Oklahoma State University Center for Health Sciences
OSU-CHS Centernet

Privacy Policies & Procedures

Section 4 - Uses and Disclosures for Which an Authorization is Required

 

Title: Authorization Required: General Rule Policy: PRV-04.01
Category: HIPAA Compliance Authority: 45 CFR §
HIPAA Section:
164.508(a)
Standard: Authorizations for Uses and Disclosures Responsibility: Health Care Components
Effective Date: 04/14/2003
Download a printable PDF of this policy
Approved by: OSU Legal Counsel Revised: 7/1/2013
Purpose

To establish when an authorization is needed from an individual to use or disclose their protected health insurance.

Policy

Except as otherwise permitted or required by the Privacy Rule, OSU may not use or disclose protected health information without an authorization that is valid under this section. When OSU obtains or receives a valid authorization for its use or disclosure of protected health information, such use or disclosure must be consistent with such authorization.  §164.508(a)(1)

Procedure

OSU will seek to obtain valid authorizations when needed.  Such authorizations will be kept on file in the individuals medical record either on paper or electronically.

All authorizations may be revoked in writing using the Authorization Revocation Form or verbal revocation to a physician, who would then document the revocation.

Any use or disclosure of information that needs an authorization, but OSU does not have an authorization will be considered an inappropriate use or disclosure, and the steps for breach notification would then need to be followed.


top of page top

 

Title: Authorization Required: Psychotherapy Notes, Marketing, Sale of PHI Policy: PRV-04.02
Category: HIPAA Compliance Authority: 45 CFR §
HIPAA Section:
164.508(a)(2)
Standard: Authorizations for Uses and Disclosures Responsibility: Health Care Components
Effective Date: 04/14/2003
Download a printable PDF of this policy
Approved by: OSU Legal Counsel Revised: 7/1/2013
Purpose

To establish when an authorization is needed regarding Psychotherapy Notes, Marketing purposes and Sale of protected health information.

Policy

Psychotherapy Notes – Not withstanding any provision of the Privacy Rule, other than the transition provisions in §164.532, OSU must obtain an authorization for any use or disclosure of psychotherapy notes, except:  §164.508(a)(2)

  1. To carry out the following treatment, payment, or health care operations:  §164.508(a)(2)(i)
    1. Use by the originator of the psychotherapy notes for treatment;  §164.508(a)(2)(i)(A)
    2. Use or disclosure by OSU for its own training programs in which students, trainees, or practitioners in mental health learn under supervision to practice or improve their skills in group, joint, family, or individual counseling; or  §164.508(a)(2)(i)(B)
    3. Use or disclosure by OSU to defend itself in a legal action or other proceeding brought by the individual; and  §164.508(a)(2)(i)(C)
  2. A use or disclosure that is required by § 164.502(a)(2)(ii) Required Disclosures or permitted by § 164.512(a) Uses and Disclosures Required by Law; § 164.512(d) Uses and Disclosures for Health Oversight Activities with respect to the oversight of the originator of the psychotherapy notes; § 164.512(g)(1) Uses and Disclosures about Decedents; or § 164.512(j)(1)(i) Uses and Disclosures to avert a serious threat to health or safety.

 

Marketing – Notwithstanding any provision of the Privacy Rule, other than the transition provisions in §164.532, OSU must obtain an authorization for any use or disclosure of protected health information for marketing, except if the communication is in the form of:  §164.508(a)(3)(i)

  1. A face-to-face communication made by OSU to an individual; or  §164.508(a)(3)(i)(A)
  2. A promotional gift of nominal value provided by OSU.  §164.508(a)(3)(i)(B)

If the marketing involves financial remuneration, as defined in paragraph 3 of the definition of marketing in policy PRV-00.01 or §164.501, to OSU from a third party, the authorization must state that such remuneration is involved.  §164.508(a)(3)(ii)

Sale of Protected Health Information – Not withstanding any provision of the Privacy Rule, other than the transition provisions in §164.532, OSU must obtain an authorization for any disclosure of protected health information which is a sale of protected health information, as defined in §164.501 of the Privacy Rule.  §164.508(a)(4)(i)

Such authorization must state that the disclosure will result in remuneration to OSU.  §164.508(a)(4)(ii)

Procedure

OSU will not use or disclose psychotherapy notes of an individual other than as stated above.  OSU does have a Behavioral Health Department, and although it is not their practice to actively collect information that would meet the definition of psychotherapy notes, if any such information does exist, any authorization needed to use or disclose will be obtained.

OSU does not use any individuals protected health information for marketing purposes and also does not sell protected health information for remuneration of any kind.  If any agent or department of OSU decides to market or sell PHI, the agent or department will adhere to the above stated policy.


top of page top

 

Title: General Requirements Policy: PRV-04.03
Category: HIPAA Compliance Authority: 45 CFR §
HIPAA Section:
164.512(i)
Standard: Authorizations for Uses and Disclosures Responsibility: Health Care Components
Effective Date: 04/14/2003
Download a printable PDF of this policy
Approved by: OSU Legal Counsel Revised: 7/1/2013
Purpose

To establish the general requirements for authorizations regarding individuals and their medical information.

Policy

Valid Authorizations – A valid authorization is a document that meets the requirements of Marketing Authorizations, Sale of Protected Health Information Authorizations, and contains the core elements and requirements (PRV-04.04) as applicable.  §164.508(b)(1)(i)

A valid authorization may contain elements or information in addition to the elements required by §164.508, provided that such additional elements or information are not inconsistent with the elements required by §164.508.  §164.508(b)(1)(ii)

Defective Authorizations – An authorization is not valid, if the document submitted has any of the following defects:  §164.508(b)(2)

  1. The expiration date has passed or the expiration event is known the OSU to have occurred;  §164.508(b)(2)(i)
  2. The authorization has not been filled out completely, with respect to an element described by the “Core Elements and Requirements” of authorizations, if applicable;  §164.508(b)(2)(ii)
  3. The authorization is known by OSU to have been revoked;  §164.508(b)(2)(iii)
  4. The authorization violates Compound Authorizations or Prohibition on conditioning of authorizations, if applicable; §164.508(b)(2)(iv)
  5. Any material information in the authorization is known by OSU to be false.  §164.508(b)(2)(v)

 

Compound Authorizations – An authorization for use or disclosure of protected health information may not be combined with any other document to create a compound authorization, except as follows:  §164.508(b)(3)

  1. An authorization for the use or disclosure of protected health information for a research study may be combined with any other type of written permission for the same or another research study. This exception includes combining an authorization for the use or disclosure of protected health information for a research study with another authorization for the same research study, with an authorization for the creation or maintenance of a research database or repository, or with a consent to participate in research. Where a OSU health care provider has conditioned the provision of research-related treatment on the provision of one of the authorizations, as permitted under paragraph (b)(4)(i) Prohibition on conditioning of authorizations of this section, any compound authorization created under this paragraph must clearly differentiate between the conditioned and unconditioned components and provide the individual with an opportunity to opt in to the research activities described in the unconditioned authorization.  §164.508(b)(3)(i)
  2. An authorization for a use or disclosure of psychotherapy notes may only be combined with another authorization for a use or disclosure of psychotherapy notes.  §164.508(b)(3)(ii)
  3. An authorization under this section, other than an authorization for a use or disclosure of psychotherapy notes, may be combined with any other such authorization under this section, except when OSU has conditioned the provision of treatment, payment, enrollment in the health plan, or eligibility for benefits under paragraph (b)(4) Prohibition on conditioning of authorizations of this section on the provision of one of the authorizations. The prohibition in this paragraph on combining authorizations where one authorization conditions the provision of treatment or payment under paragraph (b)(4) Prohibition on conditioning of authorizations  of this section does not apply to a compound authorization created in accordance with paragraph 1 of this section of this policy.  §164.508(b)(3)(iii)

Prohibition on Conditioning of Authorizations – OSU may not condition the provision to an individual of treatment, payment or eligibility of benefits on the provision of an authorization, except;  §164.508(b)(4)

  1. An OSU health care provider may condition the provision of research-related treatment on provision of an authorization for the use or disclosure of protected health information for such research under this section;  §164.508(b)(4)(i)
  2. The authorization is not for a use or disclosure of psychotherapy notes under paragraph policy PRV-04.02; and  §164.508(b)(4)(ii)(B)
  3. OSU may condition the provision of health care that is solely for the purpose of creating protected health information for disclosure to a third party on provision of an authorization for the disclosure of the protected health information to such third party.  §164.508(b)(4)(iii)

Revocation of Authorizations – An individual may revoke an authorization provided under this section of policies PRV-04.XX at any time, provided that the revocation is in writing, except to the extent that:  §164.508(b)(5)

  1. OSU has taken action in reliance thereon; or  §164.508(b)(5)(i)
  2. If the authorization was obtained as a condition of obtaining insurance coverage, other law provides the insurer with the right to contest a claim under the policy or the policy itself.  §164.508(b)(5)(ii)

Documentation – OSU must document and retain any signed authorization under these authorization policies (PRV-04.XX) as required by §164.530(j) Documentation§164.508(b)(6)

Procedure
  • OSU faculty and staff will follow the above policy in regards to authorizations.
  • OSU faculty and staff will document all authorizations and place such authorizations in the patient’s medical record.  If a paper document exists, it will be scanned into the Electronic Health Records system
  • OSU employees working with individuals to authorize or release information shall use the Authorization/Revocation Form.  This form shall also be used when an individual wishes to revoke an existing valid authorization.
  • The authorization/revocation form is to be completed in its entirety before any authorization is to be recognized as valid.
  • Research is the only department allowed to do compound authorizations, and must follow the policy above.

 


top of page top

 

Title: Core Elements and Requirements Policy: PRV-04.04
Category: HIPAA Compliance Authority: 45 CFR §
HIPAA Section:
164.508(c)
Standard: Uses and Disclosures for Which an Authorization is Required Responsibility: Health Care Components
Effective Date: 04/14/2003
Download a printable PDF of this policy
Approved by: OSU Legal Counsel Revised: 7/1/2013
Purpose

To identify the required elements of what must be in a valid authorization.

Policy

Core Elements – A valid authorization under the Privacy Rule must contain at least the following elements:  §164.508(c)(1)

  1. A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion.  §164.508(c)(1)(i)
  2. The name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure.  §164.508(c)(1)(ii)
  3. The name or other specific identification of the person(s), or class of persons, to whom OSU may make the requested use or disclosure.  §164.508(c)(1)(iii)
  4. A description of each purpose of the requested use or disclosure. The statement “at the request of the individual” is a sufficient description of the purpose when an individual initiates the authorization and does not, or elects not to, provide a statement of the purpose.  §164.508(c)(1)(iv)
  5. An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure. The statement “end of the research study,” “none,” or similar language is sufficient if the authorization is for a use or disclosure of protected health information for research, including for the creation and maintenance of a research database or research repository.  §164.508(c)(1)(v)
  6. Signature of the individual and date. If the authorization is signed by a personal representative of the individual, a description of such representative's authority to act for the individual must also be provided.  §164.508(c)(1)(vi)

Required Statements - In addition to the core elements, the authorization must contain statements adequate to place the individual on notice of all of the following:  §164.508(c)(2)

  1. The individual’s right to revoke the authorization in writing, and either:  §164.508(c)(2)(i)
    1. The exceptions to the right to revoke and a description of how the individual may revoke the authorization; or  §164.508(c)(2)(i)(A)
    2. To the extent that the information in the above paragraph of this policy is included in the notice required by §164.520 Notice of Privacy Practices, a reference to the covered entity's notice.  §164.508(c)(2)(i)(B)
  2. The ability or inability to condition treatment, payment, enrollment or eligibility for benefits on the authorization, by stating either:  §164.508(c)(2)(ii)
    1. OSU may not condition treatment, payment, enrollment or eligibility for benefits on whether the individual signs the authorization when the prohibition on conditioning of authorizations in policy PRV-04.03 of this section applies; or  §164.508(c)(2)(ii)(A)
    2. The consequences to the individual of a refusal to sign the authorization when, in accordance with policy PRV-04.03 of this section, OSU can condition treatment, enrollment in the health plan, or eligibility for benefits on failure to obtain such authorization.  §164.508(c)(2)(ii)(B)
  3. The potential for information disclosed pursuant to the authorization to be subject to redisclosure by the recipient and no longer be protected by the Privacy Rule.  §164.508(c)(2)(iii)

Plain Language Requirement – The authorization must be written in plain language.  §164.508(c)(3)

Copy to the Individual - If OSU seeks an authorization from an individual for a use or disclosure of protected health information, OSU must provide the individual with a copy of the signed authorization.  §164.508(c)(4)

Procedure

OSU will ensure its authorization forms are in compliance with this policy and have all the required elements.

Any changes to the authorization forms need to be checked against this policy to ensure the forms meet the standards required.

If an individual refuses to sign an authorization, in accordance with policy PRV-04.03, OSU may possibly refuse to treat the individual, this should be looked at on a case by case basis, and ultimately the decision to treat or not treat the patient is left to the discretion of the attending physician.

If an individual refuses to sign an authorization for a research study, that individual shall not be included in the research study.

Upon the individual signing an authorization, the OSU employee will immediately copy the signed form and give the copy to the individual.  OSU shall retain the original signed form.  Failure to provide a signed copy to the individual will be a violation of this policy and sanctions will be imposed on the employee.  If the individual refuses the signed copy, the employee shall conspicuously document such refusal so as to not be in violation of this policy.


top of page top

 

 

 

 

OSU-CHS on Facebook OSU-CHS on Twitter OSU Medicine on You Tube