What Is a HIPAA Authorization in a Florida Estate Plan?

Under 45 CFR 164.508(c)(1), a valid authorization describes the information to be disclosed in a specific and meaningful way. It names who may make the disclosure and who may receive it, states each purpose, and sets an expiration date or event. It is signed and dated, and the statement "at the request of the individual" is enough to describe the purpose when the individual starts the request.

The authorization must also give notice of the right to revoke it in writing, whether treatment can be conditioned on signing it, and the chance that a recipient may redisclose the information. It must be written in plain language.

A separate federal rule, 45 CFR 164.502(g), generally requires covered entities to treat a personal representative as the individual for protected health information relevant to that representation. That covers a person with authority under applicable law to make health care decisions for an adult and, after death, an executor, administrator or other person with authority over the estate.

Florida's suggested health care surrogate form in section 765.203 already includes a choice to let the surrogate receive health information. The surrogate's authority to receive information takes effect when the primary physician determines that the principal cannot make health care decisions, unless the principal initials a box making it immediate. Under 45 CFR 164.508(c)(1)(iii), an authorization may name specific persons or a class of persons as recipients.