An individual's personal representative (generally, a person with authority under State law to make health care decisions for the individual) also has the right to access PHI about the individual in a designated record set (as well as to direct the covered entity to transmit a copy of the PHI to a designated person or ...
(a) Patients may authorize the release of their health care information by completing the CDCR 7385, Authorization for Release of Protected Health Information, to allow a family member or friend to request and receive an update when there is a significant change in the patient's health care condition.
Patients have a right to determine how and what parts of their health information is shared. Further, any individual or company seeking to access a patient's most confidential medical information must comply with federal and state law and develop or have an established trusted relationship with the patient.
Any qualified person who may access records on behalf of a patient under State law is a personal representative with a right of access under federal law. Parents have a right of access to their children's medical records under federal law to the same extent that they have that right under state law.
Content for a valid authorization includes: The name of the person or entity authorized to make the request (usually the patient) The complete name of the person or entity to receive the protected health information (PHI) A specific description of the information to be used or disclosed, including the dates of service.
Q: Do I need to notarize the signed form? A: No. The HIPAA Privacy Rule does not require you to notarize authorization forms or have a witness.
A covered entity may disclose PHI without the individual's permission for treatment, payment, and health care operations purposes. For other uses and disclosures, the Privacy Rule generally requires the individual's written permission, which is an “authorization” that must meet specific content requirements.