HIPAA Authorization Form - Nebraska

HIPAA AUTHORIZATION FOR USE AND DISCLOSURE OF PROTECTED HEALTH INFORMATION (NEBRASKA)

(Comprehensive - HIPAA and Nebraska privacy law)

TABLE OF CONTENTS

1. Document Header
2. Definitions
3. Operative Provisions
4. Sensitive Records and Required Initials
5. Revocation and Re-Disclosure
6. Representations and Warranties
7. Default and Remedies
8. Risk Allocation
9. Dispute Resolution
10. General Provisions
11. Execution Block

1. DOCUMENT HEADER

HIPAA AUTHORIZATION FOR USE AND DISCLOSURE OF PROTECTED HEALTH INFORMATION
Effective Date: [__/__/____]

This HIPAA Authorization ("Authorization") is made by and between:

Recitals

A. The Covered Entity ("CE") maintains Protected Health Information ("PHI") regarding the Individual that is subject to HIPAA, 45 C.F.R. Parts 160 and 164.
B. The Individual desires to authorize the use and disclosure of PHI as described herein, for the purposes set forth below, subject to Nebraska law.
C. The CE is willing to use and disclose PHI in reliance on this Authorization.

NOW, THEREFORE, the Parties agree as follows:

2. DEFINITIONS

"Authorization" — This HIPAA authorization form, including all appendices.

"Covered Entity" or "CE" — The provider, plan, or clearinghouse identified above.

"Disclose" / "Disclosure" — The release, transfer, provision of access to, or divulging of PHI outside the CE (45 C.F.R. § 160.103).

"HIPAA" — The Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, and its implementing regulations.

"Individual" — The subject of the PHI and signatory to this Authorization.

"PHI" — Protected Health Information described in Section 3.1(a), including [describe categories, dates, providers, and types of records].

"Recipient" — The person(s) or entity(ies) authorized to receive PHI under Section 3.1(b).

"Sensitive Information" — Information described in Section 4, including mental health, HIV/AIDS or other communicable disease, substance use disorder, and genetic records.

3. OPERATIVE PROVISIONS

3.1 Grant of Authorization.
a. Authorized PHI — Records dated [__/__/____] through [__/__/____], including: ☐ progress notes; ☐ diagnostic imaging; ☐ laboratory results; ☐ medication records; ☐ billing/itemized statements; ☐ discharge summaries; ☐ other: [____].
b. Authorized Recipient(s) — [Recipient Name, Title, Address, Phone].
c. Purpose(s) — PHI may be used or disclosed solely for: [e.g., continuity of care, insurance claim, legal proceeding in Case No. ____, at the request of the Individual, or other purpose].
d. Expiration — This Authorization expires on the earliest of: (i) [__/__/____]; (ii) completion of the purpose stated above; or (iii) revocation under Section 5.1.

3.2 Treatment, Payment, Enrollment, Eligibility.
Except for research-related treatment or enrollment in a health plan, the CE may not condition treatment, payment, enrollment, or eligibility on the execution of this Authorization (45 C.F.R. § 164.508(b)(4)).

3.3 Compensation.
No party shall receive remuneration for the use or disclosure of PHI except as permitted under HIPAA and Nebraska law.

3.4 Medical Records Access Rights.
This Authorization is in addition to, and does not waive, the Individual's right to inspect and copy medical records under Neb. Rev. Stat. §§ 71-8401 to 71-8407.

4. SENSITIVE RECORDS AND REQUIRED INITIALS

4.1 Psychotherapy Notes — 45 C.F.R. § 164.508(a)(2). Disclosure of psychotherapy notes maintained separately from the medical record requires a separate authorization and may not be combined with any other authorization.
☐ I authorize disclosure of psychotherapy notes. Initials: [____]

4.2 Mental Health Records — Neb. Rev. Stat. § 71-961 (Mental Health Commitment Act). Records subject to § 71-961 are confidential and may be released only with the subject's written permission or as otherwise provided by law. Willful breach is a Class II misdemeanor under § 71-962.
☐ I authorize disclosure of mental health records (including Mental Health Board records). Initials: [____]

4.3 HIV / AIDS / Communicable Disease Information — Neb. Rev. Stat. §§ 71-503.01, 71-511. HIV test results and communicable-disease information are confidential and may be redisclosed only as permitted by statute.
☐ I authorize disclosure of HIV, AIDS, and other communicable disease test results and related information. Initials: [____]

4.4 Substance Use Disorder Records — 42 C.F.R. Part 2. Federal law (and Nebraska law) prohibits disclosure of records identifying a person as having a substance use disorder unless this authorization complies with 42 C.F.R. § 2.31.
☐ I authorize disclosure of substance use disorder treatment records subject to 42 C.F.R. Part 2. Initials: [____]

4.5 Genetic Information — Genetic Information Nondiscrimination Act ("GINA"), 42 U.S.C. §§ 2000ff et seq. Disclosure shall comply with GINA and applicable Nebraska law.
☐ I authorize disclosure of genetic test results and genetic information. Initials: [____]

4.6 Physician-Patient Privileged Communications — Neb. Rev. Stat. § 25-21,128. I waive the physician-patient privilege to the extent necessary to effectuate this Authorization.
Initials: [____]

5. REVOCATION AND RE-DISCLOSURE

5.1 Right of Revocation.
The Individual may revoke this Authorization at any time by delivering written notice to the CE at [Designated Privacy Office Address]. Revocation is effective on receipt, except to the extent the CE or Recipient has already acted in reliance.

5.2 Re-Disclosure Warning.
Information disclosed under this Authorization may be subject to re-disclosure by the Recipient and may no longer be protected by HIPAA or Nebraska law. Substance use disorder records (42 C.F.R. Part 2) and HIV/communicable disease information (§§ 71-503.01, 71-511) retain their statutory protections against re-disclosure.

5.3 Copy to Individual.
The Individual is entitled to a signed copy of this Authorization (45 C.F.R. § 164.508(c)(4)).

6. REPRESENTATIONS AND WARRANTIES

6.1 Individual.
The Individual is of legal age and has full capacity, or is the personal representative duly authorized under Nebraska law.

6.2 Covered Entity.
The CE will use and disclose PHI only as permitted by this Authorization and applicable law, and maintains the administrative, physical, and technical safeguards required by HIPAA.

6.3 Recipient.
The Recipient shall maintain the confidentiality of PHI in accordance with all applicable laws and this Authorization.

7. DEFAULT AND REMEDIES

7.1 Events of Default.
a. Material breach of Sections 3 through 6;
b. Violation of applicable law regarding PHI; or
c. Written notice of breach from a governmental authority.

7.2 Notice and Cure.
The non-breaching Party shall give written notice specifying the default. The breaching Party shall have [30] days to cure, if curable.

7.3 Remedies.
a. Termination of this Authorization;
b. Limited injunctive relief to prevent unauthorized disclosure;
c. Recovery of direct damages subject to statutory limits;
d. Reasonable attorney fees and costs to the prevailing Party.

8. RISK ALLOCATION

8.1 Indemnification.
The Recipient shall indemnify, defend, and hold harmless the CE from any third-party claims arising out of the Recipient's use or disclosure of PHI in violation of this Authorization or applicable law.

8.2 Limitation of Liability.
Aggregate liability shall not exceed statutory damages or penalties expressly authorized by HIPAA (42 U.S.C. § 1320d-5), Neb. Rev. Stat. §§ 71-503.01, 71-511, 71-962, and related regulations. No Party shall be liable for incidental, consequential, or punitive damages.

8.3 Insurance.
[Optional] The Recipient shall maintain cyber/privacy liability insurance of not less than $[1,000,000] per claim.

9. DISPUTE RESOLUTION

9.1 Governing Law.
This Authorization is governed by HIPAA and, to the extent not preempted, the laws of the State of Nebraska.

9.2 Forum.
Exclusive jurisdiction and venue lie in the state and federal courts located in [COUNTY], Nebraska.

9.3 Optional Arbitration.
The Parties may, by mutual written election after a dispute arises, submit the matter to binding arbitration administered by the American Arbitration Association.

9.4 Jury Trial.
Nothing herein waives any Party's constitutional right to a jury trial.

10. GENERAL PROVISIONS

10.1 Amendment and Waiver.
Any amendment must be in writing and signed by all Parties. No waiver is continuing unless expressly stated.

10.2 Assignment.
No Party may assign without prior written consent, except that the CE may assign to a successor in interest upon merger or acquisition.

10.3 Severability.
If any provision is held invalid, it shall be reformed to the minimum extent necessary and the remainder shall continue in force.

10.4 Integration.
This Authorization is the entire agreement on its subject matter and supersedes prior understandings.

10.5 Counterparts and Electronic Signatures.
This Authorization may be executed in counterparts. Electronic signatures are equivalent to handwritten signatures.

11. EXECUTION BLOCK

IN WITNESS WHEREOF, the Parties have executed this Authorization as of the Effective Date.

Individual / Patient

Signature: _________________________________
Printed Name: _____________________________
Date: [__/__/____]

If signing as Personal Representative:
Authority / Relationship: _________________________________

Covered Entity

By: __________________________ Title: ____________________
Printed Name: _____________________________
Date: [__/__/____]

Recipient

By: __________________________ Title: ____________________
Printed Name: _____________________________
Date: [__/__/____]

SOURCES AND REFERENCES

• 45 C.F.R. § 164.508 — Uses and disclosures requiring an authorization
• 42 C.F.R. Part 2 — Confidentiality of Substance Use Disorder Patient Records
• Neb. Rev. Stat. § 71-961 — Mental health records; confidentiality
• Neb. Rev. Stat. § 71-962 — Mental health confidentiality; violations; penalty
• Neb. Rev. Stat. § 71-503.01 — Communicable diseases; reports; confidentiality
• Neb. Rev. Stat. § 71-511 — HIV/STD information; confidentiality
• Neb. Rev. Stat. §§ 71-8401 to 71-8407 — Patient access to medical records
• Neb. Rev. Stat. § 25-21,128 — Physician-patient privilege