HIPAA Authorization Form - Vermont

HIPAA AUTHORIZATION FOR USE AND DISCLOSURE OF PROTECTED HEALTH INFORMATION (VERMONT)

(Comprehensive - HIPAA and Vermont Privacy Laws)

1. INDIVIDUAL AND COVERED ENTITY IDENTIFICATION

Disclosing Covered Entity ("CE"):
[Provider / Plan / Clearinghouse Legal Name]
[Address] | [Phone] | [HIPAA Privacy Officer]

Authorized Recipient(s):
[Recipient Name(s), Title, Organization, Address]

2. DESCRIPTION OF INFORMATION TO BE USED OR DISCLOSED

(Required by 45 C.F.R. § 164.508(c)(1)(i): the authorization must describe the PHI to be used or disclosed in a specific and meaningful fashion.)

☐ Complete medical record
☐ Office and progress notes, dated [__/__/____] through [__/__/____]
☐ Laboratory and pathology reports
☐ Diagnostic imaging and radiology reports / films
☐ Discharge summaries and hospital records
☐ Billing and payment records
☐ Immunization records
☐ Prescription / medication records
☐ Other: [____________________________]

Date range of records: From [__/__/____] to [__/__/____] (or ☐ all dates).

3. SENSITIVE / SPECIALLY PROTECTED INFORMATION (VERMONT)

Initial each category you authorize for disclosure. Leaving a line blank means the category is NOT released.

☐ Mental health treatment records (18 V.S.A. § 7103 - written consent required; all certificates, applications, records, and reports identifying a patient receiving mental health hospitalization or care are confidential). Initials: [____]

☐ HIV / AIDS testing or counseling information (12 V.S.A. § 1705 - heightened protection; in litigation a court may compel disclosure only on a showing of compelling need). Initials: [____]

☐ Sexually transmitted disease and communicable disease information (18 V.S.A. § 1095 and Vermont DOH rules). Initials: [____]

☐ Substance use disorder ("SUD") treatment records protected by 42 C.F.R. Part 2. I acknowledge that Part 2 records may not be redisclosed without additional written authorization and that any further disclosure is prohibited unless permitted by Part 2. Initials: [____]

☐ Genetic testing results and information (18 V.S.A. § 9332(e) - results may be disclosed only pursuant to written authorization). Initials: [____]

☐ Psychotherapy notes as defined in 45 C.F.R. § 164.501 (separate authorization required under 45 C.F.R. § 164.508(a)(2)). Initials: [____]

4. PURPOSE OF DISCLOSURE

(Required by 45 C.F.R. § 164.508(c)(1)(iv).)

☐ Continuity of care / treatment by another provider
☐ Personal use ("at the request of the individual")
☐ Legal proceeding: Case caption [____________________________], Case No. [______________]
☐ Insurance / claim review / disability determination
☐ Workers' compensation
☐ Social Security / public benefits application
☐ Employment / pre-employment screening
☐ Research study: [____________________________]
☐ Other: [____________________________]

5. EXPIRATION

(Required by 45 C.F.R. § 164.508(c)(1)(v).)

This Authorization expires on the earliest to occur of:

a. Specific expiration date: [__/__/____]; or
b. Specific expiration event: [e.g., "conclusion of Case No. ____" or "completion of disability adjudication"]; or
c. ☐ One (1) year from the date of signature if no date or event is specified; or
d. The Individual's written revocation pursuant to Section 6.

6. RIGHT TO REVOKE

(Required by 45 C.F.R. § 164.508(c)(2)(i).)

I understand that I may revoke this Authorization at any time by submitting a written revocation to:

[CE Name, attn: HIPAA Privacy Officer, Address]

Revocation is effective on receipt, except to the extent that the Covered Entity or Recipient has already acted in reliance on this Authorization. Revocation does not extend to information already disclosed.

7. RE-DISCLOSURE WARNING

I understand that once PHI is disclosed to the Recipient, federal HIPAA protections may no longer apply, and the information may be redisclosed by the Recipient. However:

• 42 C.F.R. Part 2 substance use disorder records remain subject to the federal redisclosure prohibition; any redisclosure requires my further written consent or another Part 2 exception.
• HIV-related testing/counseling information disclosed pursuant to 12 V.S.A. § 1705 in litigation remains subject to court-imposed safeguards and sealing orders.
• Genetic information remains subject to the written-authorization requirement of 18 V.S.A. § 9332(e) for any further disclosure.
• Mental health records under 18 V.S.A. § 7103 remain subject to Vermont confidentiality and may not be redisclosed without further written consent.

8. CONDITIONS, REMUNERATION, AND MARKETING

a. No conditioning of treatment. The Covered Entity may not condition treatment, payment, enrollment in a health plan, or eligibility for benefits on whether I sign this Authorization, except as permitted by 45 C.F.R. § 164.508(b)(4).
b. Marketing. PHI will not be used or disclosed for marketing without separate written authorization.
c. Sale of PHI. PHI will not be sold without my separate written authorization disclosing remuneration. ☐ I acknowledge if remuneration is involved: [Describe]
d. Fees. Charges for copies are limited by 18 V.S.A. § 9419 (the greater of a flat $5.00 fee or $0.50 per page; additional reasonable fees may apply for X-rays, films, electronic media). No charge may be imposed for records requested to support a claim or appeal under the Social Security Act or other needs-based program.

9. VERMONT HEALTH INFORMATION EXCHANGE (VHIE)

☐ I have separately signed a Vermont Health Information Exchange (VHIE) consent form authorizing participating providers to access my PHI through VHIE.
☐ I have not signed a VHIE consent form, and access through VHIE is NOT authorized by this form.

10. INDIVIDUAL'S RIGHTS NOTICE

I understand and acknowledge that:

a. I have the right to inspect and copy the PHI to be disclosed, subject to 45 C.F.R. § 164.524 and 18 V.S.A. § 9419.
b. I have the right to receive a copy of this signed Authorization.
c. The Covered Entity's Notice of Privacy Practices describes how PHI is used and disclosed; a copy is available upon request.
d. Vermont law (18 V.S.A. § 7103) imposes criminal penalties (fine up to $2,000 or imprisonment up to one year) for unauthorized disclosure of protected mental health information.
e. Vermont law (12 V.S.A. § 1705) and Vermont Judiciary administrative directives require pseudonyms and sealing for HIV-related testing information disclosed in litigation.

11. SIGNATURE

By signing below, I represent that I have read and understood this Authorization, have had an opportunity to ask questions, and voluntarily authorize the Use and Disclosure of my PHI as set forth above.

Authority of Personal Representative (check one):
☐ Parent / legal guardian of unemancipated minor
☐ Court-appointed guardian (attach order)
☐ Agent under Vermont Advance Directive (18 V.S.A. ch. 231)
☐ Health care agent / durable power of attorney for health care
☐ Executor / administrator of decedent's estate
☐ Other: [____________________________]

Witness (recommended; required by some Vermont providers for mental health releases):
Signature: _____________________ Printed Name: _____________________ Date: [__/__/____]

12. SOURCES AND REFERENCES

• 45 C.F.R. § 164.508 - HIPAA authorization core elements
• 18 V.S.A. § 7103 - Mental health treatment record confidentiality
• 18 V.S.A. ch. 042B (§§ 1881-1883) - Vermont Health Care Privacy
• 12 V.S.A. § 1705 - HIV-related testing information in litigation
• 18 V.S.A. § 1095 - STD partner treatment / communicable disease provisions
• 18 V.S.A. § 9332 - Genetic testing; written authorization
• 18 V.S.A. § 9419 - Charges for access to records
• 42 C.F.R. Part 2 - Federal SUD record confidentiality
• Vermont Judiciary Administrative Directive TC-6 (HIV sealing protocols)
• VITL Policy on Patient Consent for VHIE Access