Corporate Compliance

Compliance Q&A: Attorney request

Compliance Monitor, November 9, 2011

Q: A patient signed an authorization form eight months ago, and her attorney is now submitting it to obtain a copy of her medical records. Is this authorization still valid, or do must we obtain a new signed authorization from the patient?

A: The HIPAA Privacy Rule does not specify the maximum period of time for which an authorization is valid, but some states do so. For example, authorizations are valid for up to 120 days in Texas. If your state does not specify a maximum time period during which authorizations are considered valid, you may establish your own policy. Many organizations consider authorizations valid for up to one year after patients have signed them, unless a patient specifies an earlier expiration date or event.

Editor’s note: Mary D. Brandt, MBA, RHIA, CHE, CHPS, vice president of HIM at Scott & White Healthcare in Temple, TX, answered this question. Brandt is a nationally recognized expert on patient privacy, information security, and regulatory compliance, and her publications provided some of the basis for HIPAA’s privacy regulations.

Most Popular