Health Information Compliance Alert

You Be The Security Officer:

Set Clear Policy Regarding Time Frames for Authorization

Question: Your patient signs an authorization form in May permitting release of personal health information (PHI) to her attorney. However, her attorney requests a copy of the patient's medical records in November. Will the covered entity have to obtain another signed authorization form from the patient?

Answer: It depends upon the policy of the organization and whether the request 6 months later matches the original release, according to Ester Horowitz, CMC, CITRMS, CIISA. "To the best of my knowledge time frames within a calendar year are not stipulated in the regs," she adds. "However a health enterprise can set policy on it as long as the policy is clearly conveyed to all parties necessary and required."

Best practice: Standard documentation practice requires that any authorization form should have a date with the signature for it to be valid. As Horowitz points out, if the original document set an end date and the request fell within it, there really should not be any issues.