Confidentiality, Privacy and Security

PHI Disclosure Authorization Form/ From: (date) To: present

  • 1.  PHI Disclosure Authorization Form/ From: (date) To: present

    Posted 18 days ago
    Good afternoon,

    If you receive an authorization to disclose PHI from your patients and the date range in the HIPAA/auth form for the disclosure date range states 1/1/2020 "to present". What data/documents are you actually releasing? To present as in the date you (or your team) is physically working on the disclosure or to present as when the authorization was signed?

    Lets suppose the following:
    -You receive a PHI disclosure request and authorization form on 7/24/20 for all office notes to be released
    -The patient signed the authorization form on 7/20/2020
    -The patient had an office visit on 7/22/2020

    Are you including the 7/22/20 visit in the disclosure? Or do you stop all documents to be released at 7/20/20? I can't find any regulation that specifically mentions what covers/constitutes the appropriate date range to be released. I am inclined to stop at DOS 7/20/20 and this is what I personally practice.

    Any advice is appreciated!

    ------------------------------
    Kristina Arnold, RHIA
    Medical Records Coordinator
    ------------------------------


  • 2.  RE: PHI Disclosure Authorization Form/ From: (date) To: present

    Posted 18 days ago
    Kristina,

    I like your logic.

    First of all I think you nailed it.  If the release timeframe is from 1/1/2020 to "present"...I'm right there with you...the PHI subject to the request is from 1/1/2020 to 7/20/2020 in your example given that 7/20/2020 is imputed from the reference of "present" and the date associated with the signature is 7/20/2020.  Now, this would be a good opportunity to ask the patient if what they mean by "present" is inclusive of the whole time while the patient is receiving services.  In that case, you could use that same authorization indefinitely, in theory.  Very often the case for patients that are receiving treatment plans that may last a long time or in research studies that can last many years.

    This is also an important time to note that the HIPAA expiration date or expiry event can be longer than what is allows by the State.  So if I were to say on an authorization that it is good "until my treatment ends in 2025"...no problem with HIPAA...but the State regulations say that authorizations are only good for one year, then the facility would need to make sure it only honors the auth for one year.

    ------------------------------
    Frank Ruelas
    Compliance Professional
    Arizona
    ------------------------------



  • 3.  RE: PHI Disclosure Authorization Form/ From: (date) To: present

    Posted 18 days ago
    Thanks Frank for your input. It's been a big source of contention in the office for my some of my counterparts. 

    Also, just a sidebar note: thanks for all your contributions to this community. I thoroughly enjoy your content and find all of it incredibly useful/helpful. 





  • 4.  RE: PHI Disclosure Authorization Form/ From: (date) To: present

    Posted 18 days ago
    Glad to help.  Thank you and to others who have made me feel welcomed.  I have learned a lot and I hope over time I can also contribute to the knowledge pool of the community.

    ------------------------------
    Frank Ruelas
    Compliance Professional
    Arizona
    ------------------------------



  • 5.  RE: PHI Disclosure Authorization Form/ From: (date) To: present

    Posted 18 days ago
    Kristina,

    I would agree with your practice, and would send records from 1/1/2020 to 7/20/2020.

    Donna Coomes, MBA, RHIA, CHC, CHPS, CHDA, CPHI, CPHQ, CCS

    Senior Director of Compliance & HIPAA Compliance Officer
    Ballad Health
    Tel: 423-302-3401
    donna.coomes@balladhealth.orgdonna.coomes@balladhealth.org>