Opinion ID: 2741507
Heading Depth: 2
Heading Rank: 2

Heading: Disclosure by Express Authorization

Text: Disclosure of protected health information is also permissible when a person signs a valid written authorization. Id. § 164.508. A valid authorization, alone, is sufficient to permit disclosure in compliance with HIPAA, so long as “such use or disclosure [is] consistent with such authorization.” Id. The HIPAA regulations specify that, to be valid, an authorization must contain these elements: (1) “[a] description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion”; (2) “[t]he name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure”; (3) “[t]he name or other specific identification of the person(s), or class of persons, to whom the covered entity may make the requested use or disclosure”; (4) “[a] description of each purpose of the requested use or disclosure”; (5) “[a]n expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure”; and (6) the “[s]ignature of the individual and date.” Id. § 164.508(c)(1)(i)-(vi). Further, “the authorization must contain statements adequate to place the individual on notice of all of the following:” (1) the individual’s “right to revoke,” the exceptions to the right to revoke, and “a description of how the individual may revoke”; (2) that a covered entity “may not condition treatment, payment, 18 Case: 13-14637 Date Filed: 10/10/2014 Page: 19 of 36 enrollment or eligibility for benefits on whether the individual signs the authorization,” subject to narrow exceptions; and (3) “the potential for information disclosed pursuant to the authorization to be subject to redisclosure by the recipient and no longer be protected by [HIPAA].” Id. § 164.508(c)(2), (b)(4). In short, the HIPAA regulations mandate that an authorization contain many different elements in order to be a valid authorization. The authorization form required by § 766.1065 must have those same HIPAA elements to be valid too. The HIPAA regulations also set forth circumstances when a written authorization is invalid, specifically: (1) “[t]he expiration date has passed or the expiration event is known by the covered entity to have occurred”; (2) “[t]he authorization has not been filled out completely, with respect to [each element required]”; (3) “[t]he authorization is known by the covered entity to have been revoked”; (4) the authorization is a compound authorization or is a condition for receiving treatment (and neither exception is applicable); or (5) “[a]ny material information in the authorization is known . . . to be false.” Id. § 164.508(b)(2). The HIPAA regulations explain that a “compound authorization,” subject to exceptions not at issue here, is an authorization for the disclosure of protected health information that is “combined with any other document to create a compound authorization.” Id. § 164.508(b)(3). The Secretary gave this example of a compound authorization: an authorization for the use or disclosure of 19 Case: 13-14637 Date Filed: 10/10/2014 Page: 20 of 36 protected health information “may be combined with an informed consent to receive treatment, [or] a consent to assign payment of benefits to a provider.” Standards for Privacy of Individually Identifiable Health Information, 65 Fed. Reg. 82,462, 82,511 (Dec. 28, 2000). Further, as part of a larger modification of the HIPAA regulations, the Secretary stated that a compound authorization is created when “an authorization for the use and disclosure of protected health information is combined with any other legal permission.” Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules, 78 Fed. Reg. 5565, 5609 (Jan. 25, 2013). Citing the fact that the use of multiple authorization forms has confused patients, the Secretary permitted the use of compound authorization forms under certain circumstances. Id. at 5609-11. The Secretary’s statements elucidate the HIPAA regulations’ circular definition of “compound authorization,” clarifying that the regulation prohibits the combination of an authorization with another “legal permission”—such as a consent to treatment or consent to assign payment— not its combination with literally “any other document.” The exceptions to the compound authorization prohibition also inform this conclusion. See 45 C.F.R. § 164.508(b)(3)(i)-(iii). The first exception permits an authorization for disclosure of health information for a research study to be combined with another authorization for the same or another study. Id. 20 Case: 13-14637 Date Filed: 10/10/2014 Page: 21 of 36 § 164.508(b)(3)(i). The second exception authorizes a compound authorization for the use or disclosure of psychotherapy notes. Id. § 164.508(b)(3)(ii). The third exception allows an authorization—other than an authorization for use or disclosure of psychotherapy notes—to be combined with any other such authorization, unless the covered entity has conditioned treatment or enrollment in a health care plan on the provision of an authorization. Id. § 164.508(b)(3)(iii). Notably, each exception discusses an authorization combined with another authorization—not an authorization combined with a wholly different type of document, such as a presuit notice.