HIPAA Authorization Form - Kentucky
HIPAA AUTHORIZATION FOR USE AND DISCLOSURE OF PROTECTED HEALTH INFORMATION (KENTUCKY)
(Comprehensive - HIPAA plus Kentucky-Specific Confidentiality Statutes)
1. PARTY IDENTIFICATION
| Party | Identifying Information |
|---|---|
| Individual / Patient | [Full Legal Name] |
| Date of Birth | [MM/DD/YYYY] |
| Address | [Street, City, KY, ZIP] |
| Covered Entity (Discloser) | [Health-Care Provider / Plan / Clearinghouse Legal Name] |
| Covered Entity Address | [Street, City, KY, ZIP] |
| Authorized Recipient(s) | [Name(s) and Address(es) of Recipient(s)] |
| Effective Date | [MM/DD/YYYY] |
2. PURPOSE OF DISCLOSURE
PHI may be Used or Disclosed solely for the following purpose(s) (45 C.F.R. Section 164.508(c)(1)(iv)):
☐ Continuity of care / treatment by another provider
☐ Insurance underwriting, claims, or coverage determination
☐ Legal proceeding (Case No.: [_____________________])
☐ Disability, Social Security, or veterans benefits application
☐ Workers' compensation claim
☐ Personal records or family reference
☐ Research study titled: [_____________________]
☐ "At the request of the Individual" (if Individual declines to specify a purpose, this option satisfies 45 C.F.R. Section 164.508(c)(1)(iv))
☐ Other: [_____________________]
3. DESCRIPTION OF PROTECTED HEALTH INFORMATION TO BE DISCLOSED
A specific and meaningful description of the PHI to be disclosed (45 C.F.R. Section 164.508(c)(1)(i)):
| Record Category | Date Range | Disclose? |
|---|---|---|
| Office / progress notes | [MM/DD/YYYY] - [MM/DD/YYYY] | ☐ Yes ☐ No |
| Hospital / inpatient records | [MM/DD/YYYY] - [MM/DD/YYYY] | ☐ Yes ☐ No |
| Laboratory results | [MM/DD/YYYY] - [MM/DD/YYYY] | ☐ Yes ☐ No |
| Diagnostic imaging (films and reports) | [MM/DD/YYYY] - [MM/DD/YYYY] | ☐ Yes ☐ No |
| Discharge summaries | [MM/DD/YYYY] - [MM/DD/YYYY] | ☐ Yes ☐ No |
| Billing / itemized statements | [MM/DD/YYYY] - [MM/DD/YYYY] | ☐ Yes ☐ No |
| Prescription / medication history | [MM/DD/YYYY] - [MM/DD/YYYY] | ☐ Yes ☐ No |
| Entire medical record | All dates available | ☐ Yes ☐ No |
4. SPECIAL CATEGORIES - SEPARATE KENTUCKY AUTHORIZATION REQUIRED
I specifically authorize disclosure of the following sensitive categories. If a category is NOT initialed, those records SHALL NOT be released, even if otherwise responsive to this Authorization:
| Sensitive Category | Governing Authority | Initial to Authorize |
|---|---|---|
| Mental health treatment records (diagnosis, evaluations, treatment plans) | KRS 210.235; KRS 304.17A-555 | [____] |
| Psychotherapy notes (as defined at 45 C.F.R. Section 164.501) - a SEPARATE authorization is required under 45 C.F.R. Section 164.508(a)(2) | 45 C.F.R. Section 164.508(a)(2) | [____] |
| HIV / AIDS test results, diagnosis, or treatment | KRS 214.420; KRS 214.625 | [____] |
| Sexually transmitted disease (STD) records | KRS 214.420 | [____] |
| Substance use disorder / chemical dependency records (federally protected) | 42 C.F.R. Part 2; KRS 304.17A-555 | [____] |
| Genetic test results | GINA, 42 U.S.C. Section 2000ff et seq. | [____] |
5. KENTUCKY PREEMPTION ANALYSIS
Under 45 C.F.R. Section 160.203, HIPAA does not preempt state laws that are more stringent. The following Kentucky statutes provide greater privacy protection and control where applicable:
a. Mental Health Records (KRS 210.235). Records identifying a patient seeking hospitalization in a state or regional mental health facility are confidential and may not be disclosed except pursuant to the statute's enumerated exceptions or a specific written authorization.
b. HIV / STD Records (KRS 214.420 and KRS 214.625). HIV test results are confidential, may be used only for diagnostic or treatment purposes, and may not be disclosed except pursuant to a written release or to authorized researchers. A written statement noting confidentiality must accompany any disclosure.
c. Insurer Access to Mental Health / Chemical Dependency Records (KRS 304.17A-555). Insurers' access to mental health and chemical dependency records is limited to information necessary to determine coverage, medical necessity, appropriateness, and quality of care.
d. Substance Use Disorder Records (42 C.F.R. Part 2). Federal law independently restricts disclosure of records from federally assisted substance use disorder programs and requires specific consent elements; a Part 2-compliant consent must accompany any such disclosure.
e. Patient Right to Records (KRS 422.317). Upon written request, a Kentucky hospital or health care provider shall provide one copy of the patient's medical record without charge.
6. AUTHORIZED RECIPIENTS
PHI may be released only to the following specifically identified Recipient(s) (45 C.F.R. Section 164.508(c)(1)(iii)):
| Recipient Name | Title / Role | Address | Purpose |
|---|---|---|---|
| [Name] | [Title] | [Address] | [Purpose] |
| [Name] | [Title] | [Address] | [Purpose] |
7. EXPIRATION
This Authorization shall expire on the earliest to occur of (45 C.F.R. Section 164.508(c)(1)(v)):
☐ Specific date: [MM/DD/YYYY]
☐ Specific event: [e.g., "conclusion of Case No. ____" or "completion of underwriting decision"]
☐ One (1) year from the Effective Date, if no other expiration is selected
☐ None - applicable to research study identified in Section 2 (HIPAA permits "end of the research study" or "none" only for research authorizations)
8. RIGHT TO REVOKE
The Individual may revoke this Authorization at any time by delivering a signed, written notice of revocation to:
HIPAA Privacy Officer
[Covered Entity Name]
[Street Address]
[City, KY, ZIP]
Fax: [_____________________] Email: [_____________________]
Revocation is effective upon receipt, except to the extent that the Covered Entity has already taken action in reliance on this Authorization (45 C.F.R. Section 164.508(b)(5)). Revocation does not affect disclosures already made.
9. REQUIRED HIPAA NOTICES (45 C.F.R. Section 164.508(c)(2))
a. Treatment / Payment Conditioning. The Covered Entity may not condition treatment, payment, enrollment, or eligibility for benefits on the Individual's signing this Authorization, except where permitted by 45 C.F.R. Section 164.508(b)(4) (research-related treatment, eligibility-determination health plans, and PHI created solely for disclosure to a third party).
b. Re-Disclosure. Information disclosed under this Authorization may be re-disclosed by the Recipient and may no longer be protected by HIPAA. Kentucky law, however, may continue to restrict re-disclosure of HIV/STD information (KRS 214.420), mental health records (KRS 210.235), and substance use disorder records (42 C.F.R. Part 2 - which independently prohibits unauthorized re-disclosure and requires a written prohibition-on-redisclosure notice).
c. Right to a Copy. The Individual is entitled to a signed copy of this Authorization (45 C.F.R. Section 164.508(c)(4)).
d. Right of Access. Independent of this Authorization, the Individual retains the right of access to inspect and obtain a copy of PHI in the designated record set under 45 C.F.R. Section 164.524 and KRS 422.317.
10. COMPENSATION AND MARKETING
a. Sale of PHI Prohibited. The Covered Entity shall not receive remuneration for the disclosure of PHI under this Authorization in violation of 45 C.F.R. Section 164.508(a)(4).
b. Marketing. This Authorization does not authorize use or disclosure of PHI for marketing purposes (as defined at 45 C.F.R. Section 164.501) unless separately and explicitly initialed: [____].
11. EXECUTION
IN WITNESS WHEREOF, the undersigned, having read and understood this Authorization, executes it knowingly and voluntarily as of the Effective Date.
Individual / Patient
| Field | Entry |
|---|---|
| Signature | _________________________________ |
| Printed Name | [_____________________] |
| Date | [MM/DD/YYYY] |
If Signed by Personal Representative
| Field | Entry |
|---|---|
| Signature | _________________________________ |
| Printed Name | [_____________________] |
| Relationship / Authority (parent, guardian, attorney-in-fact under KRS 311.621-643, executor, etc.) | [_____________________] |
| Documentation Attached (POA, letters, court order) | ☐ Yes ☐ No |
| Date | [MM/DD/YYYY] |
Witness (Optional - Recommended for Sensitive Categories)
| Field | Entry |
|---|---|
| Signature | _________________________________ |
| Printed Name | [_____________________] |
| Date | [MM/DD/YYYY] |
SOURCES AND REFERENCES
- 45 C.F.R. Section 164.508 (HIPAA Privacy Rule - Authorizations)
- 45 C.F.R. Section 160.203 (HIPAA preemption standard)
- 42 C.F.R. Part 2 (Substance Use Disorder records)
- KRS Chapter 210 - State and Regional Mental Health Programs
- KRS Chapter 214 - Diseases (HIV/STD confidentiality)
- KRS 304.17A-555 - Patient privacy in mental health and chemical dependency
- KRS 422.317 - Patient access to medical records
About This Template
These templates cover the everyday paperwork that happens between patients, providers, and health plans: consent forms, medical record authorizations, directives for end-of-life care, and requests to approve or deny treatment. Getting them right matters because they document medical decisions, release sensitive health information, and often have to meet both federal privacy rules and state-specific requirements. A form that is missing a required disclosure can be rejected by a provider or challenged later in court.
Important Notice
This template is provided for informational purposes. It is not legal advice. We recommend having an attorney review any legal document before signing, especially for high-value or complex matters.
Last updated: May 2026