Health Care Privacy Compliance Handbook, 3rd Edition

Required Elements

If you sign this document, you give permission to [name or other identification of specific health care provider(s) or description of classes of persons, e.g., all doctors, all health care providers] at [name of covered entity or entities] to use or disclose (release) your health information that identifies you for the research study described here:

[Provide a description of the research study, such as the title and purpose of the research.]

The health information that we may use or disclose (release) for this research includes [complete as appropriate]:

[Provide a description of the information to be used or disclosed for the research project. This may include, for example, all information in a medical record, results of physical examinations, medical history, lab tests, or certain health information indicating or relating to a particular condition.]

The health information listed above may be used by and/or disclosed (released) to:

[Name or class of persons involved in the research; i.e., researchers and their staff*]

_______________________________________________

*Where a covered entity conducts the research study, the Authorization must list ALL names or other identification, or ALL classes, of persons who will have access through the covered entity to the protected health information (PHI) for the research study (e.g., research collaborators, sponsors, and others who will have access to data that includes PHI). Examples may include, but are not limited to the following:

• Data coordinating centers that will receive and process PHI;

• Sponsors who want access to PHI or who will actually own the research data; and/or

• Institution Review Boards or Data Safety and Monitoring Boards.

If the research study is conducted by an entity other than the covered entity, the authorization need only list the name or other identification of the outside researcher (or class of researchers) and any other entity to whom the covered entity is expected to make the disclosure.

_______________________________________________

[Name of covered entity] is required by law to protect your health information. By signing this document, you authorize [name of covered entity] to use and/or disclose (release) your health information for this research. Those persons who receive your health information may not be required by Federal privacy laws (such as the Privacy Rule) to protect it and may share your information with others without your permission, if permitted by laws governing them.

Please note that [include the appropriate statement]:

• You do not have to sign this Authorization, but if you do not, you may not receive research-related treatment. (When the research involves treatment and is conducted by the covered entity or when the covered entity provides health care solely for the purpose of creating protected health information to disclose to a researcher).

• [Name of covered entity] may not condition (withhold or refuse) treating you on whether you sign this Authorization. (When the research does not involve research-related treatment by the covered entity or when the covered entity is not providing health care solely for the purpose of creating protected health information to disclose to a researcher)

Please note that [include the appropriate statement]:

• You may change your mind and revoke (take back) this Authorization at any time, except to the extent that [name of covered entity(ies)] has already acted based on this Authorization. To revoke this Authorization, you must write to: [name of the covered entity(ies) and contact information]. (Where the research study is conducted by an entity other than the covered entity)

• You may change your mind and revoke (take back) this Authorization at any time. Even if you revoke this Authorization, [name or class of persons at the covered entity involved in the research] may still use or disclose health information they already have obtained about you as necessary to maintain the integrity or reliability of the current research. To revoke this Authorization, you must write to: [name of the covered entity(ies) and contact information]. (Where the research study is conducted by the covered entity)

This Authorization does not have an expiration date [or as appropriate, insert expiration date or event, such as “end of the research study.”]

Optional Elements

Examples of optional elements that may be relevant to the recipient of the protected health information:

• Your health information will be used or disclosed when required by law.

• Your health information may be shared with a public health authority that is authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury, or disability, and conducting public health surveillance, investigations or interventions.

• No publication or public presentation about the research described above will reveal your identity without another authorization from you.

• If all information that does or can identify you is removed from your health information, the remaining information will no longer be subject to this authorization and may be used or disclosed for other purposes.

• When the research for which the use or disclosure is made involves treatment and is conducted by a covered entity: To maintain the integrity of this research study, you generally will not have access to your personal health information related to this research until the study is complete. At the conclusion of the research and at your request, you generally will have access to your health information that [name of the covered entity] maintains in a designated record set, which means a set of data that includes medical information or billing records used in whole or in part by your doctors or other health care providers at [name of the covered entity] to make decisions about individuals. Access to your health information in a designated record set is described in the Notice of Privacy Practices provided to you by [name of covered entity]. If it is necessary for your care, your health information will be provided to you or your physician.

• If you revoke this Authorization, you may no longer be allowed to participate in the research described in the Authorization.