Health Information Compliance Alert

Published on Thu Jan 28, 2010 PDF

How to make sure your authorization hasn't expired

One year ago, your patient signed an authorization permitting the release of protected health information (PHI) to his employer. Today, you receive a request from the employer asking for information regarding the patient's most recent office visit. Can the office release the information to the employer?

"Absolutely not," says Betty Thompson, office manager at the Capital Medical Center in Olympia, Wash. The patient's authorization has expired, because the signature is only good for information from the date of signing backward, not for future information, she says.

In general, "The authorization can't be forever," says Marvel J. Hammer, RN, CPC, CCS-P, CHCO, owner of MJH Consulting in Denver. An authorization generally has to have an expiration date or an expiration event, and the event must have some sort of relationship to the individual or the reason why the authorization is needed, says Elizabeth C. Stone, JD, of von Briesen & Roper in Madison, WI.

For example, Stone says, if it were an authorization for release of PHI for litigation, the expiration event could be the "end of the litigation." In the case mentioned above, the authorization could have a specific expiration date ("Jan. 1, 2011" or "one year from the date of signature") or an expiration event, such as the employer's fitness-for-duty determination.

Of course, patients have the right to revoke most authorizations at any time, says Rebecca L. Williams, RN, JD, partner and co-chair of the HIT/HIPAA practice group of Davis Wright Tremaine in Seattle. Therefore, you need to have some way to track the authorizations.

Authorization for research purposes is a specific circumstance in which PHI approval does not need to have an expiration event or date. For example, on its Web site (http://vpfweb.harvard.edu/osr/support/sup_tra_regs_hipaa_path.shtml#1) Harvard University Research Administration states, "Unlike other authorizations, one for a research purpose may state that the authorization does not expire, that there is no expiration date or event, or that the authorization continues 'until the end of the research study.'"

The section continues, "An authorization for a research purpose may be combined with a consent form to participate in a study, or with any other legal permission related to the research study. This way, a research subject will sign only one form."

One other point to remember is that the PHI consent has to comply not only with Health Insurance Portability and Accountability Act (HIPAA) but also with any other state law that applies.

If the state privacy laws are more stringent, then they take precedence, Hammer says.

For example, if an authorization is drafted that is compliant with HIPAA, and its expiration date occurs one and a half years after the patient signs, but state law only allows authorizations to be valid for one year, then the state law takes precedence, Stone says. Therefore, you should ensure that your authorization complies with the applicable state law as well as with HIPAA.

In addition, the time limit under state law may differ depending on the purpose of the authorization, Williams says.

For example, the state law may allow an authorization for disclosures for payment purposes to have a different termination period than an authorization for different purposes. Also, if you are dealing in multiple state jurisdictions, then you also need to comply with each set of state laws, Williams says.