Under HIPAA, a patient’s written authorization for a health care provider to disclose the patient’s protected health information to a third party must, by its terms, expire either upon a) the occurrance of a specified event or b) a date certain. HIPAA puts no limit on how long these time periods can be.
Therefore, when creating a HIPAA-compliant authorization form, a provider can select as long a time period as desired. However, under Nebraska law, an authorization to release a patient’s medical records must expire no more than 180 days after the patient signs it. This particular Nebraska statute is not preempted by HIPAA.
Although some Nebraska providers use authorization forms that limit the period for all disclosures to 180 days from execution, Nebraska law only limits authorizations to disclose medicial records to 180 days. Therefore, a single authorization form can be drafted in such a way as to provide that it will expire in 180 days only for purposes of authorizing medical records releases, but have a much longer shelf life for purposes of disclosures other than releases of medical records.
The main reason many providers (wisely) require all patients to sign a disclosure authorization is to cover the frequent and ongoing verbal discussions they have with others who accompany patients to their appointments and/or assist them with paying their bills (such as the adult children of elderly patients or the parents of college students). Rather than having patients re-execute authorizations every 180 days to cover these types of discussions, providers may wish to consider using an authorization form with a 180 day expiration that is limited to the authorization to release medical records. Then, after 180 days, the provider can have the patient execute a new authorization if medical records need to be released. Otherwise, the authorization will remain good for the type of day-to-day disclosures it is mainly intended to cover.