System shall obtain an Individual’s written Authorization before requesting, Using or Disclosing the Individual’s PHI when such request, Use or Disclosure is not permitted by the HIPAA Privacy Standards without an Authorization.
4.11(1) Obtaining an Individual’s Written Authorization
Except as otherwise provided in this Manual, System shall obtain an Individual’s signed, written Authorization before requesting, Using, or Disclosing the Individual’s PHI in situations when the intended request, Use or Disclosure is not otherwise permitted by the HIPAA Privacy Standards. System’s Authorization for the Use and Disclosure of Protected Health Information form, a copy of which is attached as a Form in the Appendix to this Manual and which contains the elements required by the HIPAA Privacy Standards, or another specific form for specific circumstances shall be used whenever possible to ensure that the Authorization is valid An Individual may, but is not required to initiate an Authorization to obtain the Individuals PHI or to direct the release of PHI to a third party, in which case the Individual shall not be required to reveal the purpose of the requested Use or Disclosure.
4.11(2) Personal Representative
In accordance with Section 4.12 of this Manual, an Individual’s Personal Representative has the authority to give and revoke Authorizations on behalf of the Individual.
4.11(3) Provision of Copies to the Individual
System shall provide each Individual with a copy of any signed Authorization received on behalf of the Individual by System provided that the specific Authorization is adequately identified in the request. System will not comply with global requests for all Authorizations received concerning a particular Individual, except as part of a Individual’s request for access to PHI or provision of access to a third party on behalf of the Individual’s PHI made in accordance with Section 7.2 of this Manual.
4.11(4) Reliance on an Authorization
Prior to Using, or Disclosing PHI in reliance on an Authorization, the Privacy Officer or a Privacy Officer’s designee shall review the Authorization to ensure that:
Upon receipt of a valid Authorization, the Authorization shall be filed with the Individual’s Designated Record Set, in accordance with Section 9.2 of this Manual.
4.11(5) Contents of an Authorization
An Authorization, to be valid, must contain all of the following elements written in plain and understandable language:
4.11(6) Revocation of an Authorization
An Individual shall have the right to revoke his or her Authorization at any time, provided that the Individual’s revocation is in writing. The revocation is effective upon its receipt by the Privacy Officer. A System form Revocation of Authorization, a copy of which is contained in the Appendix to this Manual, may be used by the Individual. When the Privacy Officer receives an Individual’s written revocation the Privacy Officer shall notify applicable parties of the revocation of Authorization and document the revocation or information concerning the revocation received by the person obtaining the authorization. System shall stop Using and Disclosing the Individual’s PHI in reliance on the Authorization, except to the extent System has already taken action in reliance on the Authorization. If System has not yet Used or Disclosed the PHI, System shall refrain from doing so, pursuant to the revocation. If EGI has already Disclosed the information, System need not retrieve the information. Notwithstanding the above, if an Authorization is obtained as a condition of obtaining insurance coverage under a policy or certificate, a revocation of the Authorization shall not be effective to the extent any law provides an insurer with the right to contest either a claim under the policy or certificate or the policy or certificate itself and the revocation would cause Uses or Disclosures for such purpose to be prohibited.
4.11(7) Conditioning Activities on the Provision of an Authorization
The provision of Treatment, Payment, health plan enrollment, or eligibility for health plan benefits may not be conditioned on an Individual’s provision of an Authorization, except as follows:
4.11(8) Combining Authorizations.
An Authorization may not be combined with any other document, except as follows:
4.11(9) Retention of Authorizations
System shall maintain any written Authorization, or the electronic record of any Authorization, that it receives in accordance with Section 9.2 of this Manual.
45 C.F.R. §§ 164.508, 164.532