 |
Part 3: Uses and Disclosures (FAQ 62 of
65)
62. What Should I Do if Asked to Sign an Authorization to Disclose
my Record?
Although not everyone who asks you to sign an authorization will have
a sinister motive, you should be cautious in signing an authorization
for more disclosure of your information. Here are some things to look
out for.
- Does the authorization say that all of your information can be disclosed?
If you are authorizing disclosure to another physician who is treating
you, a broad authorization may be appropriate. If you are authorizing
disclosure to a life insurance company, the company will likely insist
on a broad authorization as part of the application process. However,
if the authorization is for disclosure to your employer to explain your
absence from work, you may want to be sure that the authorization only
covers your recent illness and not records from the past. You may not
want your employer to know, for example, that you were treated for a
psychiatric ailment ten years ago.
- Is there an expiration date or event for the authorization? There
should be in nearly all cases. You should try to understand why the
date or event was chosen and be very suspicious of any open-ended authorizations.
Some long-term research activities may be able to justify not having
an expiration date. Otherwise, you should try to insist on a short expiration
date or near-term event.
- Is the person authorized to receive the information properly described?
It is okay if the form says ABC Life Insurance Company rather than the
name of a specific individual at the company. However, if the form is
too vague (e.g., "bearer";), then you should definitely think twice.
- Is the purpose for the disclosure properly described? This can be
tricky because if you tell the covered entity why you are authorizing
the disclosure, you may be revealing information that you don't want
to reveal and don't have to share. It is okay to sign a form that merely
describes the purpose as "at the request of the individual." However,
we wouldn't sign an authorization written that way without a good reason.
By stating a purpose, you may limit what the recipient can do with the
information. Anyone seeking an authorization in good faith should be
willing to include an appropriate purpose and, if someone does not suggest
a narrow purpose, you should be wary.
- Is the disclosure for a marketing activity? We would never allow
a disclosure for a marketing purpose, no matter what the inducement.
Once a marketer obtains your information, the marketer can use it, keep
it, and sell it without any restriction. Don't give away your
privacy for a t-shirt.
We want to emphasize that while we think that you should be cautious
in signing authorizations, in some circumstances it will be the right
thing to do. Being asked to sign an authorization should happen infrequently
enough that you can spend a little time asking questions.
We would be cautious if asked to sign an authorization as part of the
process for admission to a hospital. The HIPAA rule allows the hospital
to make all the disclosure necessary for your care and for the hospital's
operations. If you are presented with an authorization to sign, ask questions.
We have heard that some hospitals routinely collect authorizations that
allow disclosures to employers. That is a type of disclosure that you
may not want to permit without a specific reason. The hospital may seek
a broad authorization for its own convenience so that it can make a disclosure
without getting your signature later. We suggest that any extra paperwork
may be worth it, because it may protect you. You can decline to sign the
authorization or you can limit its effectiveness to the period while you
are in the hospital or perhaps for an additional week.
SIDEBAR: The HIPAA rule expressly provides that no one can condition
treatment, payment, or enrollment in a health plan on signing an authorization.
This is an important protection, and if anyone says "sign or leave",
you should be extremely suspicious and ask for a written explanation that
you can take with you. There is a limited exception to this policy if
you are enrolling in a research activity involving treatment. Another
exception allows a health plan to require an authorization for an individually
underwritten health policy. There is one other complex but minor exception
to the rule.
|
|
