HIPAA Authorization Requirements

The Health Insurance Portability and Accountability Act (HIPPA) has several laws geared toward protecting patient medical information. The Privacy Law under HIPAA details the requirements for health care professionals in obtaining patient authorization to view medical records. Violations of this law can result in hospital fines and the loss of employment.

Patient Consent to View Records

• Under HIPAA regulations, medical personnel are required to obtain a patient's authorization in writing to view his medical records. This requirement is in place to protect a patient's confidentiality and limit the number of health care personnel able to view records. Exceptions apply to this requirement when a health care professional has a medically relevant reason to view a patient's records such as an emergency room setting, in diagnosis of a current illness, checking for possible medicinal allergies, or if the patient is incapacitated and unable to give other vital information relating to his medical history.

Elements of Authorization

• Requests for authorization to view patient medical records are required to include detailed descriptions relating to the specific medical information to be used and made known, to whom the patient's information is being disclosed, the purpose for disclosure of medical information and an expiration date after which the medical entity no longer has authorization to view the information. Authorization may not be used as a condition of providing medical treatment or granting medical coverage.

Authorization Versus Consent

• The HIPAA Privacy Rule allows covered health care entities to design a system of obtaining patient consent to view medical records that best suit them. According to the U.S. Department of Health and Human Services, patient consent to view records may be given verbally when viewing of medical records is in the normal scope of diagnosing and treating an illness or injury. Authorization is necessary any time the patient's medical records are being transmitted or viewed to a third party, which can include health insurance companies and third party medical billing firms.