Texas HIPAA release form: the AG standard form, electronic disclosures and Chapter 74

Texas adds a state layer on top of HIPAA. The Texas Medical Records Privacy Act is Chapter 181 of the Health and Safety Code, and its section 181.154 governs electronic disclosures of health information (Texas Health and Safety Code Chapter 181 (sections 181.102 and 181.154)). Because most records now move electronically, that section reaches nearly every release a Texas provider makes outside routine care.

Section 181.154 also told the Attorney General to adopt a standard authorization form (Texas Health and Safety Code Chapter 181 (sections 181.102 and 181.154)). The form on the Attorney General’s site is marked effective June 2013, and its own instructions say covered entities may use it or any other form that complies with HIPAA and Texas law (Texas Attorney General, Authorization to Disclose Protected Health Information).

A different Texas form applies to malpractice claims. Civil Practice and Remedies Code 74.052 prints the exact authorization a claimant must send with the pre-suit notice of a health care liability claim (Texas Civil Practice and Remedies Code 74.051 and 74.052).

The patient or the patient’s legally authorized representative signs it (Texas Health and Safety Code Chapter 181 (sections 181.102 and 181.154)). A Texas hospital or clinic usually hands over its own version. The release-of-information office is the provider department that receives these forms and sends the records; a law firm, insurer or family member can bring the Attorney General’s form or a template like the one below. The provider checks it before any electronic release, because Texas requires a separate authorization for each one (Texas Health and Safety Code Chapter 181 (sections 181.102 and 181.154)).

1. Ask the provider’s release-of-information office which form it takes, such as its own or the Attorney General’s standard form.
2. For a general release, fill in the template below or the Attorney General’s PDF, one per provider.
3. For a health care liability claim, copy the statutory form from Civil Practice and Remedies Code 74.052 word for word (Texas Civil Practice and Remedies Code 74.051 and 74.052).
4. Sign, date, keep a copy, and send it with a note saying whether you want paper or electronic records.

• Reusing one signed authorization for a second electronic disclosure, when Texas asks for a separate one each time.
• A generic release sent with a health care liability notice instead of the 74.052 form (Texas Civil Practice and Remedies Code 74.051 and 74.052).
• Leaving the initials blank for mental health, genetic, substance use or HIV records on the Attorney General’s form, so those records stay out (Texas Attorney General, Authorization to Disclose Protected Health Information).
• A medical power of attorney holder signing without describing that authority on the form.

Start from what you need the records for. The table maps the situation to the form and the rule behind it.

Under section 181.154(b), a covered entity may not disclose a person’s health information electronically without a separate authorization for each disclosure (Texas Health and Safety Code Chapter 181 (sections 181.102 and 181.154)). The authorization may be written, electronic, or oral if the entity documents it in writing (Texas Health and Safety Code Chapter 181 (sections 181.102 and 181.154)).

The rule does not apply to disclosures to another covered entity for treatment, payment, health care operations or certain insurance functions, or where other law allows it (Texas Health and Safety Code Chapter 181 (sections 181.102 and 181.154)). Covered entities must also post a general notice that health information may be disclosed electronically, for example in the office or on their website (Texas Health and Safety Code Chapter 181 (sections 181.102 and 181.154)).

The state’s form follows the federal elements and adds a few choices of its own (Texas Attorney General, Authorization to Disclose Protected Health Information). Knowing them helps when you compare it with a hospital’s version.

• Separate initials for mental health records excluding psychotherapy notes, genetic information, drug, alcohol or substance abuse records, and HIV/AIDS test results or treatment (Texas Attorney General, Authorization to Disclose Protected Health Information). Records from a federally assisted substance use disorder program may also need a consent that meets 42 CFR 2.31 (42 CFR 2.31, Consent requirements for substance use disorder records).
• A default end point: the authorization lasts until the patient dies, a minor reaches the age of majority, permission is withdrawn, or an optional date passes (Texas Attorney General, Authorization to Disclose Protected Health Information).
• Revocation by written notice to the recipient named on the form, without undoing earlier actions taken in reliance on it (Texas Attorney General, Authorization to Disclose Protected Health Information).
• A line for a minor’s own signature where Texas law lets the minor consent to the care, with a reference to the Family Code (Texas Attorney General, Authorization to Disclose Protected Health Information).

A claimant must give written notice by certified mail to each physician or provider at least 60 days before filing suit, with the 74.052 authorization attached (Texas Civil Practice and Remedies Code 74.051 and 74.052). Without it, proceedings against that provider are abated until 60 days after the provider receives the authorization (Texas Civil Practice and Remedies Code 74.051 and 74.052). Abatement means the case is put on hold against that provider, so nothing moves until the form arrives.

The statutory form covers records from providers who treated the injuries, and from providers seen during the five years before the incident (Texas Civil Practice and Remedies Code 74.051 and 74.052). The patient may list providers whose records are not relevant and initial exclusions for HIV/AIDS, substance abuse, mental health and genetic information (Texas Civil Practice and Remedies Code 74.051 and 74.052).

It expires when the claim is resolved or the litigation ends, whichever comes first (Texas Civil Practice and Remedies Code 74.051 and 74.052). Use the statute’s current text as printed; a homemade version invites a fight over compliance.

You do not need an authorization to see your own file. A provider with an electronic health records system able to fill the request must provide your electronic record no later than the 15th business day after your written request (Texas Attorney General, Medical privacy). It sends it in electronic form unless you agree to another form (Texas Health and Safety Code Chapter 181 (sections 181.102 and 181.154)).

Providers may charge reasonable copying and mailing costs, but not a retrieval fee (Texas Attorney General, Medical privacy). To send records to someone else, use the authorization; the general HIPAA release form guide explains each federal element.

• Texas Health and Safety Code Chapter 181 (sections 181.102 and 181.154): A covered entity needs a separate authorization for each electronic disclosure outside the listed exceptions; the authorization may be written, electronic or documented oral; the Attorney General adopts a standard form; electronic records go to the patient in electronic form unless the patient agrees otherwise.
• Texas Attorney General, Authorization to Disclose Protected Health Information: Standard form effective June 2013 with initials for sensitive categories, a default expiration, written revocation, and a note that any compliant form may be used.
• Texas Attorney General, Medical privacy: Providers with a capable electronic health records system must provide records by the 15th business day after a written request, and may charge copying and mailing costs but no retrieval fee.
• Texas Civil Practice and Remedies Code 74.051 and 74.052: Pre-suit notice at least 60 days before filing must be accompanied by the statutory authorization, which covers five years before the incident and expires at resolution or the end of litigation.
• 45 CFR 164.508, Authorizations: Sets the core elements and required statements of a valid HIPAA authorization.
• 45 CFR 164.502(g), Personal representatives: A person with authority under applicable law to make health care decisions for an adult is treated as the individual.
• 42 CFR 2.31, Consent requirements for substance use disorder records: A Part 2 consent must carry its own listed elements; SUD counseling notes need a separate consent; a consent for use in legal proceedings cannot be combined with any other consent.