264-What is the difference between consent and authorization under the HIPAA Privacy Rule. The Privacy Rule permits, but does not require, a covered entity voluntarily to obtain patient consent for uses and disclosures of protected health information for treatment, payment, and health care operations.

An authorization form is a document that is duly endorsed by an individual or organisation which grants permission to another individual or organisation to proceed with certain actions. It is often used to grant permission to carry out a specific action for a fixed period of time.

Consent refers to the patient's giving permission for electronic medical records to be released to third parties involved in treatment, utilization review, insurance payment, quality assurance, and continuity of care. Authorization is required for all other uses to which a patient's medical records may be put.

A HIPAA authorization is consent obtained from an individual that permits a covered entity or business associate to use or disclose that individual's protected health information to someone else for a purpose that would otherwise not be permitted by the HIPAA Privacy Rule.

What Is a Medical Authorization Form? A typical medical authorization form grants authorization from you, the patient, to a third party, like your insurance company, for access to your medical records. Depending on the agreement, the scope may be limited or broad.

Patient consent form Although not specifically required by HIPAA, you may also want to consider using a Patient Consent Form in your practice ( download here. ). A consent form specifies methods by which a patient agrees to let your practice use his or her protected information for routine TPO purposes.