HIPAA Medical Release Rules

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) was enacted to provide privacy standards to protect individuals' medical information. This protected health information (PHI) is typically only accessible to persons other than the patient after a release authorization has been completed and submitted by the individual. The U.S. Department of Health and Human Services has established a set of guidelines to be followed before PHI disclosure authorization should be granted.

Identify PHI & Names

• Before PHI can be disclosed, the exact PHI to be released must be specified. This requirement limits the information that is released to the minimum amount necessary to fulfill the need for the disclosure. The specific names of the persons or organizations that are allowed to receive or use the PHI, as well as the names of those that are allowed to disclose the PHI, must also be stated.

Purpose

• The specific purpose of the request for PHI disclosure should be stated. Stating the purpose of the PHI disclosure aids in limiting the amount of information released to a minimum amount.

Signature

• The PHI disclosure authorization form should be dated and signed by either the individual or the personal representative of the individual. This signature represents that the individual fully understands and agrees to the disclosure.

Notifications

• The individual should be notified of their right to refuse to sign the form without the consequence of any adverse effects to their treatment, benefit eligibility or payment options. The individual should also be notified of their right to cancel the authorization at any time in writing.

Potential for Redisclosure

• The individual should be made aware that the PHI being shared has the potential to be redisclosed by the recipient. The shared information will no longer be protected by the Privacy Rule.

Who Must Comply

• The HIPAA Privacy Rule applies to health plans, health-care clearinghouses and health-care providers. Health plans include insurance companies, managed care organizations as well as government organizations. Health-care clearinghouses include billing services and repricing services as well as health information services. Health-care providers include any service that provides health care. All of these entities must comply with the HIPAA Privacy Rule and adhere to the PHI release guidelines.

Special Circumstances

• In certain situations, PHI disclosure authorization is not required. These situations may involve law enforcement operations, judicial proceedings, worker’s compensation claims and public health investigations. Other instances where authorization is not required are in situations involving abuse or neglect, domestic violence, organ donations or health research. PHI disclosures are also permitted if it is required by law--federal, state, local or tribal.