Disclaimer:
HIPAA Collaborative of Wisconsin (“HIPAA COW”) holds the Copyright © to this Authorization Elements Grid (“Document”). HIPAA COW retains full copyright ownership, rights and protection in all material contained in this Document. You may use this Document for your own non-commercial purposes. It may be redistributed in its entirety only if (i) the copyright notice is not removed or modified, and (ii) this Document is provided to the recipient free of charge. If information is excerpted from this Document and incorporated into another work-product, attribution shall be given to HIPAA COW (e.g., reference HIPAA COW as a resource). This Document may not be sold for profit or used in commercial documents or applications. This Document is provided “as is” without any express or implied warranty. This Document is for educational purposes only and does not constitute legal advice. If you require legal advice, you should consult with an attorney. Unless otherwise noted, HIPAA COW has not addressed all state pre-emption issues related to this Document. Therefore, this Document may need to be modified in order to comply with Wisconsin/State law.
Revisions:
April 4, 2018
Grid updated withchanges to 42 CFR Part 2 effective March 21, 2017
April 13, 2016
Grid updated with Wis. Stat. 252.15 (3m) and 252.15(4)
Grid updated with Wis. Stat. 610.70(2)(a)
August27,2010
Grid updatedtocorrecttheomissionof "general"intheWis.Stat.51.30columnforthe42CFR 2.31(a)(1) reference
March 1,2006
Grid updatedtoaddress theHHS FAQ "Cananindividual revokehisorherAuthorization?" [dated8/8/2005]
TheRight toWithdrawtheAuthorizationstatementidentifiesthecoveredentity asthe"disclosing"coveredentity.
March 15,2004
Grid updated: HFS94.03(1)(f) removed
January2, 2004
Gridis updatedtoaddress expirationdate accordingtoHFS94.03(1)(f)
Wis. Stat.146.81 / Wis. Stat.51.30
DHS92 / 42CFR2.31 / Wis. Stat.
252.15 / Wis. Stat.
610.70 / 45 CFR164.508
HIPAA Authorization
Required Elements / Required Elements / Required Elements / Required Elements / Required Elements / RequiredElements
Allpatienthealthcare records shallremainconfidential. Patient healthcare records may be releasedwithpatientconsent orto the personsdesignatedin the statutoryexceptions
146.82(2)
Or, according to Wis. Stat. 146.816(2) addressing HIPAA harmonization for 51.30(4)(a) and 146.82. / ...alltreatmentrecordsshall remainconfidential and are privileged to the subject individual ...records maybe released…withtheinformed written consentofthesubjectindividual…51.30(4)(a) orwithoutwritteninformed consentunderspecificstatutory exceptions stated in51.30(4)(b). Or, according to Wis. Stat. 146.816(2) addressing HIPAA harmonization for 51.30(4)(a) and 146.
/ ----- / The subject of an HIV test or the subject's authorized representative may disclose the results of the subject's test to anyone. 252.15(3m)(a) / ----- / Exceptasotherwisepermitted orrequiredbythis subch.,a CE maynotuseordisclosePHI withoutanauthorizationthatis validunderthis section.
Inwriting:146.81(2) / Inwriting:51.30(2) / In writing: 2.31(a) / Inwriting:
252.15(3m)(b) / All instructions and other information contained in the form are presented in plain language 610.70(2)(a)1 / Writteninplainlanguage
164.508(c)(3)
Nameofthe patientwhose recordisbeingdisclosed:
146.81(2)(a) / Nameofthe individual whosetreatmentrecordis
beingdisclosed:51.30(2) / Nameofthe individual whosetreatmentrecordis beingdisclosed:
2.31(a)(1) / The name of the subject ofthe HIV test.
252.15 (3m)(b)1 / ---- / (Signature,see below)
Typeofinformationto be disclosed:146.81(2)(b) / Specifictypeofinformation to be disclosed:51.30(2) / How much and what kind of information is to be disclosed including an explicit description of the substance use disorder information that may be disclosed.
2.31(a)(3) / Specification of the information that may be disclosed.
252.15 (3m)(b)2 / Specifiesthenatureofthe informationthatis authorizedto be disclosed:
610.70(2)(a)4 / Adescriptionofthe informationto be used/ disclosed that identifiesthe informationin aspecificandmeaningful
fashion:164.508(c)(1)(i)
Thetypesofhealthcare providersmakingthe disclosure:146.81(2)(c) / ----- / Specific name(s)or general designation(s)of the part 2program(s), entity(ies)or individual(s)permittedtomake disclosure:2.31(a)(2) / The name of the person authorized to make the disclosure. 252.15(3m)(b)3 / Specifiesthe typesof personsthatare authorized to discloseinformation aboutthe individual:
610.70(2)(a)3 / The nameorotherspecific identificationofthe person(s),orclassof persons,authorizedto make the requesteduseordisclosure:
164.508(c)(1)(ii)
Theindividual,agency,or organizationtowhich disclosure maybemade:
146.81(2)(e) / The nameofthe individual, agencyororganizationto whichdisclosureisto be made:51.30(2) / •The nameofthe individual, agencyororganizationto whichdisclosureisto be made; or
•Entities with a treating provider relationship with the patient, or
•Entities without a treating provider relationship with the patient if
•Is a third-party payer, the name of the entity, or
•The entity is not listed above but facilitates the exchange of health information or is a research institution, the name(s) of the entity(ies), and
•The names of an individual participant(s), or
•The name(s) of an entity participant(s) that has a treating provider relationship with the patient whose information is being disclosed, or
•the general designation of an individual or entity participant(s) or class of participants that must be limited to a participant(s) who has a treating provider relationship with the patient whose information is being disclosed. / The nameofthe personto whom the disclosure is authorized
252.15(3m)(b)4 / The nameofinsurerand identifiesbygeneric referencerepresentativesof the insurer,towhomthe informationisauthorizedto
be disclosed:610.70(2)(a)5 / The nameorotherspecific identificationofthe person(s),orclassof persons,towhomthe CE maymakethe requesteduse
ordisclosure:
164.508(c)(1)(iii)
----- / ----- / Note: When using a general designation, as statement must be included on the consent form that the patient (or other individual authorized to sign in lieu of the patient) confirms their understanding that, they must be provided a list of entities to which their information has been disclosed:
2.31(a)(4)(i-iii) / ----- / ----- / -----
Thepurposeofthe disclosure:146.81(2)(d) / Thepurposeorneedforthe disclosure:51.30(2); / Thepurposeorneedforthe disclosure. The disclosure must be limited to that information which is necessary to carry out the stated purpose:
2.31(a)(5) / ---- / Thepurposesforwhichthe informationisbeing obtained/disclosed:
610.70(2)(a)6 / Adescriptionofeach purposeofthe requested useordisclosure.The statement"atthe requestofthe individualis sufficient...":
164.508(c)(1)(iv)
Thesignatureofthe patient orthe personauthorizedby the patient,andrelationship
to patientorlegalauthority:
146.81(2)(f) / The signatureofthe individualorpersonlegally authorizedto giveconsentforthe individual:51.30(2); / The signature of the patient and, when required for a patient who is a minor, the signature of an individual authorized to give consent; or, when required for a patient who is incompetent or deceased, the signature of an individual authorized to sign. Electronic signatures are permitted to the extent that they are not prohibited by any applicable law:
2.31(a)(8) / The signature of the subject of the HIV test or the signature of the subject's authorized representative:
252.15(3m)(b)5 / Signed/Authorizedby individual,orbya person whoisauthorizedto
consentonbehalfofanindividual…:
610.70(5)(a) / Signatureofthe individual anddate. Ifthe authorizationissignedbyapersonalrepresentativeofthe individual...:
164.508(c)(1)(vi)
Ifthe authorizationis signedbyaperson authorizedbythe patient, the relationshipofthatpersonto the patientorthe
authorityofthe person:
146.81(2)(f) / ---- / ---- / ---- / ---- / Ifthe authorizationis signedbya personal representativeofthe individual,a descriptionofsuchrepresentative'sauthorityto act forthe individual mustalsobe provided:164.508(c)(1)(vi)
Thedate onwhichthe consentis signed: 146.81(2)(g) / Thedate onwhichthe consentis signed:51.30(2) / Thedate onwhichthe consentis signed:2.31(a)(9) / The date the authorization is signed as.252.15(3m)(b)6 / Theformisdated:
610.70(2)(a)2 / Signatureofthe individual anddate:164.508(c)(1)(vi)
Thetimeperiodduring whichthe consentis effective:146.81(2)(h) / Thetimeperiodduring whichthe consentis effective:51.30(2)
Informed consent is effective only for the period of time specified by the patient in the informed consent document:
DHS 92.03(3)(b) / The date, event, or condition upon which the consent will expire if not revoked before. This date, event, or condition must ensure that the consent will last no longer than reasonably necessary to serve the purpose for which it is provided:
2.31(a)(7)
A disclosure may not be made on the basis of a consent which:
- Has expired;
- On its face substantially fails to conform to any of the requirements
- Is known to have been revoked;
- Is known, or through reasonable diligence could be known, by the individual or entity holding the records to be materially false:
252.15(3m)(b)7 / Specifiesthe lengthoftime forwhichthe authorization remainsvalid:610.70(2)(a)7 / Anexpirationdate oran expirationeventthatrelates to the individualorthe purposeofthe useor disclosure:164.508(c)(1)(v)
----- / Each informed consent document shall include a statement that the patient has a right to inspect and receive a copy of the material to be disclosed: DHS 92.03(3)(d) / ----- / ----- / ----- / -----
----- / Anypatientorpatient representative may withdrawauthorizationfor disclosureofany informationat anytime.
Ifthisoccurs,anagencynot includedunders.51.30(4)(b)Stats.,that requestsrelease of informationrequiring informedconsentshallbe toldonlythats. 51.30, Stats.,prohibitrelease of the informationrequested.
DHS92.03(3)(e) / Authorization contains a statement that the consent is subject to revocation at any time except to the extent that the part 2 program or other lawful holder of patient identifying information that is permitted to make the disclosure has already acted in reliance on it. Acting in reliance includes the provision of treatment services in reliance on a valid consent to disclosure information to a third-party payer:
2.31(a)(6) / ----- / ----- / Astatementplacingthe individualon noticeofthe individual'srightto revoke the authorizationin writing, andeither
•Theexceptionsto the rightto revokeand howto revoke [164.508(b)(5)],or
•Ifthe rightto revokeis inthenotice,a referenceto thenotice.
164.508(c)(2)
(i) Note:An individual may revokeanauthorizationby
providinga revocationin writingto the disclosingCE, exceptto the extent:1)the disclosingCE hastakenaction inrelianceonthe authorization or2)ifthe authorizationwas obtainedasaconditionof obtaininginsurancecoverage, otherlawprovidesthe insurer withthe rightto contestaclaim under the policy or the policy itself.
ReferenceHHSFAQwebsite link on page1 ofthisdocument.
----- / ----- / ------/ ----- / ----- / Astatementplacingthe individualon noticeofthe
abilityorinabilityto
conditiontreatment, payment,enrollmentor eligibility forbenefitson the authorizationbystating either
•CE maynotcondition abovebasedon whetherindividual signsauthorization whenthe prohibition onconditioningof authorizationsapplies,
or
• Theconsequencesof refusalto sign. 164.508(c)(2) (ii)
Note:Aconsequenceofrefusal to signan authorizationfor disclosureofWIlaw252.15or 51.30 records maybe non- payment;therefore,aCE may wantto includethis consequenceinthe authorization.
----- / ----- / ------/ ----- / ----- / Astatementplacingthe individualon noticeofthe potentialforinformation disclosedpursuantto the authorizationto be subject to redisclosurebythe recipientand nolongerbe protectedbythe federal privacyrule: 164.508(c)(2)(iii)
----- / ----- / ----- / ----- / ----- / Marketingauthorization—a statement noticing individualthat remunerationisinvolvedif CEreceivesdirector indirectremunerationfrom athirdparty. 164.508(a)(3)(ii)
----- / ----- / ----- / ----- / ----- /
- Miscellaneous
164.508(b)(1)(ii)
MaintenanceofAuthorization / MaintenanceofAuthorization / Maintenance of Authorization / MaintenanceofAuthorization / MaintenanceofAuthorization / MaintenanceofAuthorization
----- / A copy of the informed consent document shall be maintained in the treatment record. DHS 92.03(3)(c) / ----- / HCP must maintain in the person’s health care record a record of any authorization for disclosure of HIV test results for testing or disclosure: 252.15(4)(bm) / ----- / CE mustdocumentand retainanysigned authorization.
164.508(b)(6)
Providing a Copy of the Authorization / Providing a Copy of the Authorization / Providing a Copy of the Authorization / Providing a Copy of the Authorization / Providing a Copy of the Authorization / Providing a Copy of the Authorization
----- / A copy of each informed consent shall be offered to the patient or guardian and a copy shall be maintained in the treatment record: DHS 92.03(3)(c) / ----- / ----- / Advised that the individual or an authorized representative of the individual, is entitled to receive a copy of the completed authorization form: 61.070(2)(a)8 / If a CE seeks an authorization from an individual for a use/disclosure of PHI, the CE must provide the individual with a copy of the signed authorization. 164.508(c)(4)
Fees / Fees / Fees / Fees / Fees / Fees
Any patient or other person main, upon submitting a statement of informed consent, receive a copy of the patient’s health care records upon payment of fees as established by rule by the department which shall be based on an approximation of actual costs: 146.83(3f) / A reasonable and uniform charge for reproduction may be assessed to the submit individual requesting individual access: 51.30(4)(f)3 / ----- / ----- / An insurer may charge the individual a reasonable fee to cover the costs incurred in providing a copy of recorded personal medical information: 610.70(3)(f) / If an individual requests a copy of their PHI, the CE may impose a reasonable, cost-based fee….
164.524(c)(4)
Refer to HIPAA guidance regarding “Individuals’ Right under HIPAA to Access their Health Information” available at
The Wisconsin statutes regulate releaseordisclosure ofpatientinformation.HIPAAregulates uses and disclosures ofpatientinformation. Understandingthat thelaw"mostprotective"ofpatientrights willcontrol,an authorization maynowbe requiredfora use and/ordisclosure.Therefore,theHIPAA-COW interfaceauthorization formis titled"Authorization forUseand Disclosure ofHealth Information."
Version History:
Current Version: 4/4/18
Prepared by: / Reviewed by: / Content Changed:Chrisann Lemery, MercyCare Insurance
Dawn Paulson, UW Hospital & Clinics
Teresa Smithrud, MercyHealth
Paul Trizenberg, ThedaCare
Kerry Wolford, HSHS, St. Vincent Hospital / Nancy Davis, Door County Memorial Hospital
Sarah Coyne, JD, Quarles & Brady LLP / Grid updated with addition of 42 CFR Part 2 column
51.30 column edited to reflect removal of 42 CFR Part 2 requirements
Previous Version: 4/13/16
Prepared by: / Reviewed by: / Content Changed:Chrisann Lemery, MercyCare Insurance / Sarah Coyne, JD, Quarles & Brady LLP / Grid updated with Wis. Stat. 252.15 (3m) and 252.15(4)
Grid updated with Wis. Stat. 610.70(2)(a)
Original Version: 1/2/04
Prepared by: / Reviewed by:Susan Manning, JD
Chrisann Lemery, RHIA
Authorization Elements Grid – 04/04/18 1 Copyright HIPAA COW