Medical Records Authorization (HIPAA)

AUTHORIZATION FOR RELEASE OF PROTECTED HEALTH INFORMATION (HIPAA) — COLORADO

This Authorization is executed in connection with a personal-injury matter so that the Patient and/or the Patient's attorney may obtain the Patient's medical records.

1. PATIENT IDENTIFICATION

2. PROVIDER(S) AUTHORIZED TO RELEASE RECORDS

I authorize the following health-care provider(s), facility(ies), clinic(s), pharmacy(ies), laboratory(ies), insurer(s), or custodian(s) of records to release the Protected Health Information ("PHI") described below:

3. RECIPIENT(S) — PERSON(S) AUTHORIZED TO RECEIVE RECORDS

4. RECORDS AUTHORIZED FOR RELEASE

Date range of records: [__/__/____] to [__/__/____] (or ☐ all dates).

Check each category of records to be released:

• ☐ Complete medical record / designated record set
• ☐ History and physical examination reports
• ☐ Office/progress/treatment notes
• ☐ Hospital and emergency department records
• ☐ Operative and surgical reports
• ☐ Physician orders
• ☐ Laboratory and pathology reports
• ☐ Radiology/imaging reports and films (X-ray, MRI, CT, mammogram, ultrasound)
• ☐ Physical therapy / rehabilitation records
• ☐ Prescription and pharmacy/medication records
• ☐ Billing statements, itemized charges, and payment records
• ☐ Diagnostic test results
• ☐ Discharge summaries
• ☐ Other (specify): [________________________________]

5. SPECIAL-CATEGORY RECORDS — SEPARATE SPECIFIC AUTHORIZATION REQUIRED

The following categories are protected by heightened confidentiality rules. They will NOT be released unless the Patient specifically initials the corresponding line below. My initials authorize release of that specific category to the Recipient(s) named in Section 3:

42 C.F.R. Part 2 notice (substance use disorder records): Federal law (42 C.F.R. Part 2) prohibits any further disclosure of substance use disorder records unless the further disclosure is expressly permitted by the written consent of the person to whom they pertain or as otherwise permitted by 42 C.F.R. Part 2. A general authorization for release of medical or other information is NOT sufficient for this purpose. The federal rules restrict any use of the information to criminally investigate or prosecute any patient with a substance use disorder.

6. PURPOSE OF DISCLOSURE

The purpose of this disclosure is:

• ☐ Legal representation / evaluation, prosecution, or settlement of the Patient's personal-injury claim
• ☐ At the request of the Patient
• ☐ Other (specify): [________________________________]

7. HIPAA REQUIRED STATEMENTS

7.1 Expiration. This Authorization expires on [__/__/____], or upon the following event: [________________________________]. If no date or event is specified, this Authorization expires upon final resolution of the Patient's personal-injury claim or three (3) years from the date of signature, whichever occurs first.

7.2 Right to Revoke. I understand that I may revoke this Authorization at any time by delivering written notice to the provider/custodian identified in Section 2. Revocation will not apply to information already released in reliance on this Authorization before the provider receives my written revocation. (45 C.F.R. § 164.508(c)(2)(i).)

7.3 No Conditioning of Treatment. I understand that the provider may not condition treatment, payment, enrollment, or eligibility for benefits on whether I sign this Authorization, except as permitted by 45 C.F.R. § 164.508(b)(4).

7.4 Redisclosure Notice. I understand that information disclosed under this Authorization may be redisclosed by the Recipient and may then no longer be protected by HIPAA. (Special-category records under Section 5 remain subject to the redisclosure prohibitions of 42 C.F.R. Part 2 and applicable Colorado law.)

7.5 Right to a Copy. I understand that I am entitled to a copy of this signed Authorization.

7.6 Voluntary. I understand that signing this Authorization is voluntary.

8. COLORADO COPY-FEE AND RESPONSE-TIME NOTE

Under C.R.S. § 25-1-801 (facilities) and § 25-1-802 (individual providers), patient records must be made available to the patient or the patient's personal representative on a valid written authorization. Fees:

• Patient or personal representative (and an attorney representing them): the fee a covered entity may impose under HIPAA; an attorney requesting on the patient's behalf is subject to the same reasonable-fee limits, capped at the maximum allowed under the federal HITECH Act.
• Third parties (on a HIPAA-compliant authorization, valid subpoena, or court order): reasonable fees.
• No charge is allowed for mere inspection of records.
• Records must be delivered in electronic format if requested and if the originals are stored electronically and readily producible in that format.

Under the HIPAA right of access (45 C.F.R. § 164.524), a covered entity must generally act on a request within 30 days (with one 30-day extension on notice).

9. SIGNATURE

Personal Representative (if Patient is a minor, incapacitated, or deceased)

Notary (optional)

State of Colorado, County of [________________________].

Subscribed and sworn to before me on [__/__/____] by [________________________________].

Sources and References

• HIPAA authorization core elements — 45 C.F.R. § 164.508: https://www.law.cornell.edu/cfr/text/45/164.508
• HIPAA right of access — 45 C.F.R. § 164.524: https://www.law.cornell.edu/cfr/text/45/164.524
• Substance use disorder records — 42 C.F.R. Part 2: https://www.ecfr.gov/current/title-42/chapter-I/subchapter-A/part-2
• C.R.S. § 25-1-801 (patient records in custody of health-care facility): https://law.justia.com/codes/colorado/title-25/administration/article-1/part-8/section-25-1-801/
• C.R.S. § 25-1-1202 (index of medical-record confidentiality statutes): https://codes.findlaw.com/co/title-25-health/co-rev-st-sect-25-1-1202/