HIPAA Authorization Form - Washington

HIPAA AUTHORIZATION FOR USE AND DISCLOSURE OF PROTECTED HEALTH INFORMATION (WASHINGTON)

(Comprehensive — HIPAA, Washington UHCIA, and My Health My Data Act)

1. DOCUMENT HEADER

HIPAA AUTHORIZATION FOR USE AND DISCLOSURE OF PROTECTED HEALTH INFORMATION
Effective Date: [__/__/____]

2. PURPOSE OF AUTHORIZATION

The Patient authorizes the Covered Entity to use and/or disclose the Protected Health Information ("PHI") and Washington "health care information" (as defined in RCW 70.02.010) described below to the Authorized Recipient(s) for the following purpose(s):

☐ Continuity of care / treatment by another provider
☐ Insurance claim, underwriting, or coordination of benefits
☐ Legal proceeding — Case No. [__________], Court: [__________]
☐ Personal records / patient's own request
☐ Disability / Social Security determination
☐ Workers' compensation (Title 51 RCW)
☐ Research study: [__________]
☐ Other: [__________]

3. SPECIFIC INFORMATION AUTHORIZED FOR DISCLOSURE

The following categories of records are authorized for release:

☐ Complete medical record
☐ Office / clinic visit notes — date range [__/__/____] to [__/__/____]
☐ Laboratory test results
☐ Diagnostic imaging (X-ray, MRI, CT, ultrasound) and radiology reports
☐ Operative and procedure reports
☐ Hospital discharge summaries and inpatient records
☐ Prescription / medication history
☐ Immunization records
☐ Billing and itemized statements
☐ Other: [__________]

4. SPECIAL CATEGORIES — SEPARATE WASHINGTON AUTHORIZATION REQUIRED

If no box is initialed, none of the above categories may be released under this Authorization.

5. EXPIRATION

This Authorization shall expire on the earliest to occur of:

☐ Date certain: [__/__/____]
☐ Event: [e.g., conclusion of litigation, end of treatment course]
☐ Default: ninety (90) days from the date of signature (consistent with RCW 70.02.030(2))

6. RIGHT TO REVOKE

The Patient may revoke this Authorization at any time by delivering written notice to:

Privacy Officer, [Covered Entity Name]
[Address] | [Email] | [Fax]

Revocation is effective upon receipt, except to the extent (a) the Covered Entity has already acted in reliance on the Authorization, or (b) disclosure is necessary to effectuate payment for health care already provided. See RCW 70.02.040; 45 C.F.R. Section 164.508(b)(5).

7. RE-DISCLOSURE WARNING

Information disclosed pursuant to this Authorization may be re-disclosed by the Recipient and may no longer be protected by HIPAA or the Washington Uniform Health Care Information Act. Records protected by 42 C.F.R. Part 2 (federal substance use disorder confidentiality) carry an additional prohibition on re-disclosure without further written consent, and recipients must comply with the Part 2 notice in 42 C.F.R. Section 2.32.

8. CONDITIONS ON TREATMENT, PAYMENT, OR ENROLLMENT

The Covered Entity may not condition treatment, payment, enrollment in a health plan, or eligibility for benefits on the execution of this Authorization, except as permitted by 45 C.F.R. Section 164.508(b)(4) (research-related treatment, eligibility determinations by a health plan, or where the PHI is created for disclosure to a third party).

9. PROHIBITION ON SALE OF PHI AND CONSUMER HEALTH DATA

No remuneration may be received in exchange for the disclosure of PHI authorized hereunder, except as permitted by 45 C.F.R. Section 164.508(a)(4).

10. PATIENT RIGHTS NOTICE

The Patient acknowledges:

a. The right to inspect and copy the PHI to be disclosed (45 C.F.R. Section 164.524; RCW 70.02.080);
b. The right to receive a copy of this signed Authorization;
c. That refusal to sign will not affect treatment, payment, enrollment, or benefits eligibility except as permitted by law;
d. The right to revoke this Authorization in writing as set forth in Section 6;
e. That under the My Health My Data Act, consumers have additional rights with respect to "consumer health data" held by regulated entities outside HIPAA, including the right to confirm collection, access, withdraw consent, and request deletion (RCW 19.373.040).

11. SIGNATURE

12. PROVIDER ACKNOWLEDGMENT (OPTIONAL)

Received by:

Signature: _______________________________
Printed Name / Title: [__________________________]
Date: [__/__/____]

SOURCES AND REFERENCES

• 45 C.F.R. Section 164.508 — required elements of a valid HIPAA authorization
• RCW Chapter 70.02 — Washington Uniform Health Care Information Act
• RCW 70.02.030 — authorization requirements; 90-day form validity
• RCW 70.02.040 — patient's right to revoke
• RCW 70.24.105 — HIV/AIDS testing and disclosure
• RCW 71.05.390 et seq. — mental health record confidentiality
• RCW 70.96A.150 — substance use disorder records
• 42 C.F.R. Part 2 — federal SUD confidentiality
• RCW Chapter 19.373 — My Health My Data Act (effective March 31, 2024)
• Washington State Attorney General — My Health My Data Act FAQs