Skip to main content

Library: Policy

340:2-8-7. Authorization

Revised 9-16-19

(a) A valid authorization is required to disclose protected health information (PHI) unless it is:

(1) for the purposes of treatment, payment, or health care operations; or

(2) listed in Oklahoma Administrative Code (OAC) 340:2-8-6.

(b) An authorization is considered valid, when:

(1) it contains the elements described, per Section 164.508(c) of Title 45 of the Code of Federal Regulations and OAC 340:2-8-2;

(2) the expiration date has not passed; and

(3) the authorization is signed by the client, parent, guardian, or client's personal representative.  • 1

(c) A client may only revoke an authorization in
writing.  • 2

Revised 9-16-19

1.(a) The client, parent, guardian, or client's court-ordered personal representative completes and signs Oklahoma Department of Human Services (DHS) Form 13HI003E, Authorization to Disclose Medical Records, when he or she wants DHS to disclose protected health information to a third party.

(b) DHS staff gives a copy of Form 13HI003E to the client.

(c) Valid authorizations must be kept in the client's case record for at least six years.

2.DHS staff attaches a copy of the written revocation to original Form 13HI003E and images or files the documents in the client's case record.

Back to Top