Neurology & Pain Management Coding Alert

Make sure your authorization to disclose PHI hasn't expired One year ago, your patient signed an authorization permitting the release of protected health information (PHI) to his employer. Today, you receive a request from the employer asking for information regarding the patient's most recent office visit. Can the office release the information to the employer? "Absolutely not," says Betty Thompson, office manager at the Capital Medical Center in Olympia, Wash. The patient's authorization has expired because the signature is only good for information from the date of signing backward, not for future information, according to Thompson. In general, "the authorization can't be forever," says Marvel J. Hammer, RN, CPC, CCS-P, CHCO, owner of MJH Consulting in Denver. An authorization generally has to have an expiration date or an expiration event, and the event must have some sort of relationship to the individual or the reason why the authorization is needed, says Elizabeth C. Stone, JD, of von Briesen & Roper in Madison, Wis. For example, Stone says, if the authorization were for PHI release for litigation, the expiration event could be the "end of the litigation." In the case mentioned above, the authorization could have a specific expiration date ("Jan. 1, 2007," or "one year from the date of signature") or an expiration event, such as the employer's fitness-for-duty determination. Of course, patients have the right to revoke most authorizations at any time, says Rebecca L. Williams, RN, JD, partner and co-chair of the HIT/HIPAA practice group of Davis Wright Tremaine LLP in Seattle. Therefore, you need to have some way to track the authorizations. Note This Expiration Exception Authorization for research purposes is a specific circumstance in which PHI approval does not need to have an expiration event or date. For example, on its Web site http://vpf-web.harvard.edu/osr/support/sup_tra_regs_hipaa_path.shtml#1, Harvard University Research Administration states: "Unlike other authorizations, one for a research purpose may state that the authorization does not expire, that there is no expiration date or event, or that the authorization continues -until the end of the research study.- " The section continues, "An authorization for a research purpose may be combined with a consent form to participate in a study, or with any other legal permission related to the research study. This way, a research subject will sign only one form." Overlooking State Law Could Cost You One other point to remember is that the PHI consent has to comply not only with HIPAA but also with any other state law that applies. If the state privacy laws are more stringent, then they take precedence, Hammer says. Example: If an authorization is drafted that is compliant with HIPAA, and its expiration date occurs one-and-a-half years after the patient [...]