1640.020 HIPAA PRIVACY: OBTAINING INDIVIDUAL AUTHORIZATION FOR USE AND DISCLOSURE OF PROTECTED HEALTH INFORMATION
Except as permitted or required by the HIPAA Privacy Rule, all health care components of Florida International University must obtain written authorization of the individual prior to the use or disclosure of protected health information (“PHI”). In order to be valid, the authorization must contain the minimum elements prescribed by the HIPAA Privacy Rule as set forth below. All uses and disclosures of PHI made pursuant to an authorization must be consistent with the authorization.
All authorizations must be documented and retained for a period of no less than six (6) years from the date of the authorization’s expiration. The health care component seeking an authorization from an individual for a use or disclosure of PHI must provide to the individual a copy of the signed authorization. Authorizations may be revoked in accordance with federal law.
Published on 2017-12-13
Administrative Oversight & Contact Information
Office of University Compliance & Integrity
University Compliance & Privacy Officer
- Phone: 305--348-2216