorized under Kansas law to execute this Authorization.

7.2 Covered Entity. CE will Use and Disclose PHI only as permitted herein and will maintain HIPAA-required administrative, physical, and technical safeguards (45 C.F.R. §§ 164.308-.312).

7.3 Recipient. Recipient shall maintain confidentiality of PHI consistent with HIPAA, K.S.A. §§ 65-5601 et seq., K.S.A. § 65-6002, K.S.A. § 65-5603, K.S.A. § 65-4922, and 42 C.F.R. Part 2 (as applicable).

8. REMEDIES AND ENFORCEMENT

8.1 Default. Material breach of Sections 4-7, or violation of HIPAA or Kansas confidentiality law, constitutes an Event of Default.

8.2 Remedies. Available remedies include: (a) immediate termination of this Authorization; (b) injunctive relief limited to protecting PHI; (c) statutory damages under HIPAA (42 U.S.C. § 1320d-5) and Kansas law; (d) criminal referral under K.S.A. § 65-6002 where applicable; (e) reasonable attorney fees to the prevailing party where authorized by law.

8.3 Limitation of Liability. Aggregate liability shall not exceed statutory damages and penalties expressly authorized by HIPAA and Kansas law. No Party shall be liable for incidental, consequential, or punitive damages except where statutorily mandated.

9. GENERAL PROVISIONS

9.1 Governing Law. This Authorization shall be governed by HIPAA and, to the extent not preempted, the laws of the State of Kansas.

9.2 Forum. Exclusive jurisdiction and venue shall lie in the state and federal courts located in [____________] County, Kansas.

9.3 Severability. If any provision is held invalid, it shall be reformed to the minimum extent necessary; the remainder shall remain in effect.

9.4 Counterparts; Electronic Signatures. This Authorization may be executed in counterparts, including by electronic signature pursuant to the Kansas Uniform Electronic Transactions Act, K.S.A. § 16-1601 et seq.

9.5 Integration. This Authorization constitutes the entire agreement of the Parties concerning the subject matter.

10. EXECUTION

IN WITNESS WHEREOF, the Parties have executed this Authorization as of the Effective Date.

Individual / Patient

Covered Entity

Recipient (if signature required)

SOURCES AND REFERENCES

• 45 C.F.R. § 164.508 (HIPAA authorization requirements)
• 42 C.F.R. Part 2 (Substance use disorder confidentiality)
• K.S.A. §§ 65-5601 to 65-5606 (Mental health treatment records confidentiality)
• K.S.A. § 65-6002 (HIV/AIDS confidentiality and criminal penalty)
• K.S.A. § 65-5603 (Exceptions to mental health / SUD privilege)
• K.S.A. § 65-4922 (Peer review and risk management records)
• K.S.A. § 16-1601 et seq. (Kansas Uniform Electronic Transactions Act)