HIPAA Authorization for PHI Use or Disclosure

Summary

This template is used by an employer-sponsored group health plan to obtain the consent of an individual to authorize the plan's use or disclosure of the individual's protected health information (PHI), as may be required under the Health Insurance Portability and Accountability Act (HIPAA). The plan representative must complete this template before furnishing it to the individual for signature, provide a signed copy to the individual, and maintain a record of the authorization in accordance with 45 C.F.R. § 164.508(b)(6). This template is drafted for a group health plan, but can be modified for use by other types of HIPAA covered entities, such as a health service provider. The template contains drafting notes and an optional clause. HIPAA strictly limits on how, and for what purposes, covered entities (including many group health plans) can use or disclose PHI. PHI refers generally to health information collected, created, or handled by a covered entity that can be linked to an individual. Unless a use or disclosure is specifically permitted under the statute (e.g., PHI used for treatment, payment of benefits, or plan operations), the covered entity may only proceed after receiving the affected individual's authorization to do so, obtained in accordance with 45 C.F.R. § 164.508(c). For extensive coverage of important topics in the healthcare industry, see Healthcare Fundamentals Resource Kit. For a full listing of key content covering HIPAA considerations, see HIPAA Resource Kit. For more on health information privacy and security, see Health Information Privacy and Security Resource Kit. For more information on HIPAA Privacy Rule and Security Rule Compliance, see HIPAA Privacy, Security, Breach Notification, and Other Administrative Simplification Rules. For other PHI-related templates, see HIPAA Notice of Privacy Practices and HIPAA Request for Accounting of PHI Disclosures.