Policy
Except as expressly permitted by applicable law (as reflected in applicable policies), PHI shall not be used or disclosed without a valid authorization from the client . The term "authorization" as used in this policy means a form that meets all the requirements of the Privacy Standards.

Procedure

1. Content of Authorization

1.1 A valid authorization will contain the following elements:

1.1.1 A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion

1.1.2 The specific name or other specific identification of the person(s), or class of persons, authorized to provide the information

1.1.3 The name or other specific identification of the person(s), or class of persons, or organization authorized to receive the information

1.1.4 A description of the purpose of the use or disclosure

1.1.5 An expiration date or an expiration event

1.1.6 Signature of the client and date (If a personal representative rather than the client/parent/guardian signs the authorization, the authorization must specify how the representative is authorized to act for the client.)

1.1.7 A statement about the client's right to revoke the authorization in writing and the exceptions to the right to revoke and a description of how the individual may revoke the authorization.

1.1.8 A statement that Christine Randle may not refuse to treat the client if the client refuses to sign the authorization, except for the provision of research-related treatment or if the purpose of the treatment is solely to create PHI for disclosure to a third party (e.g., a fitness for duty evaluation)

1.1.9 A statement about the potential, if any, for the information to be re-disclosed by the recipient of the information and no longer be protected. Under Federal law, substance abuse treatment information may not be re-disclosed unless the client consents in writing to re-disclosure by the recipient of the information

1.2 The authorization may contain additional elements as long as they do not contradict the required elements.

2. Invalid Authorizations. An authorization is invalid if any of the following apply:

2.1 The expiration date has passed or the expiration event has occurred

2.2 A required element is not filled out completely

2.3 The authorization is known to have been revoked

2.4 The authorization conditions the provision of treatment on signing the authorization, unless otherwise permitted as described above

2.5 The authorization requires the client to waive his or her rights under the Privacy Standards as a condition of receiving treatment

2.6 The authorization is combined with any other document, except another authorization for use or disclosure of PHI

2.7 Any material information in the authorization is known by the Covered Entity to be false

3. Additional Requirements

3.1 The authorization must be written in plain language

3.2 Any authorization for use or disclosure of PHI that is signed by the client shall be retained in the patient/client's record

3.3 A copy must be given to the client (except where the client furnishes the authorization form)

4. Compound and Multi-Party Authorizations

4.1 An authorization may be combined with another authorization to create a compound authorization except a) authorizations for use or disclosure of psychotherapy notes may be combined only with another authorization for psychotherapy notes and b) if one of the authorizations is conditional and the other is not, they may not be combined.

4.2 An authorization cannot be combined with any other type of document such as a notice of privacy practices except that a research authorization may be combined with any other type of written permission for the same research study

4.3 A multi-party authorization is permissible if the information to be disclosed and the purpose for the disclosure are the same for all parties. However, if the client revokes the authorization for one party, the entire multi-party authorization is revoked.

5. Effect of Prior Authorization. PHI that was created or received prior to April 14, 2003, may be used or disclosed based on an authorization that was signed prior to April 14, 2003 as long as the authorization is otherwise valid (e.g., not expired, addresses the disclosure).

References
45 C.F.R. §164.508