Library: Policy
340:2-8-7. Authorization
Revised 9-16-19
(a) A valid authorization is required to disclose protected health information (PHI) unless it is:
(1) for the purposes of treatment, payment, or health care operations; or
(2) listed in Oklahoma Administrative Code (OAC) 340:2-8-6.
(b) An authorization is considered valid, when:
(1) it contains the elements described, per Section 164.508(c) of Title 45 of the Code of Federal Regulations and OAC 340:2-8-2;
(2) the expiration date has not passed; and
(3) the authorization is signed by the client, parent, guardian, or client's personal representative. • 1
Revised 9-16-19
1.(a) The client, parent, guardian, or client's court-ordered personal representative completes and signs Oklahoma Department of Human Services (DHS) Form 13HI003E, Authorization to Disclose Medical Records, when he or she wants DHS to disclose protected health information to a third party.
(b) DHS staff gives a copy of Form 13HI003E to the client.
(c) Valid authorizations must be kept in the client's case record for at least six years.
2.DHS staff attaches a copy of the written revocation to original Form 13HI003E and images or files the documents in the client's case record.
