HIPAA Compliance Checklist for Release of Information

HIPAA COMPLIANCE CHECKLIST & PROTOCOL FOR RELEASE OF INFORMATION (ROI)

DOCUMENT CONTROL

• Effective Date: [Effective Date]
• Version: 3.4 (Enterprise Production)
• Jurisdiction/Scope: United States Healthcare Operations, Covered Entities (CE), and Business Associates (BA) pursuant to 45 CFR Parts 160 and 164

---

1. OFFICIAL NOTICE & LEGAL DISCLAIMER

This document contains operational compliance protocols designed to align with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the Health Information Technology for Economic and Clinical Health (HITECH) Act, and associated implementing regulations. This checklist does not constitute formal legal advice. Covered Entities and Business Associates must independently verify operational workflows against state-specific medical privacy statutes (e.g., CMIA in California, Texas Medical Records Privacy Act) where such laws impose more stringent requirements than federal baselines.

---

2. PARTIES & DEFINITIONS

• Covered Entity / Business Associate: [Company/Entity Name], having its principal place of business at [Entity Address] ("Entity").
• ROI Officer / Compliance Lead: [Full Name of Compliance Officer], reachable at [Email Address] and [Phone Number].
• Designated Record Set (DRS): A group of records maintained by or for the Entity that is: (i) medical and billing records about individuals maintained by or for a covered health care provider; (ii) enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or (iii) used, in whole or in part, by or for the covered entity to make decisions about individuals.

---

3. OPERATIVE CLAUSES & PROTOCOLS

Phase I: Intake and Authorization Validation

1. Receipt of Request: All requests for the Release of Information (ROI) must be submitted in writing via the secure enterprise intake portal or through a physically signed and dated Authorization Form compliant with 45 CFR § 508.
2. Mandatory Core Elements Verification: Prior to processing any non-treatment, non-payment, or non-operations (TPO) request, the ROI Specialist must verify that the authorization contains all six (6) core elements mandated by 45 CFR § 164.508(c)(1):
   • Specific and meaningful description of the information to be used or disclosed.
   • Name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure.
   • Name or other specific identification of the person(s), or class of persons, to whom the Entity may make the requested use or disclosure.
   • Description of each purpose of the requested use or disclosure (stating "at the request of the individual" is sufficient for requests by individuals).
   • Expiration date or an event that relates to the individual or the purpose of the use or disclosure (e.g., "End of research study," "90 days from execution").
   • Signature of the individual (or legally authorized representative) and date. If signed by a representative, a verification of authority (e.g., Power of Attorney, Letters of Administration) must be appended.
3. Required Statements Verification: Ensure the authorization contains mandatory statements regarding:
   • The individual's right to revoke the authorization in writing and the exceptions/procedures for revocation.
   • The inability of the Entity to condition treatment, payment, enrollment, or eligibility for benefits on whether the individual signs the authorization (with limited exceptions under 45 CFR § 164.508(b)(4)).
   • The potential for information disclosed pursuant to the authorization to be subject to redisclosure by the recipient and no longer protected by HIPAA.
4. Defect Identification: If an authorization lacks any core element or required statement, or contains structural defects (e.g., expired date, obvious alteration, unverified intermediary), the request must be flagged as Invalid and rejected within the statutory timeframe.

Phase II: Minimum Necessary Standard & Scope Limitation

5. Application of Minimum Necessary: Pursuant to 45 CFR §§ 164.502(b) and 164.502(d), the Entity shall make reasonable efforts to limit Protected Health Information (PHI) to the minimum necessary to accomplish the intended purpose of the disclosure, unless an exception applies (e.g., disclosures to the individual, treatment disclosures, or pursuant to a valid HIPAA authorization).
6. Psychotherapy Notes Segregation: Psychotherapy notes (as defined in 45 CFR § 164.501) maintained by a mental health professional must never be released under a generic medical records authorization. Release of psychotherapy notes requires a separate, standalone authorization explicitly identifying psychotherapy notes, except for limited treatment, training, or defense-of-legal-actions exemptions under 45 CFR § 164.508(a)(2).
7. Substance Use Disorder Records (42 CFR Part 2): If the records originate from or relate to a federally assisted substance use disorder program, verify that the release complies with heightened 42 CFR Part 2 requirements, including explicit prohibition of redisclosure notices.

Phase III: Processing, Timing, and Statutory Compliance

8. Statutory Turnaround Times: The Entity shall fulfill requests for access or disclosure within [Insert State Mandate, e.g., 15] calendar days (or the federal maximum of 30 calendar days under 45 CFR § 164.524, whichever is stricter) from the date of receipt.
9. Single 30-Day Extension: If the Entity is unable to meet the initial deadline due to technical or geographical complexities, a written statement of the reasons for the delay and the expected date of fulfillment must be provided to the requestor prior to the expiration of the initial period. Only one extension is permitted.
10. Fee Calculation (Cost-Based Limitations): Fees charged for supplying a copy of the DRS (or a summary thereof) must be limited to a cost-based fee encompassing only:
    • Labor for copying the PHI requested (whether in paper or electronic form).
    • Supplies for creating the paper copy or electronic media (e.g., USB drive).
    • Postage, when the individual has requested the copy be mailed.
    • Preparation of an explanation or summary of the PHI, if agreed to by the individual in advance.
    • Note: No retrieval fees, search fees, or maintenance fees may be charged.

Phase IV: Transmission Security and Verification of Identity

11. Identity Verification: Prior to releasing PHI, the identity and authority of the requestor must be verified pursuant to 45 CFR § 164.514(h) (e.g., government-issued photo ID, institutional credentials, or cryptographic verification for digital portals).
12. Secure Transmission Protocol:
    • Electronic PHI (ePHI): Must be transmitted via encrypted channels (AES-256 or TLS 1.3 compliant transfer protocols, secure SFTP, or encrypted email). Unencrypted email may only be utilized if the individual has been warned of security risks in writing and explicitly opts in to unencrypted delivery.
    • Physical PHI: Must be packaged in opaque, double-wrapped envelopes or secure containers and shipped via tracked courier service (e.g., certified mail, UPS, FedEx).

Phase V: Accounting of Disclosures and Audit Trail Logging

13. Mandatory Logging: Every executed ROI transaction must be logged in the enterprise audit ledger ([System/Database Name]) with the following immutable data points:
    • Date of request and date of fulfillment/denial.
    • Name and contact information of the recipient.
    • Brief description of the PHI disclosed.
    • Brief statement of the purpose of the disclosure (or attached authorization/legal mandate).
14. Accounting Availability: The disclosure log must be maintained for a minimum of six (6) years from the date of creation and made available to the individual upon request pursuant to 45 CFR § 164.528.

---

4. SIGNATURES & ACKNOWLEDGMENT BLOCK

By signing below, the designated compliance officers and operational supervisors attest that the protocols outlined in this checklist have been reviewed, integrated into operational workflows, and will be enforced in strict accordance with HIPAA regulatory mandates.

For the Covered Entity / Business Associate:

---

Authorized Compliance Officer Signature

Printed Name: [Full Legal Name of Officer]
Title: [Title, e.g., Chief Privacy Officer]
Date: [Date of Execution]

---

For the Operations / ROI Department Lead:

---

Operations Lead Signature

Printed Name: [Full Legal Name of Operations Lead]
Title: [Title, e.g., Director of Health Information Management]
Date: [Date of Execution]

---

5. STEP-BY-STEP EXECUTION GUIDE

1. Intake & Audit: Upon receiving any request for patient records, route the documentation directly to the Health Information Management (HIM) department to cross-check against Phase I (Core Elements Verification) before opening a tracking ticket.
2. Scope Enforcement: Apply Phase II filters strictly. Separate Psychotherapy Notes and verify state-specific statutes if the request involves minors, substance use data, or infectious disease records.
3. Fulfillment & Security: Execute the transmission within the statutory timeline using cost-based fee schedules (Phase III) and ensure end-to-end encryption or secure tracked courier services as outlined in Phase IV.
4. Archiving: Immediately log the transaction details into the permanent enterprise ledger (Phase V) to ensure compliance with the 6-year HIPAA audit trail retention rule.