OKDHS - OAC 340:2-8-7. Authorization

340:2-8-7. Authorization

Back

|

Next

Issued 8-21-03

(a) A valid authorization is required to disclose protected health information (PHI) unless it is:

(1) for the purposes of treatment, payment, or health care operations; or
(2) listed specifically in OAC 340:2-8-6.

(b) An authorization is considered valid if:

(1) it contains the elements described at OAC 340:2-8-2;
(2) the expiration date has not passed; and
(3) the authorization is signed by the client, parent, guardian, or court-ordered personal representative of the client. • 1

(c) A client may revoke an authorization if the revocation is in writing. • 2

INSTRUCTIONS TO STAFF 340:2-8-7

1. (a) Oklahoma Department of Human Services (OKDHS) Form HIPAA-3, Authorization to Disclose Medical Records, is completed when a client requests protected health information disclosure to a third party.

(b) A copy of the valid authorization is provided to the client.

(c) Valid authorizations are kept in the client's file for at least six years.

2. A copy of the written revocation is attached to the original authorization and placed in the client's file.

Back

|

Next