Statement of Policy
Washington University and its member organizations (collectively, “Washington University” or “WU”) are committed to conducting business in compliance with all applicable laws, regulations, and WU policies. As part of this commitment, WU has adopted this policy to define the circumstances under which written Authorization is required to Use or Disclose an Individual’s Protected Health Information (“PHI”).
Scope of Policy
The scope of this policy covers the uses and disclosures of patient medical records. For Research Authorizations, see policy on Use or Disclosure of Protected Health Information in Research. For Psychotherapy Notes Authorizations, see policy on Use or Disclosure of Psychotherapy Notes. For Fundraising Authorizations, see policy on Use or Disclosure of Protected Health Information in Fundraising. For Media Relations Authorizations, see policy on Use or Disclosure of Protected Health Information in Media Relations.
1) When an Authorization is Required
As a general rule, WU must obtain a specific, written Authorization from an Individual before Using or Disclosing the Individual’s PHI for all purposes other than Treatment, Payment or Health Care Operations or Uses and Disclosures required by law.
2) Authorization Requirements
A valid Authorization must:
a) Be written in plain language and signed and dated by the Individual (or, if signed by the Individual’s representative, it must additionally state that person’s authority or relationship to the Individual);
b) Provide a specific and meaningful description of the PHI to be Used or Disclosed;
c) Identify WU and/or the class of entities or persons authorized to make the Use or Disclosure of the PHI;
d) Identify specifically the person or class of persons who will receive the PHI;
e) Describe each purpose of the Use or Disclosure;
f) Indicate the Authorization’s expiration date or event (can be a specific date or a specific time period or event period);
g) State that the Individual may refuse to sign the Authorization;
h) State that the Individual has the right to revoke the Authorization in writing, including instructions as to how and where the Individual can complete such a revocation and the exceptions to the right to revoke and reference the Notice of Privacy containing instructions on how to revoke;
i) State that WU cannot condition Treatment, Payment, enrollment in the Health Plan, or eligibility for benefits on the Individual agreeing to sign the Authorization; and
j) State that the PHI, once it is Used or Disclosed pursuant to the Authorization, may no longer be protected by the privacy regulations.
See Exhibit A for an Authorization Form.
3) Procedural Requirements
a) WU must document in writing any request for Authorization and retain any signed Authorization for a period of six (6) years from the date that the Authorization was last in effect (the expiration date); and
b) Must provide the Individual with a copy of the signed Authorization.
4) General Rule: Compound Authorizations Prohibited
Generally, an Authorization cannot be combined into the same form with (i) the Covered Entity’s Notice of Privacy Practices, or (ii) any other form of written legal permission for Use or Disclosure of PHI.
Exception: An Authorization may be combined with another document giving permission to Use or Disclose PHI in the following situations:
a) Use/Disclosure of Psychotherapy Notes for multiple purposes may be combined into a single Authorization related strictly to Psychotherapy Notes. See WU HIPAA Policy on Use or Disclosure of Psychotherapy Notes;
b) An informed consent for research purposes.
5) General Rule: Prohibition on Conditioning Authorizations.
In general, WU is prohibited from conditioning Treatment, Payment or enrollment in a Health Plan or eligibility for benefits upon an Individual signing an Authorization.
a) WU may condition research-related Treatment on provision of an Authorization;
b) WU may condition Treatment to an Individual who is to be given Treatment at WU for the sole purpose of providing information to a third party (For example: insurance application pre-screening examinations) on the provision of an Authorization to Disclose the PHI to the third party;
c) A health plan may condition enrollment or eligibility for benefits on the provision of an Authorization if Authorization is for the purpose of determining eligibility for enrollment and is not for a Use or Disclosure of Psychotherapy Notes; or
d) A health plan may condition Payment of a claim for specified benefits on provision of an Authorization if Disclosure is necessary to determine payment of such claim and Authorization is not for Use or Disclosure of Psychotherapy Notes.
6) Revocation of Authorizations
Individuals may revoke their Authorizations at any time, in writing.
a) The Authorization was obtained as a condition of the Individual receiving insurance coverage;
b) WU has taken action in reliance upon the Authorization; or
c) The Authorization is necessary for research integrity and/or research reporting purposes.
7) Disclosure of Inpatient and Outpatient Psychiatric Records Pursuant to Authorization
WU shall only Disclose inpatient and outpatient psychiatric records or Psychotherapy Notes with a specific and valid Authorization or a valid court order.
8) Who May Sign the Authorization
A competent, adult Individual should always sign the Authorization to Use or Disclose his/her PHI. A person is competent if he/she has the general ability to understand the concept of the Use or Disclosure of his/her medical information.
a) If the Individual is competent, but physically unable to sign the Authorization, the person witnessing the form may write in “Patient unable to sign due to _______________. Patient gave verbal permission.” and then witness the form.
b) If the Individual is not conscious, coherent or is not competent for whatever reason, another person must sign the Authorization:
i) INDIVIDUALS UNDER COURT-ORDERED GUARDIANSHIP. If the representative has been appointed guardian by the court, the guardian may sign the Authorization on behalf of the Individual.
ii) AUTHORIZATION FROM RELATIVES. In those situations when the Individual is unconscious or unable to give his/her Authorization and does not have a court appointed guardian, WU may rely upon an Individual’s relatives to provide Authorization. Missouri and Illinois law recognize the following order as “next of kin” and this order should be followed whenever possible.
- Patient’s Guardian of the Person;
- Adult son or daughter;
- Either parent;
- Adult brother or sister;
- Any adult grandchild of the Individual;
- Relative by blood or marriage; or
- Any other person authorized to provide Authorization.
a) If the Individual is under 18 and: is not pregnant; does not already have children; is not emancipated from his/her parents; and/or the Treatment at issue is not related to pregnancy, drug abuse, or venereal disease, then the minor’s parents (or other legal guardian or person standing in the place of the parents (i.e., grandparent or adult sibling)) may sign the Authorization on behalf of the minor Individual; or
b) If the Individual is under 18 and: is pregnant; has had a child; is emancipated from his/her parents; and/or the treatment at issue is related to pregnancy, drug abuse, or venereal disease, then the minor may sign the Authorization on behalf of him/herself.
i) Any parent may sign for his minor child in his legal custody;
ii) Any minor who has been lawfully married and any minor parent or legal custodian of a child may sign for himself, his child and any child in his legal custody;
iii) Any minor may sign for himself in case of:
- Pregnancy, but excluding abortions;
- Venereal disease;
- Drug or substance abuse including those referred to in Chapter 195, RSMo;
iv) Any adult standing in loco parentis, whether serving formally or not, may sign for his minor charge in case of emergency as defined in section 431.063;
v) Any guardian of the person may sign for his ward;
vi) During the absence of a parent so authorized and empowered, any adult may sign for his minor brother or sister; or
vii) During the absence of a parent so authorized and empowered, any grandparent for his minor grandchild.
vii) “Absence” as used in (vi) and (vii) above shall mean absent at the time when further delay occasioned by an attempt to obtain consent may jeopardize the life, health or limb of the person affected, or may result in disfigurement or impairment of faculties.
c) Individuals Under Court-Ordered Guardianship. If the individual has been appointed a guardian by the court, the guardian may sign the Authorization on behalf of the Individual. The Authorization must state the guardian’s authority or relationship to the Individual.
Any person with the authority to act on the decedent’s behalf, or on behalf of the estate, may authorize the disclosure of the patient’s medical records in the same manner that an individual may authorize the disclosure of their own records. The “authority to act” is governed by state law. WU allows the spouse, child or parent of a deceased patient to authorize the disclosure of the patient’s PHI. All persons requesting access to or disclosure of records of a deceased patient must provide some proof of their relationship with the deceased (e.g., a marriage certificate, death certificate or birth certificate identifying the relationship). Any other person requesting the records the records of the deceased patient will be required to provide a court order or other document (such as a will or court order) showing their authority to act on the decedent’s behalf.
Creation Date: November 22, 2002
Effective Date: April 14, 2003
Last Revision Date: May 16, 2012