6.00 - AUTHORIZATION FOR USE OR DISCLOSURE OF PROTECTED HEALTH INFORMATION

I. Purpose:
To issue instructions to all ADAMH workforce members regarding the use and disclosure of protected health information (PHI), and necessary documentation of authority for such use or disclosure, when use/disclosure is for purposes outside of those permitted relating to treatment, payment or health care operations, or under other provisions of law.

II. Applicability:
This policy applies to all ADAMH workforce members.

III. Authority:
45 CFR Parts 160 & 164

IV. Definitions:

Disclosure means the release, transfer, provision of access to, or divulging in any other manner of information outside the entity holding the information.

Use means with respect to individually identifiable health information, the sharing, employment, application, utilization, examination, or analysis of such information within an entity that maintains such information.

Protected Health Information (PHI) means individually identifiable information relating to the past, present or future physical or mental health or condition of an individual, provision of health care to an individual, or the past, present or future payment for health care provided to an individual.

Treatment, Payment and Operations (TPO) includes all of the following:

Treatment means the provision, coordination, or management of health care and related services, consultation between providers relating to an individual, or referral of an individual to another provider for health care.
Payment means activities undertaken to obtain or provide reimbursement for health care, including determinations of eligibility or coverage, billing, collection activities, medical necessity determinations and utilization review.
Operations includes functions such as quality assessment and improvement activities, reviewing competence or qualifications of health care professionals, conducting or arranging for medical review, legal services and auditing functions, business planning and development, and general business and administrative activities.

Personal Representative means a person who has authority under applicable law to make decisions related to health care on behalf of an adult or an emancipated minor, or the parent, guardian, or other person acting in loco parentis who is authorized under law to make health care decisions on behalf of an unemancipated minor, except where the minor is authorized by law to consent, on his/her own or via court approval, to a health care service, or where the parent, guardian or person acting in loco parentis has assented to an agreement of confidentiality between the provider and the minor.

Workforce Members means Board of Trustees members, employees, volunteers, trainees, and other persons whose conduct, in the performance of work for ADAMH, is under the direct control of ADAMH, regardless of whether they are paid by ADAMH.

V. Policy:

1. Generally: In compliance with 45 CFR Part 164 and Ohio law, all uses and disclosures of PHI beyond those otherwise permitted or required by law (See 5.00 Use Or Disclosure of Protected Health Information For Treatment, Payment or Health Care Operations Purposes) require a signed authorization according to the provisions of this rule. An authorization is required for each entity that is to receive PHI.
   1. As a Covered Entity, ADAMH may not condition the provision of treatment, payment, or enrollment in the health plan or eligibility for benefits on the provision of an authorization.
   2. As a Health Plan, ADAMH may condition enrollment in the health plan or eligibility for benefits on provision of an authorization requested by ADAMH prior to an individual's enrollment in the health plan if the authorization sought is for the ADAMH's eligibility or enrollment determinations relating to the individual or for its underwriting or risk rating determinations.
2. Content Requirements: Each authorization for the use or disclosure of an individual's PHI shall be written in plain language and shall include at least the following information:
   1. A specific and meaningful description of the information to be used or disclosed;
   2. The name or identification of the person or class of person(s) authorized to make the use or disclosure;
   3. The name or identification of the person or class of person(s) to whom the requested use or disclosure may be made;
   4. A description of each purpose of the requested use or disclosure. The statement, "at the request of the individual" is a sufficient description of the purpose when an individual initiates the authorization and does not, or elects not to, provide a statement of the purpose.
   5. An expiration date, condition or event that relates to the individual or the purpose of the use or disclosure.
   6. A statement of the individual's right to revoke the authorization in writing, and exceptions to the right to revoke, together with a description of how the individual may revoke the authorization. Upon written notice of revocation, further use or disclosure of PHI shall cease immediately except to the extent that the ADAMH workforce member has acted in reliance upon the authorization or to the extent that use or disclosure is otherwise permitted or required by law;
   7. Other statement that treatment, payment, enrollment or eligibility cannot be conditioned on the individual signing the authorization or statement setting forth consequences of not signing;
   8. The dated signature of the individual, and;
   9. If the authorization is signed by a personal representative of the individual, a description of the representative's authority to act on behalf of the individual.
   10. A statement that the individual may inspect or copy the PHI to be used or disclosed;
   11. A statement that the individual may refuse to sign the authorization;
   12. If applicable, a statement that the use or disclosure will result in direct or indirect remuneration from a third party, and;
   13. The potential for information disclosed pursuant to the authorization to be subject to re-disclosure by the recipient and no longer be protected by this subpart.
   14. Retention: A written or electronic copy of the authorization must be retained for a period of six (6) years from the later of the date of execution or the last effective date.
   15. Copy to be Provided: If ADAMH is seeking the authorization, a copy of the authorization must be provided to the individual.