Click here to see an example of a completed HIPAA Authorization FORM

Note:

• This form is only used when “Protected Health Information” as defined by HIPAA is being used in the research study.
• “Use” always refers to how your project team will use the information within the project team/research study
• “Disclosure” always refers to who you may share the information with outside of the project team/research study

Section 1. Name & Contact Info

Your authorization should always clearly state the Title of Project, your Project Leader and the address & phone that the project leader can be reached at

Section 2. Purpose and Scope of Authorization

This section needs to explain what the purpose of this authorization is, who you are as the researcher and what covered entities (refer to them by the name) are involved in the project. Sample text is below:

You have agreed to (allow your child or a child in your custody) participate in the project identified above, and have signed a separate consent form that explains the project procedures and how your (child’s) information about (specify here what specific types of information you mean) will be collected and other generalized health information will be kept confidential. The project will be completed by (list the name(s) of the program(s) and/or organization(s) participating in the project here).

Because the federal government provides special protections for health information, this Authorization is required by privacy regulations that are a part of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), and other applicable laws. (The name of your program and any other organization that will have access to information should be listed here), are required to abide by the HIPAA Privacy Regulations. These programs/agencies are sometimes called a Covered Entity in the HIPAA law. This Authorization applies to (The name of your program and any other organization that will have access to information should be listed here to the extent that they provide protected health information to this project.

This Authorization legally permits(The name of your program and any other organization that will have access to information should be listed here), to use and disclose your protected health information for this project, but only in accordance with the restrictions outlined below.

The HIPAA Privacy Regulations use a special term to identify your protected health information – they call it “protected health information”, or “ PHI ”, for short. We refer to “ PHI ” below to mean your protected health information.

This Authorization gives you detailed information about how your PHI will be used, disclosed and protected in the context of this study, and answers the following questions:

Section 3: Participant Information

All ten questions listed in this section must be answered relevant to your project.

1. What PHI about you will be used or disclosed by (YOUR PROGRAM/ORGANIZATION NAME HERE)?
Please list the type of information that will be collected and for what purpose it will be used here.

2. Who within (YOUR PROGRAM/ORGANIZATION NAME HERE) may use or disclose your child’s PHI ?
Please list who either specific staff positions or types of staff that will be allowed to use and disclose information and for what purpose.

3. To whom may (YOUR PROGRAM/ORGANIZATION NAME HERE) disclose your child’s PHI?
Please list who will receive the information that is disclosed (either specific staff positions or types of staff) and for what purpose.

4. How long will (YOUR PROGRAM/ORGANIZATION NAME HERE) be able to use or disclose your (child’s) PHI ?
What is the length of time that information will be used and/or available for use.

5. Will you be able to access your (child’s) PHI associated with this study?
Indicate whether consumer will be able to see information during the course of this study, if not, please explain in lay terms why not.

6. What happens if you decide not to sign this Authorization?
Please indicate that the consumer is not obligated to sign this Authorization and indicate what a decision to not sign this Authorization will mean. It should be clear that this will have no effect on the consumers (or their family members) current or future service or care, or loss of benefits to which they are otherwise entitled or eligible.

7. Can you change your mind and revoke this Authorization?
Participants must be informed of their right to withdraw permission and that they must do so in writing, this section should tell them how to do so. You should indicate that even if participants choose to withdraw permission, the project leader may still use and disclose PHI that was collected before they withdrew, to the extent necessary to preserve the integrity of the study.

8. What happens once your PHI has been disclosed by (YOUR PROGRAM/ORGANIZATION NAME HERE), or your pediatrician?
Participants should understand that once you disclose PHI, as permitted by this Authorization, a re-disclosure of your PHI by the recipient will not be covered by this Authorization, and may not be subject to the HIPAA Privacy Regulations or other privacy laws.

9. Will the results of the study be presented in publications?
Participants should know if the results of the research study may be presented in publications, however they should be clears that their names and other personally identifying information will not be revealed in such publications.

10. Who should you contact with any questions or concerns regarding your privacy rights?
Participants should understand who to contact should they have any questions or concerns about their privacy rights, this should include the project leaders name and the Privacy Officer at the Agency of Human Services at ­­­802-241-2244.

Section 4: Participant Sign off

This section should clearly indicate that all of the information above has been explained to the participant and that all of their questions have been answered. They should understand that they may ask any additional questions at any time about the research use and disclosure of their PHI and they should know who to ask such as a any member, or a particular member of the project staff or the project leader.

It should end a clear statement & signature block such as the example below:

I have read this Authorization, and acknowledge that I am authorized to act on behalf of my child. By signing this Authorization, I agree to allow the use and disclosure of my child’s PHI for the purposes described above, and I agree to the other terms identified above. A copy of this Authorization (as signed below) will be given to me.

Child’s Name [print]: __________________________________________________

Parent or Custodian Signature: __________________________________________

Date: _______________________

To provide authorization for additional children in your custody, please list their names below.

If you are someone other than the custodial parent, please provide a description of your authority to act for the child:

Staff Person obtaining authorization [print]: ________________________________

Signature: __________________________________________________________

Date: _______________________