PURPOSE

The purpose of this Policy is to set forth the Agency’s process for the use and disclosure of Protected Health Information (“PHI”) pursuant to a written authorization.

POLICY

In accordance with the HIPAA Privacy Rule, when PHI is to be used or disclosed for purposes other than treatment, payment, or personal services agency operations, the Agency will use and disclose it only pursuant to a valid, written authorization, unless such use or disclosure is otherwise permitted or required by law.  Use or disclosure pursuant to an authorization will be consistent with the terms of such authorization.

PROCEDURE

Exceptions to Authorization Requirements

PHI may be disclosed without an authorization if the disclosure is:

1. Requested by the consumer or his personal representative (authorization is never required);
2. For the purpose of treatment;
3. For the purpose of the Agency’s payment activities, or the payment activities of the entity receiving the PHI;
4. For the purpose of the Agency’s personal service agency operations;
5. In limited circumstances, for the personal service agency operations of another Covered Entity, if the other Covered Entity has or had a relationship with the consumer;
6. To the Secretary of the U.S. Department of Health and Human Services for the purpose of determining compliance with the HIPAA Privacy Rule; or
7. Required by other state or federal law. (See “Request and Disclosure Table” in the “Uses and Disclosures of Protected Health Information” Policy for other exceptions.)

Use or Disclosure Pursuant to an Authorization

1. When the Agency receives a request for disclosure of PHI, the Agency Privacy Official shall determine whether an authorization is required prior to disclosing the PHI.
2. PHI may never be used or disclosed in the absence of a valid written authorization if the use or disclosure is:
   1. Of psychotherapy notes as defined by the HIPAA Privacy Rule;
   2. For the purpose of marketing; or
   3. For the purpose of fundraising.
3. If the use or disclosure requires a written authorization, the Agency shall not use or disclose the PHI unless the request for disclosure is accompanied by a valid authorization.
4. If the request for disclosure is not accompanied by a written authorization, the Agency Privacy Official shall notify the requestor that it is unable to provide the PHI requested. The Privacy Official will supply the requestor with an Authorization to Use or Disclose PHI (“Authorization“) form.

Addendum and second contact added 5/15/2024 intentionally blank added 6.20.2025 atj

(See Authorization form following this Policy.)

5. If the request for disclosure is accompanied by a written authorization, the Privacy Official will review the authorization to assure that it is valid (see the “Checklist for Valid Authorization” following this Policy).
6. If the authorization is lacking a required element or does not otherwise satisfy the HIPAA requirements, the Privacy Official will notify the requestor, in writing, of the deficiencies in the authorization. No PHI will be disclosed unless and until a valid authorization is received.
7. If the authorization is valid, the Privacy Official will disclose the requested PHI to the requester. Only the PHI specified in the authorization will be disclosed.
8. Each authorization shall be filed in the consumer’s Service Record.

Preparing an Authorization for Use or Disclosure

1. When the Agency is using or disclosing PHI and an authorization is required for the use or disclosure, the Agency will not use or disclose the PHI without a valid written authorization from the consumer or the consumer’s personal representative.
2. The Authorization form must be fully completed, signed and dated by the consumer or the consumer’s personal representative before the PHI is used or disclosed.
3. The Agency may not condition the provision of services on the receipt of an authorization.
4. An authorization may not be combined with any other document unless one of the following exceptions applies:
   1. Authorizations to use or disclose PHI for a research study may be combined with any other type of written permission for the same research study, including a consent to participate in such research;
   2. Authorizations to use or disclose psychotherapy notes may only be combined with another authorization related to psychotherapy notes; or
   3. Authorizations to use or disclose PHI other than psychotherapy notes may be combined, but only if the Agency has not conditioned the provision of service or payment upon obtaining the authorization.

Revocation of Authorization

1. The consumer may revoke his authorization at any time.
2. The authorization may ONLY be revoked in writing. If the consumer or the consumer’s personal representative informs the Agency that he/she wants to revoke the authorization, the Agency will assist him/her to revoke in writing.
3. Upon receipt of a written revocation, the Privacy Official will write the effective date of the revocation on the Authorization form.
4. Upon receipt of a written revocation, the Agency may no longer use or disclose a consumer’s PHI pursuant to the authorization.
5. Each revocation will be filed in the consumer’s Service Record.

Addendum and second contact added 5/15/2024 intentionally blank added 6.20.2025 atj

Intentionally left blank

Addendum and second contact added 5/15/2024 intentionally blank added 6.20.2025 atj

 

AUTHORIZATION TO USE AND/OR DISCLOSE HEALTH INFORMATION

Revocation

Date Revoked:__________________

Initials of Privacy Official________

          Consumer Name:  ___________________________________ Service Record No.____________________

           Address:           ____________________________________________________________________________

           Agency Name:   Southern Indiana Center for Independent Living

I authorize this Agency to use or disclose my health information as described below.

1. Type of information: The type of information to be used or disclosed is as follows (check the appropriate spaces and include other information where indicated):

______ The entire Service Record (all information) _____ Consumer Agreement _____ Consumer/Office Communication _____ Independent Living Plan Goals _____ Referral source billing authorization _____ Consumer Rights _____ Referral Source cover sheet/narrative _____ Quality Assurance Policy _____ Service Plan _____ Documentation of receipt of Notice of Privacy Practice  _____ Other: (Describe as specifically as possible). ___________________________________________________________________________________________ ___________________________________________________________________________________________ Recipient of information – The information identified above may be used by, or disclosed to, the following individual(s) or organization(s) * Groups i.e. – Landlords in Lawrence County, Food Pantries, Churches are o.k.:

 

__

2.

Second Contact Name:  __________________________________________ Address:_________________________________________ ________________________________________________ Name:  _________________________________________ Address:_______________________________________ ______________________________________________ Name:  ______________________________________________ Address:_______________________________________ ______________________________________________  Name:  ______________________________________________ Address:_______________________________________ ______________________________________________

FSSA – in regard to Medicaid, TANF 1-800-403-0864 or SNAP 1-877-768-5098 Address:3834 Madison Avenue Indianapolis, IN 46227 AAA____________________________________ Address:________________________________ _______________________________________ USDA for the purpose of obtaining a grant or loan Gennifer Schaefer SFH Specialist – Direct Office: 574-249-7013 Gennifer.Schaefer@usda.gov Catherine (Cathie) Stratton SFH Specialist – Direct Office: 812-953-4174 Catherine.Stratton@usda.gov or other SFH Specialist Social Security Administration in regard to SSI, SSDI, or other benefit from SSA 515 Patterson Drive, Bloomington, IN 2535 Arnold Street, Columbus, IN 1-800-772-1213 or 1-877-819-2594

4

Addendum and second contact added 5/15/2024 intentionally blank added 6.20.2025 atj

AUTHORIZATION TO USE AND/OR DISCLOSE HEALTH INFORMATION -page 2

3. Purpose of use/disclosure – This information described on the previous page will be used for the following purpose(s):

____ Initiated at the request of the consumer.

____ My personal records

____ Sharing with health care providers as needed

____ Other (please describe):_____________________________________________________________

Authorization Statements/Signatures:

4. I understand that once the above information is disclosed, it may be re-disclosed by the recipient and the HIPAA Privacy Rule may no longer protect the information.
5. I understand that I have a right to revoke this authorization at any time. I understand that if I revoke this authorization, I must do so in writing and present my written revocation to a Agency management staff member. I understand that the revocation will not apply to information that has already been released in response to this authorization.
6. Unless I specify differently, this authorization will expire (insert date or event – 1 year from today):

______________________________________________________________

8. I understand that the Agency will not condition the provision of service or payment on the provision of this authorization.

______________________________________________________	____________________________
Signature of Consumer or Personal Representative  ______________________________________________________ Print Name ______________________________________________________ Personal Representative’s Title (e.g., Guardian, Executor of Estate, Health Care Power of Attorney)	Date

Distribution of copies: Copy to consumer’s Service Record, original to consumer.

5

Addendum and second contact added 5/15/2024 intentionally blank added 6.20.2025 atj

CHECKLIST FOR VALID AUTHORIZATION

When you receive a request for release of Service Records containing PHI from any entity other than the consumer or the consumer’s personal representative, and the disclosure is not for purposes of service provision, payment or personal care operations or another disclosure required or permitted by the HIPAA Privacy Rule, you may not release those records unless the requestor has provided a valid authorization.  Use this checklist to assure that the authorization is valid.  If any one element is missing, the Privacy Rule prohibits you from disclosing the information.  You should contact the requestor and explain why you cannot disclose the information.  

_____The authorization must be written in plain language.

All of the following elements must be included in the authorization:

_____A specific and meaningful description of the information to be disclosed.

_____The name or other specific identification of the person (or organization or class of persons) authorized to make the requested disclosure.

_____The name or other specific identification of the person (or organization or class of persons) to whom the information will be disclosed.

_____The purpose of the requested disclosure.  (If the consumer initiates the authorization, the statement “at the request of the consumer” is a sufficient description of the purpose).

_____An expiration date or an expiration event that relates to the consumer or the purpose of the disclosure.

_____Signature of the consumer or personal representative and date.

_____If signed by personal representative, a description of the representative’s authority to act for the consumer.

Required Statements:

_____A statement that information disclosed pursuant to the authorization may be subject to redisclosure and may no longer be protected by the Privacy Rule.

_____A statement of the consumer’s right to revoke the authorization in writing and either,

_____A reference to the revocation right and procedures described in the Notice of Privacy Practices;

OR

_____A statement about the exceptions to the right to revoke and a description of how the consumer may revoke.

_____The following statements, or a substantially similar statement:

▪ If the Covered Entity is not permitted to condition service provsion or payment on the provision of an authorization:  I understand that the Agency will not condition the provision of services or payment on the provision of this authorization.

Addendum and second contact added 5/15/2024 6 intentionally blank added 6.20.2025 atj

Defective Authorizations

If an authorization has any one of the following defects, it is invalid and any use or disclosure made pursuant to the authorization will be in violation of the Privacy Rule:

_____The authorization has expired. 

_____One of the required elements or statements is missing.

_____The Agency has knowledge that the authorization has been revoked.

_____The authorization violates the regulations governing conditioning treatment or payment upon signing the authorization, or combining authorizations.

_____The Agency has knowledge that information in the authorization is false.

ADDENDUM TO HIPPA AND ILP DOCUMENTS

I, _______________________________________, choose to request the electronic or paper copies of the HIPPA document and request electronic or paper copies of  ILP document. email address ____________________________________

Consumer signature_________________________ Date__________________

I, _______________________________________, choose to refuse the paper copies of the ____HIPPA document and refuse the_____ ILP document. *These documents can be requested at a later date by calling 812-277-9626 the office for SICIL.

Consumer signature_________________________

Date__________________

                                                                                                                    Addendum and second contact added 5/15/2024 i       7

intentionally blank added 6.20.2025 atj