HIPAA Forms and Health Information Access and Privacy - Overview

You have the right to privacy concerning information about your health, medical care, and how your care is paid for.  This right comes from a federal law called HIPAA (Health Insurance Portability and Accountability Act).  Although HIPAA regulates many other areas, the main impact it has on most people is the Privacy Rule, which determines how health care providers and health insurance companies can disclose Protected Health Information (PHI).

The Legal Aid Society has written an article explaining the HIPAA Privacy Rule, as well as answering many common questions about how it operates.

One of the most common situations in which people confront HIPAA is when they are trying to get a medical provider or health plan to disclose their Protected Health Information to another party.  In order to do this, you generally need a HIPAA Release, which is a signed authorization from the patient.  Some agencies and providers prefer to have a HIPAA release on their own specialized form, although this is not legally required.  In fact, since November 2013, Managed Long Term Care, PACE, and Medicaid Advantage Plus plans have been REQUIRED to accept the NYS Office of Court Administration OC-960 form below.  See DOH MLTC Policy 13.24 

Right to Your Own Records -- This  2015 memo from the U.S. Health and Human Services Office of Civil Rights  enumerates patients’ rights to access their medical records.  In part, it provides authority that members of managed care insurance plans -- including Medicaid plans - have a right to their records at any time, not only when a hearing or other appeal is pending.   See also NYS DOH  Managed Long Term Care Guide  p. 17.  

Here are some examples of organization-specific HIPAA forms:

  1. New York State Office of Court Administration

    OCA Form No. 960 - Authorization for Release of Health Information Pursuant to HIPAA

THIS FORM MUST BE ACCEPTED BY:

  1. New York State Department of Health

DOH-2557 - HIPAA Compliant Authorization for Release of Medical Information and Confidential HIV Related Information (English)
DOH-2557 - Autorización para divulgar información médica e información confidencial relativa al VIH conforme a la ley de Responsabilidad y Transferibilidad de Seguros Médicos (HIPAA) (Español)

Myths and Facts About HIPPA - and Other Resources

Advocates often find that although HIPAA was intended to protect consumers, the law is often abused by agency or health provider or insurance  staff as a way to obstruct an individual's access to their own health information, or to refuse to provide even general information regarding agency practices. 

Q:  Does the Privacy Rule require that an authorization be notarized or include a witness signature?
 
A:  The Privacy Rule does not require that a document be notarized or witnessed.


 


This article was authored by the Evelyn Frank Legal Resources Program of New York Legal Assistance Group.

NYLAG



Article ID: 118
Last updated: 06 Jun, 2019
Revision: 7
HIPAA -> HIPAA Forms and Health Information Access and Privacy - Overview
http://health.wnylc.com/health/entry/118/