509-867-3645
Register
All Company Policies

07-Authorization of Use and Disclosure

Approved by: William Voss Effective: May 1, 2023
Review: Annual Revised: May 1, 2023
Renewed By: Renewed:

Authorization of Use and Disclosure

Policy Statement

In accordance with the HIPAA Privacy Rule, when protected health information (PHI) is to be used or disclosed for purposes other than treatment, payment, or health care operations, River City TMS, PLLC will use and disclose it only pursuant to a valid, written authorization, unless such use or disclosure is otherwise permitted or required by law. Use or disclosure pursuant to an authorization will be consistent with the terms of such authorization.

Procedure

  • Permitted Uses and Disclosures

    River City TMS, PLLC may use and disclose protected health information, without an individual’s authorization, in the following situations:

    • To the individual who is the subject of the information.

    • For its own treatment, payment, and health care operations activities.

    • The individual is given the opportunity to agree or object, or in the best interest of the individual if they are in an incapacitated state or emergency situation.

    • The information disclosed is incident to an otherwise permitted use or disclosure with appropriate safeguards.

    • For specific Public Interest and Benefit Activities.

    • As a part of a limited data set, in which identifying information has been removed.

  • Use or Disclosure Pursuant to an Authorization §164.508(a)

    Additional caution is demanded by cases of use and disclosure of information from psychotherapy notes, records of substance abuse disorders and treatments, and for marketing purposes. These cases require that patient authorization be obtained before such uses and disclosures are appropriate.

    • Psychotherapy notes, as defined by the HIPAA Privacy Rule, contain especially sensitive patient information relating to their mental health that often informs their therapists care decisions but is not necessary for general treatment, payment, and operation use. Instances in which this information may be used without notice to the patient or requiring patient authorization include:

      • Use by the originator of the psychotherapy notes for patient assessment and treatment. 

      • Use or disclosure by River City TMS, PLLC for its own training programs under supervision to practice or improve skills in group, joint, family, or individual counseling.

      • Use or disclosure by River City TMS, PLLC to defend itself in a legal action or proceeding brought by the individual.

      • Disclosure to prevent a potential threat to the public.

      • Disclosures for the purpose of displaying HIPAA compliance under an audit from Health and Human Services (HHS).

      • Disclosure to a coroner of medical examiner in cases of death.

    • Records of substance abuse disorder and treatment require patient authorization to be documented for use and disclosure of this information. Exceptions to the authorization requirement of this information include:

      • Disclosure by River City TMS, PLLC to treat their disorder.

      • Use or disclosure in cases where the patient poses as a real threat to themselves or others.

    • Disclosures of patient information for the purpose of marketing requires documented patient authorization. This requirement applies to both River City TMS, PLLC marketing and disclosures for third party marketing efforts. Exceptions include:

      • In person communications between River City TMS, PLLC and the individual whom the information is about, while discussing alternative treatment and payment options for their care.

    If the use or disclosure requires a written authorization, River City TMS, PLLC shall not use or disclose the PHI unless the request for disclosure is accompanied by a valid authorization. If a valid written authorization is not obtained for a requested disclosure, River City TMS, PLLC shall notify the requestor that it is unable to provide the PHI requested. If a written authorization is obtained for the request for disclosure, River City TMS, PLLC will review the authorization to ensure that it is valid. Requests accompanied by a valid authorization will be provided with the minimum necessary standard in mind, and the corresponding authorization shall be filed in the patient’s medical record.

  • Requirements of Authorization Forms

    The authorization must contain all required elements of a valid HIPAA authorization and must be signed and dated by the patient or the patient’s authorized representative before the PHI is used or disclosed. The essential elements of a valid HIPAA authorization form are:

    • Must be written in plain language to be easily understood by the patient.

    • Must disclose what PHI is being authorized for use or disclosure.

    • Must state who will disclose and who will receive the PHI.

    • Must state an expiration date of the authorization.

    • Must include the patients’ right to revoke the authorization in writing.

    River City TMS, PLLC currently uses written authorizations for various purposes. Reference the following appendices:

    • Authorization for Email Communication (Appendix I)
      • Agreement between River City TMS, PLLC and patient for email communication for non-urgent matters.
    • Authorization for Release to External Parties (Appendix J)

      • Patient specifies type of PHI to be released and to whom.
    • Authorization for Release for Marketing Communications (Appendix K)
      • Patient specifies how River City TMS, PLLC can use the patient’s health information for various marketing purposes.

    River City TMS, PLLC may not condition the provision of treatment, enrollment, payment, or benefits on the receipt of an authorization unless it is providing research-related treatment or health care that is solely for the purpose of creating PHI for disclosure to a third party (i.e., performing an independent medical examination at the request of an insurer or other third party). 

    An authorization may not be combined with any other document unless one of the following exceptions applies:

    • Authorizations to use or disclose PHI for a research study may be combined with any other type of written permission for the same research study, including a consent to participate in such research.

    • Authorizations to use or disclose psychotherapy notes may only be combined with another authorization related to psychotherapy notes.

    • Authorizations to use or disclose PHI other than psychotherapy notes may be combined, but only if River City TMS, PLLC has not conditioned the provision of treatment or payment upon obtaining the authorization.

  • Revocation of Authorization §164.508(b)(5) and §164.508(b)(6)

    A patient may revoke their authorization at any time. The authorization must be revoked in writing using the Revocation of Authorization to Release Protected Health Information (Appendix H). Upon receipt of a written revocation, River City TMS, PLLC may no longer use or disclose a patient’s PHI that was reliant on the authorization. Each revocation will be filed in the patient’s medical record.