Part 2, Chapter 7: Manual Exhibit 2-7-D
Policy and Procedure for use or Disclosure of Health Information
Pursuant to Authorization or Valid Written Request
- PURPOSE. The purpose of Manual Exhibit 2-7-D is to publish the policy and procedure for disclosing protected health information (PHI) pursuant to the patient’s authorization or a valid written request in accordance with the Privacy Act of 1974, as amended, 5 United States Code (U.S.C.) 552a; the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, 45 Code of Federal Regulations (CFR) Parts 160 and 164; Confidentiality of Alcohol and Drug Abuse Patient Records, 42 CFR Part 2; Confidentiality of Mental Health Records, 42 CFR Part 51; and the Freedom of Information Act, 5 U.S.C. 552.
- AUTHORITY. 45 CFR 164.502
- POLICY. It is Indian Health Service (IHS) policy that a patient must complete and sign the form IHS-810, “Authorization for Use or Disclosure of Health Information,” (Appendix 1) prior to disclosing health information for any purpose.
- A valid written request from the patient may also be honored.
- Authorization for use and disclosure of PHI is not required to be completed for disclosures for which authorization is not required.
- PROCEDURE. The following procedures will he used when patients authorize disclosures of PHI and will govern how disclosure of PHI will be accomplished for valid authorizations (IHS-810) or written requests received by the IHS. Adherence to the following procedures is required.
- Only authorizations with valid signatures will be processed by the Health Information Management Department.
- An individual may authorize a release of PHI by completing and signing the authorization form IHS-810. (See Appendix 2 for instructions on how to complete the form.)
- Blanket authorization (no specified individual or organization or for a time period which exceeds one year) or duplicated authorizations will not be honored.
- The authorization will terminate one year from the date of signature unless the patient specifies a different expiration date or expiration event.
- A written request (other than form IHS 810) must identify the individual and description of the information desired, such as date of visit or diagnosis/condition. The request must contain the name and address of the requester, date of birth, signature for comparison purposes, and date.
- If the authorization or written request does not contain sufficient information that identifies the patient or description of the information requested, the requestor may be contacted for additional specific information in order to process the request.
- Any additional information received will be documented, dated, and initialed on the original authorization form or the written request.
- Verification of the individual requesting disclosure must be performed or comparison of the signature located in the record. (See Manual Exhibit 2-7-R, “Verification of Identify Prior to Disclosure of PHI.”)
- If the authorization is signed by a personal representative of the individual, a description of such representative authorized to act for the individual should be documented. Legal documents must be filed into the patient’s medical record.
- Information disclosed shall be accompanied by the following re-disclosure statement:
“This information, except for Alcohol and Drug Abuse Record as defined in 42 CFR Part 2, may be subject to re-disclosure by the recipient and may no longer be protected by the Health Insurance Portability and Accountability Act Privacy Rule (45 CFR Part 164) of 1996 and the Privacy Act of 1974 as amended.“
- Information disclosed by a designated alcohol/substance abuse facility must be accompanied by the following statement:
“This information has been disclosed to you from records protected by Federal confidentiality regulations (42 CFR Part 2). Federal regulations prohibit you from making any further disclosure of it without the specific written consent of the person to whom it pertains, or as otherwise permitted by 42 CFR Part 2. A general authorization for the release of medical or other information is NOT sufficient for this purpose. Federal rules restrict any use of the information to criminally investigate or prosecute any alcohol or drug abuse patient."
- A copy of the signed authorization, IHS-810, must be provided to the individual and the signed authorization or valid written request must be filed in the patient’s medical record.
- FORMS. The form IHS-810 is available at:
(For Public and Federal access) http://www.forms.gov/ or http://www.ihs.gov/CIO/puf/
(For IHS staff only) http://intranet.hhs.gov/forms
Manual Exhibit 2-7-D
Appendix 1 and Appendix 2
Special Note: PDF documents require the Adobe Acrobat Reader plug-in in your web browser to view. Please visit the I H S Plug-in page to install the plug-in you require.
Back To Top