What Forms are "HIPAA Forms" and What Forms are NOT "HIPAA Forms"?

DISCLAIMER: The information provided in this article, other knowledge base articles, and the Compliancy Group website do not, and are not intended to, constitute legal advice. All information, content, and materials in the Knowledge Base and on the Compliancy Group website are for general informational purposes only.

Introduction

HIPAA may require or permit a covered entity to create and maintain specific forms that the covered entity must or may provide to patients, or accept from patients. The form requirement (or permission) comes from the regulations. This article discusses some well-known HIPAA forms, and also provides examples of forms that are healthcare-focused but are not required by HIPAA.

What are Examples of HIPAA Forms?

"HIPAA Forms" are forms or documents that are explicitly mentioned by the HIPAA regulations.  Well-known examples of HIPAA forms include:

1. The Notice of Privacy Practices
2. A form on which a patient acknowledges having received a copy of the Notice of Privacy Practices.
3. An Authorization to Use or Disclose PHI (sometimes called a "medical release" or "Authorization to Release PHI" or "Authorization to Disclose Medical Records" or "Release of Information" or "ROI"). Authorization can be required for various purposes, including marketing, sale, and fundraising involving PHI, and disclosures of PHI to print or online media sources. The HIPAA Authorization to Use or Disclose PHI, like the Notice of Privacy Practices, has specific content requirements.
4. A consent to use and disclose PHI form. Note that HIPAA does not require a consent form. A practice may choose to obtain patient consent to use or disclosure of PHI for treatment, payment, or healthcare operations. It may choose to have a patient provide the consent in writing. As explained in this HHS guidance document, consent is different from authorization.
5. A patient request for copies of medical records, made under the HIPAA right of access standard.
6. Forms on which a patient may make a request that HIPAA gives them the right to make. Examples of these forms include a form to Request Amendment of PHI, to Request and Accounting of Disclosures of PHI, and forms to Request Privacy Protections for OHI,

What are Examples of Forms That are NOT HIPAA Forms?

If a form is not mentioned or required in the HIPAA regulations, the form is not a "HIPAA form." Examples of forms that are not HIPAA forms include:

1. Consent to treatment forms.  In a consent to treatment form, a patient provides written consent to undergo a particular procedure, after being advised of the risks and benefits of the procedure. This kind of form is often referred to as an informed consent form. States generally require that patients be given the opportunity to consent to a procedure after being informed of what the procedure entails, its potential risks, and potential benefits. The informed consent form captures a patient's consent to a procedure after the patient has been informed of these items.
2. Patient intake forms.
3. "Agreement to pay" forms, which are forms that outline a patient's financial responsibility for services rendered - particularly, for any costs that are not covered by insurance. 
4. Cancellation policies.
5. Healthcare powers of attorney forms
6. Advanced directives. 
7. Patient satisfaction surveys
8. Credit card authorization forms