HIPAA Authorization Form - Rhode Island

HIPAA AUTHORIZATION FOR USE AND DISCLOSURE OF PROTECTED HEALTH INFORMATION (RHODE ISLAND)

(Comprehensive — HIPAA and Rhode Island Confidentiality of Health Care Communications and Information Act)

1. DOCUMENT HEADER

HIPAA AUTHORIZATION FOR USE AND DISCLOSURE OF PROTECTED HEALTH INFORMATION
Effective Date: [__/__/____]

This HIPAA Authorization ("Authorization") is made by and between:

Recitals

A. CE maintains certain Protected Health Information ("PHI") pertaining to Patient that is subject to HIPAA, 45 C.F.R. Parts 160 and 164, and Rhode Island law.
B. Patient desires to authorize the Use and Disclosure of PHI subject to the terms below and applicable Rhode Island law.
C. CE is willing to Use and Disclose PHI in reliance on this Authorization, subject to HIPAA, Rhode Island law, and the covenants below.

2. DEFINITIONS

"Authorization" — This HIPAA authorization form, including all appendices and amendments.

"Confidential Healthcare Communication" — A communication of healthcare information by an individual to a healthcare provider, as defined in R.I. Gen. Laws § 5-37.3-3.

"Covered Entity" or "CE" — The health-care provider, health plan, or clearinghouse identified above subject to HIPAA.

"Disclose" or "Disclosure" — The release, transfer, provision of access to, or divulging in any other manner of PHI outside CE.

"HIPAA" — The Health Insurance Portability and Accountability Act of 1996 and 45 C.F.R. Parts 160 and 164.

"Patient" — The subject of the PHI and signatory hereto.

"PHI" — Protected Health Information, including [describe categories, e.g., "laboratory test results dated __/__/____ through __/__/____, diagnostic imaging, physician progress notes, and discharge summaries"].

"Recipient" — The person(s) or entity(ies) authorized to receive the PHI.

"RI Confidentiality Laws" — Collectively, R.I. Gen. Laws § 5-37.3-1 et seq. (Confidentiality of Health Care Communications and Information Act), § 40.1-5-26 (mental health records), § 23-6.3 et seq. (HIV), § 23-17-19.1 (hospital/genetic records), and related regulations.

"Use" — The sharing, employment, application, utilization, examination, or analysis of PHI within CE.

3. OPERATIVE PROVISIONS

3.1 Grant of Authorization

a. Authorized PHI. CE is hereby authorized to Use and Disclose the PHI specifically described above.
b. Authorized Recipient(s). Disclosure may be made to: [Recipient Name/Title/Address].
c. Purpose(s). PHI may be Used or Disclosed solely for: [e.g., "continuity of care," "insurance underwriting," "legal proceeding in Case No. ____," "research study titled ____," or "at the request of the Patient"].
d. Expiration. This Authorization shall expire on the earliest to occur of:
(i) [__/__/____];
(ii) completion of the purpose(s) stated above; or
(iii) revocation pursuant to Section 3.2.

3.2 Right of Revocation

Patient may revoke this Authorization at any time by delivering written notice to CE at [Designated Address or HIPAA Privacy Office]. Revocation is effective upon receipt, except to the extent CE or Recipient has already acted in reliance on this Authorization.

3.3 Re-Disclosure Warning

Information disclosed under this Authorization may be subject to re-disclosure by Recipient and may no longer be protected by HIPAA or Rhode Island law. For substance use disorder records subject to 42 C.F.R. Part 2: the federal rules prohibit further disclosure unless expressly permitted by the written consent of the person to whom the records pertain or as otherwise permitted by 42 C.F.R. Part 2. A general authorization is NOT sufficient.

3.4 Compliance with R.I. Gen. Laws § 5-37.3-4

Per § 5-37.3-4, a patient's confidential healthcare information shall not be released or transferred without written consent. This Authorization is intended to satisfy the written consent requirements of § 5-37.3-4 and includes:
a. The name and address of the person, agency, or organization to whom disclosure is to be made;
b. The information or records to be released;
c. The purpose for the release;
d. The date, event, or condition upon which the consent will expire; and
e. A statement that the consent is subject to revocation.

3.5 Conditions for Treatment and Payment

Except for research-related treatment or enrollment in a health plan, CE may not condition treatment, payment, enrollment, or eligibility for benefits on the execution of this Authorization.

3.6 Special Categories of PHI — Rhode Island-Specific Authorizations

Each category below requires Patient's separate, specific written consent. Initial each category authorized; un-initialed categories remain confidential.

a. Mental Health Records (R.I. Gen. Laws § 40.1-5-26). Mental health information and records shall be confidential and may be disclosed only with the written consent of the patient (or guardian) or as otherwise specifically permitted by statute.
☐ Initials: [____] — I specifically authorize release of mental health records.

b. HIV-Related Information (R.I. Gen. Laws § 23-6.3-11; Confidentiality Act). Confidential HIV-related information may not be disclosed without specific written authorization. A general authorization is NOT sufficient.
☐ Initials: [____] — I specifically authorize release of HIV testing/status/treatment information.
Recipient (HIV info): [_______________________]
Purpose (HIV info): [_______________________]

c. Substance Use Disorder Records (42 C.F.R. Part 2). SUD records may not be disclosed without specific written consent satisfying 42 C.F.R. § 2.31.
☐ Initials: [____] — I specifically authorize release of substance use disorder records.

d. Psychotherapy Notes (45 C.F.R. § 164.508(a)(2)).
☐ Initials: [____] — I specifically authorize release of psychotherapy notes.

e. Genetic Information (R.I. Gen. Laws § 23-17-19.1; GINA). Genetic information may not be released without prior written authorization that accompanies each disclosure and identifies the recipient.
☐ Initials: [____] — I specifically authorize release of genetic test results / genetic information.
Recipient (Genetic info): [_______________________]
Purpose (Genetic info): [_______________________]

f. Sexual Assault / Domestic Violence Records. If applicable under Rhode Island law:
☐ Initials: [____] — I specifically authorize release of such records.

3.7 Compensation

No Party shall receive remuneration for the Use or Disclosure of PHI except as permitted under HIPAA and Rhode Island law.

4. REPRESENTATIONS & WARRANTIES

4.1 Patient's Representations

a. Patient is of legal age and has full legal capacity, or is the personal representative/guardian duly authorized under Rhode Island law to sign this Authorization.
b. Information provided herein is accurate and complete to the best of Patient's knowledge.

4.2 CE's Representations

a. CE will Use and Disclose PHI only as permitted by this Authorization and applicable law.
b. CE maintains administrative, physical, and technical safeguards required by HIPAA and the RI Confidentiality Laws.

4.3 Recipient's Representations

Recipient shall maintain confidentiality of PHI in accordance with HIPAA, the RI Confidentiality Laws, and this Authorization, and shall not Use or Disclose PHI except as expressly permitted herein.

4.4 Survival

The representations and warranties survive expiration or termination to the extent necessary to protect PHI and enforce the Parties' rights.

5. COVENANTS & RESTRICTIONS

5.1 Recipient Covenant

Recipient shall implement reasonable safeguards to prevent unauthorized Use or Disclosure of PHI and shall immediately notify CE and Patient of any breach or suspected breach.

5.2 Prohibited Actions

Recipient shall not:
a. Sell PHI;
b. Use PHI for marketing without separate written authorization; or
c. Combine PHI with other data in a manner that violates HIPAA or Rhode Island law.

5.3 Limitations Per § 5-37.3-4

Recipient acknowledges the additional disclosure limitations of R.I. Gen. Laws § 5-37.3-4 and shall not re-disclose information except in conformity with that section.

6. DEFAULT & REMEDIES

6.1 Events of Default

a. Material breach of Sections 3–5;
b. Failure to comply with HIPAA, the RI Confidentiality Laws, or 42 C.F.R. Part 2; or
c. Written notice of breach from a governmental authority.

6.2 Notice & Cure

Upon an Event of Default, the non-breaching Party shall give written notice. The breaching Party shall have [30] days to cure, if curable.

6.3 Remedies

a. Termination of this Authorization, in whole or in part;
b. Limited Injunctive Relief to prevent imminent or continuing unauthorized Disclosure;
c. Recovery of Direct Damages subject to statutory limits;
d. Statutory Penalties under R.I. Gen. Laws § 5-37.3-9 (fines up to $5,000 per violation and/or imprisonment up to six months for knowing and intentional violations);
e. Attorney Fees to the prevailing Party.

7. RISK ALLOCATION

7.1 Indemnification (Authorization Scope)

Recipient shall indemnify, defend, and hold harmless CE and its affiliates from third-party claims arising out of Recipient's Use or Disclosure of PHI in violation of this Authorization or applicable law.

7.2 Limitation of Liability

To the fullest extent permitted by law, aggregate liability shall not exceed the statutory damages or penalties authorized by HIPAA, 42 U.S.C. § 1320d-5, the RI Confidentiality Laws, and related regulations. No Party shall be liable for incidental, consequential, or punitive damages, except as expressly permitted by statute.

7.3 Force Majeure

No Party shall be liable for delay or failure to perform due to events beyond reasonable control, provided prompt notice is given and performance resumes as soon as practicable.

8. DISPUTE RESOLUTION

8.1 Governing Law

This Authorization shall be governed by HIPAA and, to the extent not pre-empted, the laws of the State of Rhode Island, including the RI Confidentiality Laws.

8.2 Forum Selection

The Parties consent to exclusive jurisdiction and venue in the state and federal courts located in [COUNTY, RHODE ISLAND].

8.3 Optional Arbitration

By mutual written election after a dispute arises, the Parties may submit the matter to binding arbitration under the AAA Healthcare Payor Provider Rules.

8.4 Jury Trial

Nothing herein shall be construed to waive any Party's constitutional right to a jury trial.

9. GENERAL PROVISIONS

9.1 Amendment & Waiver

Any amendment must be in writing and signed by all Parties.

9.2 Assignment

No Party may assign without prior written consent, except CE may assign to a successor in interest upon merger or acquisition.

9.3 Severability

If any provision is held invalid, it shall be reformed to the minimum extent necessary; the remainder continues in full force.

9.4 Integration

This Authorization constitutes the entire agreement among the Parties.

9.5 Counterparts & Electronic Signatures

Counterparts permitted; electronic signatures equivalent to handwritten signatures.

10. EXECUTION BLOCK

IN WITNESS WHEREOF, the Parties have executed this Authorization as of the Effective Date.

Patient

Signature: _________________________________
Printed Name: _____________________________
Date: [__/__/____]

If signing as Personal Representative / Guardian:
Authority/Relationship: _____________________

Covered Entity

By: __________________________ Title: ____________________
Printed Name: _____________________________
Date: [__/__/____]

Recipient

By: __________________________ Title: ____________________
Printed Name: _____________________________
Date: [__/__/____]

NOTICE TO PATIENT (Rhode Island)

• You have the right to revoke this Authorization in writing at any time, except to the extent action has been taken in reliance on it.
• You have the right to receive a copy of this signed Authorization.
• Treatment, payment, enrollment, or eligibility for benefits cannot be conditioned on signing this Authorization (with limited exceptions).
• Information released may be subject to re-disclosure and may no longer be protected by federal or Rhode Island law.
• Rhode Island's Confidentiality of Health Care Communications and Information Act (R.I. Gen. Laws § 5-37.3) requires written consent for most disclosures and provides penalties of up to $5,000 per violation under § 5-37.3-9.
• Mental health (§ 40.1-5-26), HIV (§ 23-6.3), substance use disorder, and genetic information receive heightened protection and require specific written consent (initials above).

SOURCES AND REFERENCES

• 45 C.F.R. § 164.508 — HIPAA Authorization Required Elements
• R.I. Gen. Laws § 5-37.3-1 et seq. — Confidentiality of Health Care Communications and Information Act
• R.I. Gen. Laws § 5-37.3-4 — Limitations on and Permitted Disclosures
• R.I. Gen. Laws § 5-37.3-9 — Penalties
• R.I. Gen. Laws § 40.1-5-26 — Mental Health Records Disclosure
• R.I. Gen. Laws § 23-6.3-1 et seq. — HIV/AIDS Testing, Reporting, Confidentiality
• R.I. Gen. Laws § 23-6.3-11 — HIV Anti-Discrimination
• R.I. Gen. Laws § 23-17-19.1 — Hospital/Genetic Information
• 42 C.F.R. Part 2 — Federal SUD Patient Records Confidentiality