Skip to main content

Policy/Memo 117

Number: Policy Memo 117
Date Issued: April 14, 2003
Policy File Ref: A1820
Subject: Uses and Disclosures of PHI and Authorization Requirements

ISSUE:

Authorization for Use or Disclosure of PHI

PURPOSE:

To issue instructions to EBD workforce members regarding the 'Authorization for Release of Health Information' form for using and disclosing protected health information (PHI), and necessary documentation of authority for such use or disclosure, when use/disclosure is for purposes outside of those permitted or required by law relating to treatment, payment or health care operations, or public responsibilities.

Policy:

Except as otherwise permitted or required by law, EBD may not use or disclose PHI without a valid authorization from the individual. Once an authorization is received, all uses and disclosures must be consistent with the authorization. An individual has the right to revoke, in writing, a previous authorization, except to the extent that EBD has already taken action in reliance upon the authorization.

EBD will not condition enrollment in a health plan or eligibility for benefits on the provision of authorization.

If EBD seeks an authorization from an individual, EBD must provide individual with a copy of the signed authorization.

Procedure:

Authorization
When an individual requests EBD to release information to a third party, in a way not otherwise permitted or required by law or regulation, the individual must be instructed to complete an "Authorization for Release of Health Information" and return it to EBD.

If the individual submits a substantively equivalent request containing all required elements and statements, the request will be considered valid and must be accepted. To be substantively equivalent the authorization must contain at least the following elements:

Core Elements

  • Adequate description of information to be used or disclosed.
  • Names or other means of identifying those authorized to use or disclose PHI.
  • Names or other means of identifying those authorized to receive PHI.
  • Description of purpose of each use or disclosure, or the statement "at the request of the individual".
  • An expiration date or event. For research can use "end of research" or "none" or similar.
  • Signature of the individual and date.
  • If by personal representative, a description or that person's authority to act for the individual.

Required Statements

  • Description of the individual's right to revoke authorization.
  • Statement that EBD will not condition treatment, payment, enrollment or eligibility for benefits on the authorization.

Revocation
An individual requesting to revoke a previous authorization must submit a request in writing to the EBD Privacy Official. The revocation must indicate the authorization to which it pertains and contain the individual's signature and date. The Privacy Official will review the request to determine its applicability. Specifically, the revocation will not be effective to the extent that actions have already been taken in reliance upon the original authorization. If the revocation is valid, the privacy official will take all necessary steps to rescind the authorization currently in place and to prevent future disclosures in reliance upon the original authorization.

Documentation
All authorizations and revocations must be entered into the EBD document imaging system. All completed authorizations and revocations must be maintained by EBD for six (6) years from its date of execution or the last date it was effective, whichever is later. All ineffective authorizations must be maintained by EBD for six (6) years from the date of execution.

NEW YORK STATE HEALTH INSURANCE PROGRAM (NYSHIP)
NEW YORK STATE DEPARTMENT OF CIVIL SERVICE EMPLOYEE BENEFITS DIVISION

AUTHORIZATION FOR RELEASE OF HEALTH INFORMATION

Please complete all sections of this form. This authorization for release of information will not be valid until all sections are completed.

I (please print your name) ______________________________________________ hereby authorize and direct the release of individually identifiable health information as described below.

Fill in the name of the person whose Protected Health Information you are authorizing use or disclosure:

Name:

ID Number:

Indicate your relationship to this person
Self Parent Guardian Personal Representative (Please provide documentation, ie. Court Order, Power of Attorney, Health Care Proxy, etc.)

Persons Authorized to Make Disclosure

Please indicate by name or other identification the person(s) or class of persons authorized to make the requested use or disclosure: Please list the name and address of the person(s) or organization(s) to which you want the information provided:

Name: _____________________________________________________________________________________________
Street Address: ______________________________________________________________________________________
City, State, Zip: ______________________________________________________________________________________
Name: _____________________________________________________________________________________________
Street Address: ______________________________________________________________________________________
City, State, Zip: ______________________________________________________________________________________Please indicate the information to be released

Please indicate the purpose(s) for this release:

This authorization for use/disclosure is for the following purpose:
____ Per request of individual
____ Other (please describe):

Expiration of Authorization

Please specify the expiration date or event of this authorization: ____________________________________________

This authorization will remain effective for twelve (12) months from the date of my signature unless an earlier date or event is specified.

Terms for Termination/Revocation:

I understand that I have the right to revoke this authorization, in writing, at any time, and that the revocation will be effective except to the extent that action has already been taken in reliance on my authorization. My written statement that I want to revoke my authorization should be delivered to:

EBD Privacy Official
NYS Department of Civil Service
Building 1, State Campus
Albany, NY 12239

Required Signatures:

I authorize release of the above specified information as indicated:

Signature ID Number Date

Please keep a copy of this form for your records.

Personal Privacy Protection Law Notification:
This information you provide on this application is requested for the principal purpose of enabling the Department of Civil Service to process your authorization to use or disclose protected health information. This information will be used in accordance with Section 96 (1) of the Personal Privacy Protection Law, particularly subdivisions (b), (e) and (f). This information will be maintained by the Director of the Employee Benefits Division, NYS Department of Civil Service, The State Campus, Albany, NY 12239. For information concerning the Personal Protection Law, call (518) 457-9375. If you have a question, regarding this form or the health insurance coverage, please call (518) 457-5754 or 1-800-833-4344 between the hours of 9:00 a.m. and 3:00 p.m.