HIPAA Authorization Form - Massachusetts

HIPAA AUTHORIZATION FOR USE AND DISCLOSURE OF PROTECTED HEALTH INFORMATION (MASSACHUSETTS)

(Comprehensive – HIPAA plus Massachusetts-specific sensitive-record protections)

TABLE OF CONTENTS

1. Document Header and Identification
2. Information to Be Used or Disclosed
3. Purpose, Recipients, and Expiration
4. Massachusetts Sensitive-Category Authorizations
5. Required HIPAA Statements and Rights
6. Re-Disclosure, Compensation, and Conditioning
7. Revocation
8. Representations and Signatures

1. DOCUMENT HEADER AND IDENTIFICATION

Effective Date: [__/__/____]

2. INFORMATION TO BE USED OR DISCLOSED

2.1 General Description. The Covered Entity is authorized to use and disclose the following Protected Health Information ("PHI") concerning the Patient:

☐ Complete medical record
☐ Records limited to dates of service from [__/__/____] to [__/__/____]
☐ Diagnostic and laboratory test results
☐ Diagnostic imaging and radiology reports
☐ Physician progress notes and consultation reports
☐ Discharge summaries and admission histories
☐ Medication and prescription records
☐ Billing, claims, and itemized statements
☐ Immunization records
☐ Other (specify): [_______________________________________]

2.2 Records Excluded From This General Authorization. Unless an additional initialed authorization is provided in Section 4, the following categories of records shall not be disclosed under this Authorization:

a. Psychotherapy notes (45 C.F.R. § 164.508(a)(2));
b. Mental health records governed by M.G.L. c. 123, § 36;
c. HIV antibody/antigen test results, status, or related identifying information governed by M.G.L. c. 111, § 70F;
d. Substance use disorder treatment records governed by 42 C.F.R. Part 2 and M.G.L. c. 111B, § 11; and
e. Genetic test results and genetic information governed by M.G.L. c. 111, § 70G.

3. PURPOSE, RECIPIENTS, AND EXPIRATION

3.1 Authorized Recipient(s):

3.2 Purpose of Use or Disclosure (check all that apply):

☐ Continuity of care / treatment by another provider
☐ Personal use by the Patient ("at the request of the individual")
☐ Insurance underwriting, claims, or coverage determination
☐ Legal proceeding, Case No. [__________], court: [__________]
☐ Workers' compensation or disability claim
☐ Social Security / SSDI / Medicaid eligibility
☐ Research study titled [__________________________]
☐ Other (specify): [_______________________________________]

3.3 Expiration. This Authorization shall expire on the earliest of:
a. [__/__/____];
b. The event: [_____________________________ (e.g., "conclusion of Case No. ____", "end of research study")]; or
c. Written revocation pursuant to Section 7.

If no expiration date or event is entered, this Authorization shall expire one (1) year from the Effective Date.

4. MASSACHUSETTS SENSITIVE-CATEGORY AUTHORIZATIONS

4.1 Mental Health Records — M.G.L. c. 123, § 36.

I specifically authorize disclosure of mental health records, including records of inpatient or outpatient psychiatric treatment, diagnoses, and treatment notes (excluding psychotherapy notes governed by 45 C.F.R. § 164.508(a)(2) unless separately initialed in 4.2). I understand that under M.G.L. c. 123, § 36 these records are private and not open to public inspection.

Patient Initials: [____] Date: [__/__/____]

4.2 Psychotherapy Notes — 45 C.F.R. § 164.508(a)(2).

I specifically authorize disclosure of psychotherapy notes maintained separately from the rest of the medical record.

Patient Initials: [____] Date: [__/__/____]

4.3 HIV Test Results and Status — M.G.L. c. 111, § 70F.

I expressly and specifically authorize the disclosure of any record, test result, or information indicating my HIV antibody or antigen test status, including results of any HIV test, identification of me as a person who has been tested, and any related diagnostic or treatment information. This authorization is provided as a separate written informed consent distinguished from the consent for the release of any other medical information, as required by M.G.L. c. 111, § 70F.

Purpose of HIV-related disclosure (required by § 70F): [_______________________________________]

Patient Initials: [____] Date: [__/__/____]

4.4 Substance Use Disorder Records — 42 C.F.R. Part 2; M.G.L. c. 111B, § 11.

I specifically authorize disclosure of records relating to the diagnosis, treatment, or referral for treatment of any substance use disorder, including alcohol use disorder. I understand that these records are protected by federal law (42 C.F.R. Part 2) and Massachusetts law (M.G.L. c. 111B, § 11) and that the recipient is generally prohibited from making any further disclosure of this information unless permitted by 42 C.F.R. Part 2 or written consent.

Patient Initials: [____] Date: [__/__/____]

4.5 Genetic Information — M.G.L. c. 111, § 70G.

I specifically authorize disclosure of any genetic test results and related genetic information. I understand that under M.G.L. c. 111, § 70G, such information shall not be divulged without informed written consent.

Patient Initials: [____] Date: [__/__/____]

5. REQUIRED HIPAA STATEMENTS AND RIGHTS

5.1 Right to Revoke. I understand that I have the right to revoke this Authorization in writing at any time, except to the extent that the Covered Entity has already taken action in reliance on it. See Section 7 for the revocation procedure.

5.2 Treatment Conditioning. The Covered Entity may not condition treatment, payment, enrollment, or eligibility for benefits on whether I sign this Authorization, except as expressly permitted by 45 C.F.R. § 164.508(b)(4) (e.g., research-related treatment, eligibility determinations, or pre-enrollment underwriting).

5.3 Potential for Re-Disclosure. I understand that information disclosed under this Authorization may be subject to re-disclosure by the recipient and may no longer be protected by HIPAA or Massachusetts law. Federal substance-use records (42 C.F.R. Part 2) and HIV-related information (M.G.L. c. 111, § 70F) retain distinct re-disclosure restrictions even after release.

5.4 Right to Receive a Copy. I am entitled to receive a signed copy of this Authorization.

5.5 Right to Privacy. I retain all rights provided under M.G.L. c. 214, § 1B (right against unreasonable, substantial, or serious interference with privacy) and all applicable federal and state privacy laws.

6. RE-DISCLOSURE, COMPENSATION, AND CONDITIONING

6.1 Prohibition on Sale or Marketing. The Covered Entity shall not sell my PHI and shall not use or disclose it for marketing purposes without a separate authorization meeting the requirements of 45 C.F.R. § 164.508(a)(3)-(4).

6.2 Compensation. No party shall receive remuneration in exchange for the PHI disclosed under this Authorization except as expressly permitted by HIPAA.

6.3 Part 2 Notice (if Section 4.4 is initialed). The recipient is notified that 42 C.F.R. Part 2 prohibits unauthorized re-disclosure of records identifying a patient as having a substance use disorder, and that a general medical authorization is not sufficient for this purpose.

7. REVOCATION

I may revoke this Authorization at any time by delivering signed written notice to the Covered Entity at the address listed in Section 1 or to the HIPAA Privacy Officer. Revocation is effective on receipt, except to the extent the Covered Entity or recipient has already acted in reliance on this Authorization. Revocation does not affect any action taken before receipt of the revocation.

8. REPRESENTATIONS AND SIGNATURES

8.1 Patient Representations. I represent that (a) I am the Patient identified above or the personal representative authorized under Massachusetts and federal law to act on the Patient's behalf, (b) I have read and understand this Authorization, and (c) I am signing it voluntarily.

Patient / Individual

Signature: _________________________________
Printed Name: _____________________________
Date: [__/__/____]

Personal Representative (if applicable)

Signature: _________________________________
Printed Name: _____________________________
Relationship / Legal Authority (e.g., parent of minor, health-care agent under M.G.L. c. 201D, guardian, executor): _____________________________
Date: [__/__/____]

Witness (recommended; required for some agency forms)

Signature: _________________________________
Printed Name: _____________________________
Date: [__/__/____]

SOURCES AND REFERENCES

• 45 C.F.R. § 164.508 – HIPAA Authorization Required Elements
• M.G.L. c. 123, § 36 – Mental Health Records; Confidentiality and Inspection
• M.G.L. c. 111, § 70F – HIV Test; Informed Consent; Disclosure
• M.G.L. c. 111B, § 11 – Alcoholism / Substance Use Treatment Records
• 42 C.F.R. Part 2 – Confidentiality of Substance Use Disorder Patient Records
• M.G.L. c. 111, § 70G – Genetic Information; Prior Written Consent
• M.G.L. c. 214, § 1B – Right to Privacy
• M.G.L. c. 93A, § 2 – Consumer Protection (remedy for § 70F violations)