HIPAA Authorization Form - Oregon

HIPAA AUTHORIZATION FOR USE AND DISCLOSURE OF PROTECTED HEALTH INFORMATION (OREGON)

(Comprehensive — HIPAA, 42 C.F.R. Part 2, Oregon Protected Health Information Statutes, HIV, and Genetic Privacy Act)

TABLE OF CONTENTS

1. Document Header
2. Definitions
3. Operative Provisions
4. Representations & Warranties
5. Covenants & Restrictions
6. Default & Remedies
7. Risk Allocation
8. Dispute Resolution
9. General Provisions
10. Execution Block

1. DOCUMENT HEADER

HIPAA AUTHORIZATION FOR USE AND DISCLOSURE OF PROTECTED HEALTH INFORMATION
Effective Date: [MM/DD/YYYY]

This HIPAA Authorization ("Authorization") is made by and between:

a. Individual / Patient: [Full Legal Name], DOB [MM/DD/YYYY] ("Individual");
b. Covered Entity: [Health-Care Provider / Plan / Clearinghouse Legal Name] ("Covered Entity" or "CE"); and
c. Recipient(s): [Name(s) or Specific Identification of Recipient(s)] ("Recipient").

Recitals

A. CE maintains "Protected Health Information" ("PHI") pertaining to Individual that is subject to HIPAA, 45 C.F.R. Parts 160 and 164, and the Oregon protected health information statutes, ORS 192.553 to 192.581.
B. Individual desires to authorize the Use and Disclosure of PHI as described herein for the purpose(s) set forth below, subject to ORS 192.566 and other applicable Oregon law.
C. CE is willing to Use and Disclose PHI in reliance on this Authorization, and Recipient is willing to receive PHI, all subject to HIPAA, 42 C.F.R. Part 2 (where applicable), and the additional covenants, limitations, and remedies provided below.

NOW, THEREFORE, in consideration of the mutual promises contained herein, the Parties agree as follows:

2. DEFINITIONS

"Authorization" — This HIPAA authorization form, including all appendices and amendments. This Authorization is intended to satisfy both 45 C.F.R. § 164.508 and ORS 192.566.

"Covered Entity" or "CE" — The health-care provider, health plan, or health-care clearinghouse identified in the Document Header, subject to HIPAA and, where applicable, ORS 192.553 to 192.581.

"Disclose" or "Disclosure" — The release, transfer, provision of access to, or divulging in any other manner of PHI outside CE, as used in 45 C.F.R. § 160.103 and ORS 192.556.

"Genetic Information" — Has the meaning given in ORS 192.531(7), including the results of a genetic test and information about an individual's family medical history.

"HIPAA" — The Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, and its implementing regulations.

"Individual" — The subject of the PHI and signatory hereto.

"PHI" — Protected Health Information, including [describe categories, e.g., "physician progress notes, laboratory results dated [MM/DD/YYYY] to [MM/DD/YYYY], diagnostic imaging, discharge summaries, and billing records"].

"Recipient" — The person(s) or entity(ies) authorized to receive the PHI, as set forth in Section 3.1(b).

"Use" — The sharing, employment, application, utilization, examination, or analysis of PHI within CE.

3. OPERATIVE PROVISIONS

3.1 Grant of Authorization (ORS 192.566 Elements).
a. Person/Entity Disclosing: [CE Legal Name and Address].
b. Authorized Recipient(s): [Recipient Name / Title / Address].
c. Description of PHI: As specified in the definition of "PHI" above, including [date range, record types, treating providers].
d. Purpose(s): PHI may be Used or Disclosed solely for the following purpose(s): [e.g., "continuity of care," "insurance underwriting," "legal proceeding in Case No. ____ pending in the Circuit Court for ____ County, Oregon," "at the request of the Individual"].
e. Expiration. This Authorization shall expire on the earliest to occur of:
(i) [MM/DD/YYYY];
(ii) completion of the purpose(s) stated in Section 3.1(d); or
(iii) revocation pursuant to Section 3.2.

3.2 Right of Revocation.
Individual may revoke this Authorization at any time by delivering written notice to CE at [Designated Address or HIPAA Privacy Office]. Revocation is effective upon receipt, except to the extent CE or Recipient has already acted in reliance on this Authorization, consistent with ORS 192.566 and 45 C.F.R. § 164.508(b)(5).

3.3 Re-Disclosure Warning.
Information disclosed under this Authorization may be subject to re-disclosure by Recipient and may no longer be protected by HIPAA, 42 C.F.R. Part 2, or Oregon law. CE shall have no responsibility for any re-disclosure not under its control. Initials: ☐ [____]

3.4 Conditions for Treatment and Payment.
Except for research-related treatment or enrollment in a health plan, CE may not condition treatment, payment, enrollment, or eligibility for benefits on the execution of this Authorization. 45 C.F.R. § 164.508(b)(4); ORS 192.566.

3.5 Special Categories of PHI — Oregon-Specific Initials Required.

3.6 42 C.F.R. Part 2 and ORS 430.399 Notice (Substance Use Disorder Records).
If this Authorization extends to records protected by 42 C.F.R. Part 2 and/or ORS 430.399, Individual acknowledges receipt of the following notice required by 42 C.F.R. § 2.32:

"This information has been disclosed to you from records protected by federal confidentiality rules (42 C.F.R. Part 2) and Oregon law (ORS 430.399). The federal rules prohibit you from making any further disclosure of information in this record that identifies a patient as having or having had a substance use disorder either directly, by reference to publicly available information, or through verification of such identification by another person unless further disclosure is expressly permitted by the written consent of the individual whose information is being disclosed or as otherwise permitted by 42 C.F.R. Part 2. A general authorization for the release of medical or other information is NOT sufficient for this purpose."

3.7 Compensation / No Sale of PHI.
No Party shall receive remuneration for the Use or Disclosure of PHI except as permitted under HIPAA, 42 C.F.R. Part 2, and Oregon law. 45 C.F.R. § 164.508(a)(4).

4. REPRESENTATIONS & WARRANTIES

4.1 Individual's Representations.
a. Individual is of legal age (18 or older under ORS 109.510) and has full legal capacity, or is the personal representative duly authorized under Oregon law (e.g., parent, guardian, health-care representative under ORS 127.505 to 127.660) to sign this Authorization.
b. The information provided herein is accurate and complete.

4.2 CE's Representations.
a. CE will Use and Disclose PHI only as permitted by this Authorization and applicable law.
b. CE maintains administrative, physical, and technical safeguards required by 45 C.F.R. Part 164, Subpart C, and ORS 192.553 to 192.581.

4.3 Recipient's Representations.
Recipient shall maintain the confidentiality of PHI and shall not Use or Disclose PHI except as expressly permitted herein.

5. COVENANTS & RESTRICTIONS

5.1 Safeguards.
Recipient shall implement reasonable safeguards to prevent unauthorized Use or Disclosure of PHI and shall immediately notify CE and Individual of any breach or suspected breach.

5.2 Prohibited Actions.
Recipient shall not:
a. Sell PHI;
b. Use PHI for marketing without separate written authorization satisfying 45 C.F.R. § 164.508(a)(3); or
c. Combine PHI with other data in a manner that violates HIPAA, 42 C.F.R. Part 2, or Oregon law.

6. DEFAULT & REMEDIES

6.1 Events of Default.
a. Material breach of any provision of Sections 3-5;
b. Failure to comply with any applicable law regarding PHI; or
c. Written notice of breach delivered by a governmental authority.

6.2 Remedies.
a. Termination of this Authorization, in whole or in part;
b. Limited Injunctive Relief to prevent imminent or continuing unauthorized Disclosure of PHI;
c. Recovery of Direct Damages, including statutory penalties under the Oregon Genetic Privacy Act (ORS 192.541 — penalties ranging up to $250,000 per knowing violation of informed consent or disclosure requirements);
d. Attorney Fees. The prevailing Party is entitled to reasonable attorney fees and costs to the extent permitted by Oregon law.

7. RISK ALLOCATION

7.1 Indemnification.
Recipient shall indemnify, defend, and hold harmless CE and its affiliates from and against any third-party claims, losses, or liabilities directly arising out of Recipient's Use or Disclosure of PHI in violation of this Authorization or applicable law.

7.2 Limitation of Liability.
To the fullest extent permitted by law, the aggregate liability of any Party under this Authorization shall not exceed the statutory damages or penalties expressly authorized by HIPAA, 42 U.S.C. § 1320d-5, 42 C.F.R. Part 2, ORS 192.541, and related Oregon law. In no event shall any Party be liable for incidental or consequential damages, except as expressly provided by statute.

8. DISPUTE RESOLUTION

8.1 Governing Law.
This Authorization shall be governed by HIPAA and, to the extent not preempted, the laws of the State of Oregon.

8.2 Forum Selection.
The Parties consent to exclusive jurisdiction and venue in the state and federal courts located in [COUNTY], Oregon.

8.3 Jury Trial.
Nothing in this Section shall be construed to waive any Party's right to a jury trial under Article I, § 17 of the Oregon Constitution.

9. GENERAL PROVISIONS

9.1 Amendment & Waiver.
Any amendment must be in writing and signed by all Parties.

9.2 Severability.
If any provision is held invalid or unenforceable, it shall be reformed to the minimum extent necessary, and the remaining provisions shall continue in full force.

9.3 Integration.
This Authorization constitutes the entire agreement among the Parties concerning the subject matter and supersedes all prior understandings.

9.4 Counterparts & Electronic Signatures.
This Authorization may be executed in counterparts. Electronic signatures are deemed equivalent to handwritten signatures for all purposes under the Oregon Uniform Electronic Transactions Act, ORS 84.001 to 84.061.

10. EXECUTION BLOCK

IN WITNESS WHEREOF, the Parties have executed this Authorization as of the Effective Date.

Individual / Patient

Signature: _________________________________
Printed Name: _____________________________
Date: [__/__/____]

If signing as Personal Representative (parent, guardian, health-care representative under ORS 127.505 to 127.660, or court-appointed representative):
Authority / Relationship: _____________________
Documentation Attached: ☐ Yes ☐ No

Covered Entity

By: __________________________ Title: ____________________
Printed Name: _____________________________
Date: [__/__/____]

Recipient (if signature required)

By: __________________________ Title: ____________________
Printed Name: _____________________________
Date: [__/__/____]

Witness (Recommended for Mental Health / Substance Abuse / HIV / Genetic Disclosures)

Signature: _________________________________
Printed Name: _____________________________
Date: [__/__/____]

SOURCES AND REFERENCES

• 45 C.F.R. § 164.508 — HIPAA authorization core elements
• 42 C.F.R. Part 2 — Confidentiality of Substance Use Disorder Patient Records
• ORS 192.553 — Policy for protected health information
• ORS 192.556 to 192.581 — Oregon use and disclosure of PHI
• ORS 192.566 — Statutory authorization form for PHI
• ORS 433.045 — HIV testing notice and confidentiality
• ORS 430.399 — Confidentiality of substance use disorder treatment records
• ORS 192.531 to 192.549 — Oregon Genetic Privacy Act
• ORS 192.539 — Disclosure of genetic information
• ORS 192.541 — Civil penalties for violation of Genetic Privacy Act
• ORS 127.505 to 127.660 — Health-care representatives / advance directives
• Genetic Information Nondiscrimination Act (GINA), 42 U.S.C. § 2000ff et seq.