The Missing Consent for a Record Request
You are a health information management technician at a community health center. A law firm sends a records request for a patient, Angela Brooks, requesting 'all records from 2019 to present' related to a personal injury case. The request includes a signed authorization form. You notice the authorization lists the patient's name and DOB correctly, but the date on the patient signature line is blank, and the form does not specify the dates of service or the purpose of the disclosure. The law firm's courier is waiting and says they need the records today for a filing deadline. The center's release-of-information policy requires a complete authorization before release.
1. Is the authorization valid? Identify the missing elements and explain why each matters.
Read the worked answer
The authorization is not valid as presented. Missing elements:
- Patient signature date: Without a date, you cannot confirm when authorization was given or whether it is current. HIPAA requires a date on the signature.
- Dates of service or scope: 'All records from 2019 to present' is broad; a valid authorization should specify the date range or the specific records. This matters because releasing more than authorized is a privacy violation.
- Purpose of disclosure: The form does not state the purpose (e.g., litigation). HIPAA requires the purpose to be stated.
Other elements to check: right to revoke, expiration date or event, statement that the patient may refuse to sign, and the signature of a personal representative if applicable. Each missing element weakens the authorization's validity and increases breach risk.
2. The courier is pressing for same-day release. What should you do, and what would you communicate to the law firm?
Read the worked answer
Do not release the records. The filing deadline does not override the requirement for a valid authorization.
Steps:
- Politely explain that the authorization is incomplete and cannot be processed as submitted.
- Identify the specific missing items: signature date, dates of service/scope, and purpose.
- Offer to expedite processing once a corrected authorization is received, and provide a fax/secure email option.
- Document the request, the deficiency, and the communication.
- Notify your supervisor or Privacy Officer per policy.
Communication example: 'We received your request. The authorization is missing the patient signature date, the dates of service, and the purpose of disclosure. We cannot release records until these are provided. Once we receive a corrected form, we will process it promptly.'
3. The law firm sends a corrected authorization the next morning, but it now requests records through 'the present date' and includes a note that the patient 'waives all privacy rights.' How should you respond?
Read the worked answer
Two issues:
- Scope: 'Through the present date' is still broad but may be acceptable if the patient signed it and the scope is clear. Confirm the date range is what the patient intended.
- Waiver language: A patient cannot waive HIPAA rights, and a provider cannot rely on such a waiver. The 'waives all privacy rights' statement is not enforceable and should not be treated as authorization to release more than the patient authorized.
Response:
- Process only what the valid authorization permits.
- Do not honor the waiver language; it has no legal effect on HIPAA obligations.
- If the scope is ambiguous, contact the patient or the law firm to clarify.
- Document the review and the decision.
- Consult the Privacy Officer if there is any question about the authorization's validity.