Apatient authorization for disclosure of phi must include

A patient authorization for disclosure of PHI must include all of the elements required by the HIPAA medical privacy rule.

" What health information will be disclosed Who will disclose the information Who will receive the information The purpose(s) for disclosing the information A statement informing the patient of (1) his or her right to revoke the authorization in writing, (2) how to revoke the authorization, and (3) any exceptions to the right to revoke A statement that the hospital cannot require the patient to sign the authorization in order to receive treatment or payment or to enroll or be eligible for benefits A statement that information disclosed pursuant to the authorization may be redisclosed by the recipient and no longer protected by the federal privacy regulations A statement that the authorization will expire: (1) on a specific date, (2) after a specific amount of time (e.g., 5 years), or (3) upon the occurrence of some event related to the patient The signature of the patient and the date. Note: If the patient’s personal representative signs the authorization, the authorization also must include a description of that person’s authority to act for the patient. If the authorization is for marketing purposes and the hospital will receive direct or indirect remuneration from a third party, the authorization also must include, in addition to all of the elements listed above: A statement that the hospital will receive direct or indirect remuneration in connection with the use or disclosure of the patient’s information for marketing. "