Important Information about the Authorization to Disclose Protected Health Information
The Attorney General of Texas has adopted a standard Authorization to Disclose Protected Health Information in accordance with Texas Health & Safety Code § 181.154(d). This form is intended for use in complying with the requirements of the Health Insurance Portability and Accountability Act and Privacy Standards (HIPAA) and the Texas Medical Privacy Act (Texas Health & Safety Code, Chapter 181). Covered Entities may use this form or any other form that complies with HIPAA, the Texas Medical Privacy Act, and other applicable laws.
Covered entities, as that term is defined by HIPAA and Texas Health & Safety Code § 181.001, must obtain a signed authorization from the individual or the individual’s legally authorized representative to electronically disclose that individual’s protected health information. Authorization is not required for disclosures related to treatment, payment, healthcare operations, performing certain insurance functions, or as may be otherwise authorized by law. (Tex. Health & Safety Code §§ 181.154(b),(c), § 241.153; 45 C.F.R. §§ 164.502(a)(1); 164.506, and 164.508).
The authorization provided by use of the form means that the organization, entity or person authorized can disclose, communicate, or send the named individual’s protected health information to the organization, entity or person identified on the form, including through the use of any electronic means.
Definitions - In the form, the terms “treatment,” “health care operations,” “psychotherapy notes,” and “protected health information” are as defined in HIPAA (45 CFR 164.501). “Legally authorized representative” as used in the form includes any person authorized to act on behalf of another individual. (Tex. Occ. Code § 151.002(6); Tex. Health & Safety Code §§ 166.164, 241.151; and Tex. Probate Code § 3(aa)).
Health Information to be Released - If “All Health Information” is selected for release, health information includes, but is not limited to, all records and other information regarding health history, treatment, hospitalization, tests, and outpatient care, and also educational records that may contain health information. As indicated on the form, specific authorization is required for the release of information about certain sensitive conditions, including:
- Mental health records (excluding “psychotherapy notes” as defined in HIPAA at 45 CFR 164.501).
- Drug, alcohol, or substance abuse records.
- Records or tests relating to HIV/AIDS.
- Genetic (inherited) diseases or tests (except as may be prohibited by 45 C.F.R. § 164.502).
Note on Release of Health Records - This form is not required for the permissible disclosure of an individual’s protected health information to the individual or the individual’s legally authorized representative. (45 C.F.R. §§ 164.502(a)(1)(i), 164.524; Tex. Health & Safety Code § 181.102). If requesting a copy of the individual’s health records with this form, state and federal law allows such access unless such access is determined by the physician or mental health provider to be harmful to the individual’s physical, mental or emotional health. (Tex. Health & Safety Code §§ 181.102, 611.0045(b); Tex. Occ. Code § 159.006(a); 45 C.F.R. § 164.502(a)(1)). If a healthcare provider is specified in the “Who Can Receive and Use The Health Information” section of this form, then permission to receive protected health information also includes physicians, other healthcare providers (such as nurses and medical staff) who are involved in the individual’s medical care at that entity’s facility or that person’s office, and health care providers who are covering or on call for the specified person or organization, and staff members or agents (such as business associates or qualified services organizations) who carry out activities and purposes permitted by law for that specified covered entity or person. If a covered entity other than a health care provider is specified, then permission to receive protected health information also includes that organization’s staff or agents and subcontractors who carry out activities and purposes permitted by this form for that organization. Individuals may be entitled to restrict certain disclosures of protected health information related to services paid for in full by the individual (45 C.F.R. § 164.522(a)(1)(vi)).
Authorizations for Sale or Marketing Purposes - If this authorization is being made for sale or marketing purposes and the covered entity will receive direct or indirect remuneration from a third party in
connection with the use or disclosure of the individual’s information for marketing, the authorization must clearly indicate to the individual that such remuneration is involved. (Tex. Health & Safety Code §181.152, .153; 45 C.F.R. § 164.508(a)(3), (4)).
Limitations of this form - This authorization form shall not be used for the disclosure of any health information as it relates to: (1) health benefits plan enrollment and/or related enrollment determinations (45 C.F.R. § 164.508(b)(4)(ii), .508(c)(2)(ii); (2) psychotherapy notes (45 C.F.R. § 164.508(b)(3)(ii); or for research purposes (45 C.F.R. § 164.508(b)(3)(i)). Use of this form does not exempt any entity from compliance with applicable federal or state laws or regulations regarding access, use or disclosure of health information or other sensitive personal information (e.g., 42 CFR Part 2, restricting use of information pertaining to drug/alcohol abuse and treatment), and does not entitle an entity or its employees, agents or assigns to any limitation of liability for acts or omissions in connection with the access, use, or disclosure of health information obtained through use of the form.
Charges - Some covered entities may charge a retrieval/processing fee and for copies of medical records. (Tex. Health & Safety Code § 241.154).
Right to Receive Copy - The individual and/or the individual’s legally authorized representative has a right to receive a copy of this authorization.