Provided by:  Jennifer Kirschenbaum, Esq.

August 20, 2020 

Question:

Hi Jennifer, 

Should I be having patients sign HIPAA authorizations each year?  Do they expire or have to be renewed annually?  

Thanks, 
Dr. M


Answer:


Not annually, but each authorization should have a stated expiration.  The Office for Civil Rights says - 

https://www.hhs.gov/hipaa/for-professionals/faq/476/must-an-authorization-include-an-expiration-date/index.html

The Privacy Rule requires that an Authorization contain either an expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure. For example, an Authorization may expire "one year from the date the Authorization is signed," "upon the minor’s age of majority," or "upon termination of enrollment in the health plan."
 
An Authorization remains valid until its expiration date or event, unless effectively revoked in writing by the individual before that date or event. The fact that the expiration date on an Authorization may exceed a time period established by State law does not invalidate the Authorization under the Privacy Rule, but a more restrictive State law would control how long the Authorization is effective.