HIPAA Authorization Form - New Hampshire

HIPAA AUTHORIZATION FOR USE AND DISCLOSURE OF PROTECTED HEALTH INFORMATION (NEW HAMPSHIRE)

(Comprehensive - HIPAA, NH Medical Records Statute, and New Hampshire Sensitive-Category Laws)

TABLE OF CONTENTS

1. Document Header
2. Definitions
3. Operative Provisions
4. Sensitive-Category Authorizations (NH)
5. Required HIPAA Notices
6. Representations and Warranties
7. Covenants and Restrictions
8. Default and Remedies
9. Dispute Resolution
10. General Provisions
11. Execution Block

1. DOCUMENT HEADER

HIPAA AUTHORIZATION FOR USE AND DISCLOSURE OF PROTECTED HEALTH INFORMATION
Effective Date: [__/__/____]

This HIPAA Authorization ("Authorization") is made by and between:

Recitals

A. Covered Entity ("CE") maintains "Protected Health Information" ("PHI") pertaining to Individual that is subject to the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), 45 C.F.R. Parts 160 and 164, and to applicable laws of the State of New Hampshire, including RSA 332-I.

B. Individual desires to authorize the Use and Disclosure of PHI described herein, for the purpose(s) set forth below, subject to the terms of this Authorization and applicable New Hampshire law.

C. CE is willing to Use and Disclose PHI in reliance on this Authorization, and Recipient is willing to receive PHI, subject to HIPAA, New Hampshire law, and the additional covenants below.

NOW, THEREFORE, the Parties agree as follows:

2. DEFINITIONS

"Authorization" - This HIPAA authorization form, including all appendices and amendments.

"Covered Entity" or "CE" - The health-care provider, health plan, or health-care clearinghouse identified in the Document Header that is subject to HIPAA.

"Disclose" or "Disclosure" - The release, transfer, provision of access to, or divulging in any manner of PHI outside CE, as defined in 45 C.F.R. § 160.103.

"HIPAA" - The Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, and its implementing regulations at 45 C.F.R. Parts 160 and 164.

"Individual" - The subject of the PHI and signatory hereto, as defined in 45 C.F.R. § 160.103.

"NH Medical Records Statute" - RSA 332-I:1 et seq., declaring medical records the property of the patient and governing access and copy fees.

"PHI" - Protected Health Information described as: [DESCRIBE CATEGORIES - e.g., "all medical records dated [__/__/____] through [__/__/____]; laboratory results; imaging; physician notes; discharge summaries"].

"Recipient" - The person(s) or entity(ies) authorized to receive the PHI.

"Use" - The sharing, employment, application, utilization, examination, or analysis of PHI within CE, as defined in 45 C.F.R. § 160.103.

3. OPERATIVE PROVISIONS

3.1 Grant of Authorization.
a. Authorized PHI. CE is hereby authorized to Use and Disclose the PHI described above.
b. Authorized Recipient(s). Disclosure may be made to: [RECIPIENT NAME / TITLE / ADDRESS].
c. Purpose(s). PHI may be Used or Disclosed solely for: [e.g., "continuity of care," "insurance claim," "legal proceeding in [Docket No.]," "at Individual's request"].
d. Expiration. This Authorization expires on the earliest of: (i) [__/__/____]; (ii) completion of the purpose(s) in 3.1(c); or (iii) revocation under Section 3.2.

3.2 Right of Revocation.
Individual may revoke this Authorization at any time by delivering written notice to CE at [DESIGNATED ADDRESS / HIPAA PRIVACY OFFICE]. Revocation is effective upon receipt, except to the extent CE or Recipient has already acted in reliance. Revocation does not affect actions taken before receipt.

3.3 Re-Disclosure Warning.
Information disclosed under this Authorization may be subject to re-disclosure by Recipient and may no longer be protected by HIPAA or New Hampshire law. CE has no responsibility for re-disclosure not under its control.

3.4 Conditions for Treatment and Payment.
Except for research-related treatment or enrollment in a health plan as permitted by 45 C.F.R. § 164.508(b)(4), CE may not condition treatment, payment, enrollment, or eligibility on the execution of this Authorization.

3.5 Compensation.
No Party shall receive remuneration for the Use or Disclosure of PHI except as permitted under HIPAA, 45 C.F.R. § 164.508(a)(4), and New Hampshire law.

3.6 Copy of Authorization.
Individual is entitled to a signed copy of this Authorization. Initials: [____]

4. SENSITIVE-CATEGORY AUTHORIZATIONS (NEW HAMPSHIRE)

4.1 Mental Health Records (RSA 135-C:19-a; RSA 329:26).
Individual authorizes Disclosure of mental health treatment records, including diagnoses, course of treatment, and psychiatric evaluations, as held by community mental health programs, state facilities, or licensed providers.
☐ I authorize ☐ I do NOT authorize
Individual Initials: [____]

4.2 Psychotherapy Notes (45 C.F.R. § 164.508(a)(2)).
Individual authorizes Disclosure of psychotherapy notes maintained separately from the rest of the medical record.
☐ I authorize ☐ I do NOT authorize
Individual Initials: [____]

4.3 HIV / AIDS Test Results and Related Information (RSA 141-F:7; RSA 141-F:8).
Individual authorizes Disclosure of HIV test results and information identifying Individual as the subject of HIV testing, treatment, or diagnosis. Disclosure of HIV information requires specific written authorization, and unauthorized disclosure carries civil penalties of up to $5,000 plus damages under RSA 141-F:10.
☐ I authorize ☐ I do NOT authorize
Individual Initials: [____]

4.4 Substance Use Disorder Records (42 C.F.R. Part 2; RSA 172-B:7 where applicable).
Federal law (42 C.F.R. Part 2) restricts disclosure of records of Individual's identity, diagnosis, prognosis, or treatment relating to substance use disorder by a Part 2 program. Individual authorizes Disclosure as follows:
☐ I authorize ☐ I do NOT authorize
Individual Initials: [____]
Required Part 2 prohibition on re-disclosure: This information has been disclosed from records protected by federal confidentiality rules (42 C.F.R. Part 2). The federal rules prohibit further disclosure of this information unless authorized by Individual in writing or as otherwise permitted by 42 C.F.R. Part 2. The federal rules restrict any use of the information to investigate or prosecute with regard to a crime any patient with a substance use disorder, except as provided at §§ 2.12(c)(5) and 2.65.

4.5 Genetic Information (RSA 141-H:2; GINA).
Individual authorizes Disclosure of genetic test results and individually identifiable genetic information. RSA 141-H:2 requires prior written and informed consent for disclosure of genetic test results.
☐ I authorize ☐ I do NOT authorize
Individual Initials: [____]

4.6 Reproductive Health, Sexually Transmitted Infections, and Sexual Assault Examination Records.
☐ I authorize ☐ I do NOT authorize
Individual Initials: [____]

5. REQUIRED HIPAA NOTICES

5.1 Right to Revoke. As described in Section 3.2.

5.2 Treatment, Payment, Enrollment, and Eligibility. As described in Section 3.4.

5.3 Re-Disclosure. As described in Section 3.3.

5.4 Right to Copy. Individual is entitled to a copy of this signed Authorization (45 C.F.R. § 164.508(c)(4)) and to inspect and obtain a copy of the PHI under HIPAA and RSA 332-I:5, which deems medical records the property of the patient and entitles the patient or requestor to a copy within thirty (30) days.

5.5 Fees. Copy fees shall not exceed the limits in RSA 332-I:5 and HIPAA's "reasonable, cost-based fee" standard at 45 C.F.R. § 164.524(c)(4).

6. REPRESENTATIONS AND WARRANTIES

6.1 Individual's Representations.
a. Individual is of legal age and has full legal capacity, or is the personal representative duly authorized under applicable law to sign on Individual's behalf.
b. The information provided is accurate and complete to the best of Individual's knowledge.

6.2 CE's Representations.
a. CE will Use and Disclose PHI only as permitted by this Authorization and applicable law.
b. CE maintains administrative, physical, and technical safeguards required by HIPAA, 45 C.F.R. Part 164, Subpart C.

6.3 Recipient's Representations.
Recipient shall maintain the confidentiality of PHI in accordance with applicable law and this Authorization and shall not Use or Disclose PHI except as expressly permitted herein.

6.4 Survival.
The representations and warranties in this Section survive the expiration or termination of this Authorization to the extent necessary to protect PHI and enforce the Parties' rights.

7. COVENANTS AND RESTRICTIONS

7.1 Safeguards.
Recipient shall implement reasonable administrative, physical, and technical safeguards to prevent unauthorized Use or Disclosure of PHI and shall promptly notify CE and Individual of any breach or suspected breach.

7.2 Prohibited Actions.
Recipient shall not (a) sell PHI; (b) Use PHI for marketing without separate authorization; or (c) combine PHI with other data in a manner that violates HIPAA, RSA 332-I, or other New Hampshire law.

7.3 Sensitive-Category Compliance.
Recipient shall observe all category-specific re-disclosure restrictions, including 42 C.F.R. Part 2 for substance use disorder records and RSA 141-F:8 for HIV information.

8. DEFAULT AND REMEDIES

8.1 Events of Default.
a. Material breach of Sections 3, 4, or 7;
b. Failure to comply with any applicable law regarding PHI; or
c. Written notice of breach delivered by a governmental authority.

8.2 Notice and Cure.
Upon an Event of Default, the non-breaching Party shall give written notice specifying the default. The breaching Party shall have thirty (30) days from receipt to cure, if curable.

8.3 Remedies.
a. Termination of this Authorization, in whole or in part;
b. Injunctive relief to prevent unauthorized Disclosure;
c. Damages, civil penalties, and attorney fees as authorized by HIPAA, RSA 141-F:10 (HIV), RSA 141-H:6 (genetic testing), and other applicable law.

9. DISPUTE RESOLUTION

9.1 Governing Law.
This Authorization is governed by HIPAA and, to the extent not preempted, the laws of the State of New Hampshire.

9.2 Forum Selection.
Exclusive jurisdiction and venue lie in the Superior Court for [COUNTY] County, New Hampshire, and in the United States District Court for the District of New Hampshire.

9.3 Equitable Relief.
Any equitable relief is limited to the minimum scope necessary to protect PHI.

10. GENERAL PROVISIONS

10.1 Amendment and Waiver. Amendments must be in writing and signed by all Parties.

10.2 Assignment. No Party may assign rights or obligations without prior written consent, except CE may assign to a successor in interest upon merger or acquisition.

10.3 Severability. If any provision is held invalid, it shall be reformed to the minimum extent necessary, and the remaining provisions continue in full force.

10.4 Integration. This Authorization constitutes the entire agreement on its subject matter.

10.5 Counterparts and Electronic Signatures. Counterparts permitted; electronic signatures deemed equivalent to handwritten signatures under RSA 294-E (NH Uniform Electronic Transactions Act).

11. EXECUTION BLOCK

IN WITNESS WHEREOF, the Parties have executed this Authorization as of the Effective Date.

Individual / Patient

Signature: ____________________________________
Printed Name: [__________________________________]
Date: [__/__/____]

If signed by Personal Representative:
Printed Name: [__________________________________]
Authority / Relationship: [__________________________________]
Documentation Attached: ☐ Power of Attorney ☐ Guardianship Order ☐ Other: [____________]

Covered Entity

By: ____________________________________
Printed Name: [__________________________________]
Title: [__________________________________]
Date: [__/__/____]

Witness (Optional, recommended for sensitive-category disclosures)

Signature: ____________________________________
Printed Name: [__________________________________]
Date: [__/__/____]

SOURCES AND REFERENCES

• 45 C.F.R. § 164.508 (HIPAA authorization core elements)
• 42 C.F.R. Part 2 (substance use disorder records confidentiality)
• RSA 332-I:1 et seq. (Medical Records and Patient Information)
• RSA 135-C:19-a (mental health records disclosure)
• RSA 141-F:7 and 141-F:8 (HIV testing and disclosure)
• RSA 141-F:10 (HIV - civil penalties)
• RSA 141-H:2 (Genetic Testing - written informed consent for disclosure)
• RSA 294-E (NH Uniform Electronic Transactions Act)