Medical Records Authorization (HIPAA)

AUTHORIZATION FOR RELEASE OF PROTECTED HEALTH INFORMATION (HIPAA) — DISTRICT OF COLUMBIA

This Authorization for Release of Protected Health Information (this "Authorization") is executed under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations at 45 C.F.R. Parts 160 and 164 (collectively, "HIPAA"), and, to the extent not preempted, the laws of the District of Columbia.

1. PATIENT IDENTIFICATION

2. PROVIDER(S) / HEALTH CARE ENTITY(IES) AUTHORIZED TO RELEASE

I authorize the following health-care provider(s), facility(ies), mental-health professional(s), and health plan(s) (each a "Covered Entity" or "health care entity") to release my Protected Health Information ("PHI") as described below:

3. RECIPIENT(S) AUTHORIZED TO RECEIVE INFORMATION

4. SPECIFIC RECORDS AND DATE RANGE

Date range of records requested: From [__/__/____] to [__/__/____], or ☐ all dates of service.

Mark each record type to be released:

☐ All PHI in the patient's designated record set
☐ Office / progress notes and chart
☐ Hospital / facility records (admission, discharge summaries)
☐ History and physical / consultation reports
☐ Operative and procedure reports
☐ Laboratory and pathology results
☐ Diagnostic imaging reports and films (X-ray, MRI, CT, ultrasound)
☐ Emergency department / ambulance / EMS records
☐ Physical therapy / rehabilitation records
☐ Pharmacy and medication records
☐ Billing statements and itemized charges
☐ Other: [________________________________]

5. PURPOSE OF DISCLOSURE

The PHI is disclosed for the following purpose: [DESCRIBE — e.g., "evaluation and prosecution of the patient's personal-injury claim," "at the request of the patient," or "legal representation in Civil Action No. ____"].

6. HIPAA REQUIRED STATEMENTS (45 C.F.R. § 164.508(c))

6.1 Expiration. This Authorization expires on the earliest of: (a) [__/__/____]; (b) the event of [________________________________]; or (c) if no date or event is stated, the final resolution of the personal-injury matter described in Section 5, or two (2) years after the date of signature, whichever occurs first.

6.2 Right to Revoke. I may revoke this Authorization at any time by delivering a written revocation to the Covered Entity's privacy officer at the address in Section 2. Revocation will not affect any action taken in reliance on this Authorization before the written revocation is received.

6.3 No Conditioning of Treatment. The Covered Entity may not condition treatment, payment, enrollment in a health plan, or eligibility for benefits on whether I sign this Authorization, except as permitted by 45 C.F.R. § 164.508(b)(4).

6.4 Redisclosure Notice. PHI disclosed under this Authorization may be redisclosed by the recipient and may then no longer be protected by HIPAA or District of Columbia law. Mental-health information, HIV/AIDS information, and 42 C.F.R. Part 2 substance-use records remain subject to the redisclosure restrictions noted in Section 7.

6.5 Copy of Authorization. I am entitled to a copy of this signed Authorization.

7. SPECIFICALLY PROTECTED CATEGORIES — SEPARATE AUTHORIZATION REQUIRED

I specifically authorize release of the following heightened-consent categories only where I have initialed:

D.C. Mental Health Information Act Notice (required by D.C. Code § 7-1201.04(b)): "The unauthorized disclosure of mental health information violates the provisions of the District of Columbia Mental Health Information Act of 1978 (D.C. Code §§ 7-1201.01 to 7-1207.02). Disclosures may only be made pursuant to a valid authorization by the client or as provided in the Act. The Act provides for civil damages and criminal penalties for violations." Upon disclosure of mental-health information, the Covered Entity must enter a notation in the client's record stating the date of disclosure, the recipient, and a description of the contents disclosed (D.C. Code § 7-1201.04(a)).

HIV / AIDS Notice (D.C. Code § 7-1605): Identifying information in HIV/AIDS records may not be disclosed without the prior written permission of the person to whom it pertains and is not discoverable or admissible in any civil or criminal action without that written permission.

42 C.F.R. Part 2 Notice: Substance-use-disorder records released under this Authorization are protected by federal law (42 C.F.R. Part 2). Federal rules prohibit the recipient from making any further disclosure unless permitted by 42 C.F.R. Part 2. A general authorization for the release of medical or other information is not sufficient for this purpose.

8. DISTRICT OF COLUMBIA COPY-FEE AND RESPONSE-TIME NOTE

Under D.C. Code § 3-1210.11, a health care entity having custody of a patient's personal medical record must, upon written request, furnish a complete and current copy of that record, and may charge a reasonable copying fee determined by the Board through rulemaking. D.C. Code § 3-1210.12 establishes the cost maximums a health care entity may charge for personal medical records (see the DC Health published fee schedule). Records must be retained for at least 5 years from the date of last contact for an adult and at least 5 years after a minor reaches the age of majority.

9. SIGNATURE AND PERSONAL-REPRESENTATIVE AUTHORITY

I have read and understand this Authorization. I am the patient/client or the patient's authorized personal representative (or "client representative" under D.C. Code § 7-1201.01(3)), and I sign voluntarily.

If signed by a personal / client representative:

10. NOTARY (OPTIONAL)

District of Columbia, ss:

Subscribed and sworn to before me this [____] day of [____________], 20[____].

______________________________
Notary Public
My commission expires: [__/__/____]

SOURCES AND REFERENCES

• 45 C.F.R. § 164.508 — HIPAA Authorization core elements: https://www.ecfr.gov/current/title-45/section-164.508
• 45 C.F.R. § 164.524 — Individual right of access (fees, 30-day response): https://www.ecfr.gov/current/title-45/section-164.524
• 42 C.F.R. Part 2 — Confidentiality of SUD patient records: https://www.ecfr.gov/current/title-42/part-2
• D.C. Code § 3-1210.11 — Patient or client records: https://code.dccouncil.gov/us/dc/council/code/sections/3-1210.11
• DC Health — Medical Records Fees (§ 3-1210.12 maximums): https://dchealth.dc.gov/page/medical-records-fees
• D.C. Code § 7-1201.01 — Mental Health Information Act definitions: https://code.dccouncil.gov/us/dc/council/code/sections/7-1201.01
• D.C. Code § 7-1201.04 — General rules governing disclosures; required statement: https://code.dccouncil.gov/us/dc/council/code/sections/7-1201.04
• D.C. Code § 7-1203.01 — Disclosures within a facility; progress notes: https://code.dccouncil.gov/us/dc/council/code/sections/7-1203.01
• D.C. Code § 7-1605 — Confidentiality of HIV/AIDS medical records: https://code.dccouncil.gov/us/dc/council/code/sections/7-1605