Medical Records Authorization (HIPAA) - Idaho

AUTHORIZATION FOR RELEASE OF PROTECTED HEALTH INFORMATION (HIPAA) — IDAHO

This Authorization for Release of Protected Health Information (this "Authorization") is executed under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations at 45 C.F.R. Parts 160 and 164 (collectively, "HIPAA"), and, to the extent not preempted, the laws of the State of Idaho.

1. PATIENT IDENTIFICATION

2. PROVIDER(S) AUTHORIZED TO RELEASE INFORMATION

I authorize the following health-care provider(s), facility(ies), hospital(s), clinic(s), pharmacy(ies), laboratory(ies), and health plan(s) (each a "Provider" or "Covered Entity") to release my Protected Health Information ("PHI") as described below:

3. RECIPIENT(S) AUTHORIZED TO RECEIVE INFORMATION

4. SPECIFIC RECORDS AND DATE RANGE

Date range of records requested: From [__/__/____] to [__/__/____], or ☐ all dates of service.

Mark each record type to be released:

☐ All PHI in the patient's designated record set
☐ Office / progress notes and chart
☐ Hospital / facility records (admission, discharge summaries)
☐ History and physical / consultation reports
☐ Operative and procedure reports
☐ Laboratory and pathology results
☐ Diagnostic imaging reports and films (X-ray, MRI, CT, ultrasound)
☐ Emergency department / ambulance / EMS records
☐ Physical therapy / rehabilitation records
☐ Pharmacy and medication records
☐ Billing statements and itemized charges
☐ Other: [________________________________]

5. PURPOSE OF DISCLOSURE

The PHI is disclosed for the following purpose: [DESCRIBE — e.g., "evaluation and prosecution of the patient's personal-injury claim," "at the request of the patient," or "legal representation in Case No. ____"].

6. HIPAA REQUIRED STATEMENTS (45 C.F.R. § 164.508(c))

6.1 Expiration. This Authorization expires on the earliest of: (a) [__/__/____]; (b) the event of [________________________________]; or (c) if no date or event is stated, the final resolution of the personal-injury matter described in Section 5, or two (2) years after the date of signature, whichever occurs first.

6.2 Right to Revoke. I may revoke this Authorization at any time by delivering a written revocation to the Provider's privacy officer at the address in Section 2. Revocation will not affect any action taken in reliance on this Authorization before the written revocation is received.

6.3 No Conditioning of Treatment. The Provider may not condition treatment, payment, enrollment in a health plan, or eligibility for benefits on whether I sign this Authorization, except as permitted by 45 C.F.R. § 164.508(b)(4).

6.4 Redisclosure Notice. PHI disclosed under this Authorization may be redisclosed by the recipient and may then no longer be protected by HIPAA or Idaho law. Mental-health records, HIV information, and 42 C.F.R. Part 2 substance-use records remain subject to the redisclosure restrictions noted in Section 7.

6.5 Copy of Authorization. I am entitled to a copy of this signed Authorization.

7. SPECIFICALLY PROTECTED CATEGORIES — SEPARATE AUTHORIZATION REQUIRED

I specifically authorize release of the following heightened-consent categories only where I have initialed:

Mental-Health Records Notice (Idaho Code § 66-348): Records made for the purposes of Idaho's mental-health hospitalization act that directly or indirectly identify a patient may be disclosed only with the consent of the individual, the individual's attorney-in-fact for mental-health care, or the individual's legal guardian, or as otherwise permitted by statute or court order.

Part 2 warning: Initialing this general authorization does not itself create a consent that satisfies 42 C.F.R. § 2.31. Use a standalone consent containing every applicable current § 2.31 element. If the records will be used or disclosed in a civil, criminal, administrative, or legislative investigation or proceeding, § 2.31(d) prohibits combining that consent with a consent for any other purpose. Each disclosure made under a valid consent must also carry one of the notices permitted by § 2.32(a) and a copy of the consent or a clear explanation of its scope under § 2.32(b).

8. IDAHO COPY-FEE AND RESPONSE-TIME NOTE

Idaho has no single statute setting a uniform patient-access copy fee or response deadline for private health-care providers; accordingly, the HIPAA individual-access rule (45 C.F.R. § 164.524) governs: a Covered Entity must act on an access request within 30 days (with one 30-day extension on notice) and may charge only a reasonable, cost-based fee for labor, supplies, and postage. Idaho Code § 39-1394 governs hospital patient-care record retention (e.g., clinical-laboratory test records and X-ray films may be destroyed five years after the test/exposure, subject to conditions) and authentication of orders.

9. SIGNATURE AND PERSONAL-REPRESENTATIVE AUTHORITY

I have read and understand this Authorization. I am the patient or the patient's authorized personal representative, and I sign voluntarily.

If signed by a personal representative:

10. NOTARY (OPTIONAL)

State of Idaho, County of [________________________________]

Subscribed and sworn to before me this [____] day of [____________], 20[____].

______________________________
Notary Public
My commission expires: [__/__/____]

SOURCES AND REFERENCES

• 45 C.F.R. § 164.508 — HIPAA Authorization core elements: https://www.ecfr.gov/current/title-45/section-164.508
• 45 C.F.R. § 164.524 — Individual right of access (fees, 30-day response): https://www.ecfr.gov/current/title-45/section-164.524
• 42 C.F.R. Part 2 — Confidentiality of SUD patient records: https://www.ecfr.gov/current/title-42/part-2
• Idaho Code § 39-1394 — Patient care records; retention; authentication: https://law.justia.com/codes/idaho/title-39/chapter-13/section-39-1394/
• Idaho Code § 66-348 — Disclosure of mental-health information: https://law.justia.com/codes/idaho/title-66/chapter-3/section-66-348/
• Idaho Code §§ 39-602, 39-610 — HIV reporting and confidentiality: https://legislature.idaho.gov/statutesrules/idstat/Title39/T39CH6/