The Ohio Department of Medicaid (ODM) recently developed standard authorization forms for the use and disclosure of protected health information under new rule Ohio Administrative Code Section 5160-1-32.1.

The forms can be accessed in Appendix A to the new rule.

  • Form A is used for disclosure of protected health information by covered entities where HIPAA requires a patient authorization (and complies with all HIPAA requirements for a patient authorization).
  • Form B is used for disclosure of substance use disorder information by a 42 CFR Part 2 (Part 2) provider (and complies with all Part 2 requirements for a patient consent). This form only applies to federally assisted Part 2 programs, not all substance use disorder records.

Instructions for using the forms are contained in Appendix B to the rule.

The purpose of the standard forms is to improve care coordination for patients across multiple providers by making it easier to securely share protected health information. Providers are not required to use the forms, but a properly executed form that adequately identifies the individual must be accepted by any person or governmental entity in Ohio specified on the form as a valid authorization for the use or disclosure of the individual’s protected health information.

Providers should note the following:

  • Providers are only required to accept a standard authorization form if properly executed, meaning that all required fields are completed and the form identifies the records associated with the individual.
  • Providers are not required to adopt the forms as their own, and they may accept a valid authorization for the use or disclosure of protected health information in a form other than the standard authorization form as long as it meets all requirements of a valid authorization under HIPAA and, if applicable, Part 2.
  • The new rule does not require a provider to obtain an authorization or use the standard authorization form when use or disclosure of the information is required or permitted without such authorization under HIPAA and, if applicable, Part 2.
  • While ODM developed the new authorization forms, they can be used (and must be accepted) in any situation that requires a HIPAA or Part 2 authorization form in Ohio.
  • Form A is not a patient access request form.

Providers must begin accepting properly executed standard authorization forms on February 2, 2019.