HIPAA Authorization Form - Maryland

HIPAA AUTHORIZATION FOR USE AND DISCLOSURE OF PROTECTED HEALTH INFORMATION (MARYLAND)

(HIPAA and Maryland Confidentiality of Medical Records Act Compliant)

1. DOCUMENT HEADER

HIPAA AUTHORIZATION FOR USE AND DISCLOSURE OF PROTECTED HEALTH INFORMATION

Effective Date: [__/__/____]

This HIPAA Authorization ("Authorization") is made by and between:

a. Individual/Patient: [Full Legal Name] ("Individual" or "Patient");
b. Covered Entity / Health Care Provider: [Legal Name] ("Covered Entity" or "CE"); and
c. Recipient(s): [Name(s) or Specific Identification of Recipient(s)] ("Recipient").

2. INDIVIDUAL AND PARTY INFORMATION

Patient:

Disclosing Party (Covered Entity / Health Care Provider):

Receiving Party (Recipient):

3. DESCRIPTION OF INFORMATION TO BE DISCLOSED

I authorize the Covered Entity to use and disclose the Protected Health Information ("PHI") described below. The description is specific and meaningful as required by 45 C.F.R. § 164.508(c)(1)(i) and Md. Code Ann., Health-Gen. § 4-303.

Categories of records (check all that apply):

• ☐ All medical records
• ☐ Office/progress/visit notes (specify dates: [__/__/____] to [__/__/____])
• ☐ Hospital/discharge records
• ☐ Emergency department records
• ☐ Laboratory test results
• ☐ Diagnostic imaging and radiology reports
• ☐ Prescription/medication history
• ☐ Billing and itemized statements
• ☐ Immunization records
• ☐ Other: [________________________________]

Date range of records: [__/__/____] through [__/__/____]

4. SPECIAL CATEGORIES OF INFORMATION (MARYLAND-PROTECTED)

I specifically authorize disclosure of the following protected categories. I must initial each line to authorize disclosure of that category. Failure to initial means that category is NOT authorized for disclosure.

5. PURPOSE OF DISCLOSURE

The purpose of this disclosure is (check or specify; 45 C.F.R. § 164.508(c)(1)(iv) and Md. Code Ann., Health-Gen. § 4-303 require a specific purpose):

• ☐ At the request of the Individual (no further description required)
• ☐ Continuity of care / transfer to new provider
• ☐ Legal proceedings (Case No.: [____________])
• ☐ Insurance claim or benefits determination
• ☐ Disability determination (SSA, ERISA, private)
• ☐ Personal review by Patient
• ☐ Employment-related evaluation
• ☐ Research study: [____________________]
• ☐ Other (specify): [________________________________]

6. EXPIRATION

This Authorization shall expire upon the earliest of:

• ☐ Date certain: [__/__/____]
• ☐ Event: [_________________________] (e.g., "conclusion of Case No. ____" or "end of treatment")
• ☐ One (1) year from the date signed below (default if no other selection)

7. RIGHT TO REVOKE

Pursuant to 45 C.F.R. § 164.508(c)(2)(i) and Md. Code Ann., Health-Gen. § 4-303(b), I understand:

a. I may revoke this Authorization at any time by delivering written notice to the Covered Entity at the Privacy Officer address listed in Section 2.
b. Revocation takes effect on receipt by the Covered Entity, EXCEPT to the extent the Covered Entity or Recipient has already taken action in reliance on this Authorization prior to receipt of the revocation.
c. Revocation will not affect disclosures already made.

8. RE-DISCLOSURE WARNING

I understand that:

a. Once PHI is disclosed under this Authorization, the Recipient may re-disclose it, and the information may no longer be protected by HIPAA or Maryland law unless the Recipient is also a covered entity or subject to Maryland's Confidentiality of Medical Records Act.
b. Substance Use Disorder Records (42 C.F.R. Part 2; Md. Code Ann., Health-Gen. § 4-307(k)): Federal and Maryland law prohibit re-disclosure of these records without specific written consent. A general authorization is NOT sufficient.
c. HIV/AIDS Records (Md. Code Ann., Health-Gen. §§ 18-336, 18-337): Subject to additional Maryland disclosure restrictions; re-disclosure restricted.
d. Mental Health Records (Md. Code Ann., Health-Gen. § 4-307): Subject to special protections, including limits on Recipient re-disclosure.
e. Genetic Information (Md. Code Ann., Health-Gen. § 4-309): Subject to specific Maryland protections against re-disclosure.

9. CONDITIONING

Pursuant to 45 C.F.R. § 164.508(b)(4) and Md. Code Ann., Health-Gen. § 4-303, the Covered Entity may not condition treatment, payment, enrollment, or eligibility for benefits on whether I sign this Authorization, except as permitted for:

• Research-related treatment;
• Health plan eligibility/enrollment underwriting; or
• Disclosures solely for creating PHI for a third party.

10. COMPENSATION FOR DISCLOSURE

• ☐ The Covered Entity WILL NOT receive remuneration for the disclosure of my PHI.
• ☐ The Covered Entity WILL receive remuneration as follows: [____________________] (45 C.F.R. § 164.508(a)(4)).

11. COPY FEES (MARYLAND)

I understand that the Covered Entity may charge a reasonable preparation and copying fee for paper or electronic copies, subject to the maximums set forth in Md. Code Ann., Health-Gen. § 4-304 and the Maryland Health Care Commission's published rates. Copies requested by the Patient or for continuity of care may be subject to reduced or waived fees as required by law.

12. METHOD OF DELIVERY

PHI shall be delivered to Recipient by (select all that apply):

• ☐ U.S. Mail (standard)
• ☐ U.S. Mail (certified, return receipt)
• ☐ Secure electronic transmission / encrypted email
• ☐ Patient portal
• ☐ Fax to: [____________________]
• ☐ Hand delivery / in-person pickup
• ☐ Other: [____________________]

13. STATEMENT OF UNDERSTANDING

By signing below, I acknowledge and agree:

1. I have read and understood this Authorization in its entirety, or it has been read and explained to me.
2. I am signing voluntarily and free from coercion.
3. I have had the opportunity to ask questions and to consult an attorney if I wished.
4. I am entitled to a copy of this signed Authorization (45 C.F.R. § 164.508(c)(4); Md. Code Ann., Health-Gen. § 4-303).
5. I understand my rights under HIPAA and the Maryland Confidentiality of Medical Records Act.

14. EXECUTION

If signed by a personal representative (parent of minor, legal guardian, healthcare agent under Maryland Advance Directive Act, surrogate decision-maker, or personal representative of decedent's estate):

Witness (recommended for sensitive disclosures):

15. COPY TO PATIENT

☐ A copy of this completed and signed Authorization has been provided to the Patient on [__/__/____] as required by 45 C.F.R. § 164.508(c)(4) and Md. Code Ann., Health-Gen. § 4-303.

SOURCES AND REFERENCES

• 45 C.F.R. § 164.508 (HIPAA Authorization Core Elements)
• Md. Code Ann., Health-Gen. § 4-301 et seq. (Maryland Confidentiality of Medical Records Act)
• Md. Code Ann., Health-Gen. § 4-303 (Disclosure Upon Authorization)
• Md. Code Ann., Health-Gen. § 4-304 (Copies of Records / Fees)
• Md. Code Ann., Health-Gen. § 4-307 (Mental Health and Substance Use Disclosure)
• Md. Code Ann., Health-Gen. § 4-309 (Genetic Information)
• Md. Code Ann., Health-Gen. §§ 18-336, 18-337 (HIV Testing and Disclosure)
• 42 C.F.R. Part 2 (Federal Substance Use Disorder Records)
• 42 U.S.C. § 1320d-5 (HIPAA Civil Penalties)