Home : Academic/Research : Health Sciences

AUTHORIZATION PROCESS REQUIREMENTS
A valid written authorization is required for use or disclosure of PHI except where the use or disclosure is otherwise required or permitted. All uses and disclosures made pursuant to an authorization must be consistent with the authorization.

All authorizations must be documented and retained for a period of no less than 6 years from the date of the authorization's expiration.

A copy of all signed authorizations will be provided to the individual.

The authorization must be completed and must be signed by the person with authority to authorize use or disclosure, i.e. the individual or personal representative. The health care component must verify that the person who signs the authorization has this authority.

RELATIONSHIP WITH MINNESOTA LAW
In general, a consent to release individual health information is valid under Minnesota law if it is signed and dated by the individual or the individual's personal representative and is effective for no more than one year. A consent that meets the requirements of Minnesota law is not sufficient to authorize a use or disclosure where written authorization is required by HIPAA.

AUTHORIZATION DOCUMENT REQUIREMENTS
A valid authorization is written in plain language and contains at least the following elements:

1. Individual's Name or other identifier(s);
2. Name/identification of person or class of persons authorized to use or disclosure the information;
3. Name/identification of person or class of persons authorized to receive the information;
4. Specific and meaningful description of the information being used or disclosed;
5. Description of each purpose of the disclosure;
6. Date and signature of the individual or personal representative and a description of such person's authority to sign on behalf of the individual;
7. Expiration date of the authorization, or event that relates to the individual or the purpose of the use or disclosure which would cause the authorization to expire (Note: authorizations for research purposes may have a statement indicting they do not expire);
8. Statement of the individual's right to revoke the authorization in writing, and either a description of the exceptions to the right to revoke and a description of how to revoke, or if this information is in the health care component's Notice of Privacy Practices, a reference to the Notice;
9. Statement of prohibition on conditioning treatment, payment, enrollment or eligibility for benefits on authorization, except in certain circumstances;
10. Statement that information disclosed to recipients who are not covered by HIPAA may be subject to re-disclosure by these recipients and no longer be protected by the HIPAA Privacy Rule;
11. If the authorization is for marketing purposes and involves direct or indirect remuneration to the health care component from a third party, the authorization must state that such remuneration is involved.

AUTHORIZATION REQUIREMENT FOR PSYCHOTHERAPY NOTES
Psychotherapy notes are notes recorded by a mental health therapist in documenting or analyzing the contents of conversation during a counseling session that capture the therapist's impressions about the patient and contain details of the conversation. Psychotherapy notes are separated from the rest of the patient's medical record and used only by the provider who created the note.

The following information is not psychotherapy notes:

1. medication prescription and monitoring;
2. session start/stop times;
3. modalities and frequency of treatment;
4. results in clinical tests; and
5. summaries of diagnosis, functional status, treatment plan, symptoms, prognosis and progress to date.

A separate authorization is required for release of psychotherapy notes for all uses and disclosures of psychotherapy notes, except in the following circumstances:

1. use for the purpose of treatment by the provider who created the notes;
2. for permitted health oversight activities with respect to the provider who created the note;
3. use or disclosure by the health care component for its own training programs in which students, trainees or practitioners in mental health learn under supervision to practice or improve their skills in counseling;
4. use or disclosure by the University to defend itself in a legal action or other proceeding brought by the individual;
5. use or disclosure to medical examiners and coroners, as permitted under Minnesota law;
6. as required by law;
7. use or disclosure made for the purpose of preventing or lessening a serious or imminent threat to the health or safety of a person or the public when made to a person reasonably able to prevent or lessen the threat, including the target of the threat;
8. to the Secretary for compliance.

SPECIAL RULES FOR CONDITIONED AUTHORIZATIONS
Provision of treatment, payment, enrollment in a health plan or eligibility for benefits may not be conditioned on authorization except:

1. A provider may condition research related treatment on authorization for the use or disclosure of the information for the research;

2. Health care components may condition provision of health care solely for the purpose of creating PHI for disclosure to third parties on authorization for disclosure to those third parties (for example, an independent medical examination); and

3. The health plan component may condition enrollment or eligibility for benefits on authorization obtained prior to the individual's enrollment if the authorization is for the purpose of underwriting, or health plan enrollment and eligibility determinations, and the authorization is not for use or disclosure of psychotherapy notes.

SPECIAL RULES FOR COMBINING AUTHORIZATIONS
Authorizations may be combined with other documents to create a compound authorization except in the following circumstances:

1. Authorizations for release of psychotherapy notes may only be combined with another authorization to release psychotherapy notes.

2. Research authorizations may be combined only with other authorizations or written permissions for the same research study.

3. An authorization may not be combined when treatment, payment, enrollment in a health plan or eligibility of benefits is conditioned upon the authorization.

Except as described above, authorization may be combined with other documents to create compound authorizations. If the PHI falls into one of the categories requiring separate authorization, a separate valid authorization must be obtained.

REVOCATION OF AUTHORIZATION
The individual may revoke authorization at any time in writing, except the authorization is not revoked:

1. to the extent that the health care component has taken action in reliance on the authorization; or
2. if the authorization was obtained as a condition of insurance coverage and other law provides the insurer with the right to contest a claim under the policy or the policy itself.

EFFECT OF PRIOR PERMISSIONS
If an authorization or other express legal permission that permits release of specific PHI was obtained prior to April 14, 2003, the health care component may rely on this permission and need not obtain an authorization for uses and disclosure of PHI that are made in accordance with the prior permission. This applies only to uses and disclosures of PHI created prior to April 14, 2003. For use or disclosure of PHI created on or after April 14, 2003, a valid authorization for the use or disclosure must be obtained where required. Special rules apply to prior permissions and authorizations for research purposes.