HIPAA Authorization Forms

Form 1. Release of My Information to My Primary Care Doctor or Another Clinician

Version [VERSION] | Effective [EFFECTIVE DATE] | Last updated [LAST UPDATED]

About you

1. Who may share my information

[PRACTICE NAME] (the Practice), its clinicians and its staff. WellPeps, a Wyoming corporation, and the technology platform that runs your patient portal may help send it for the Practice.

2. Who may receive it

☐ Send by a secure portal link or fax.

☐ Send by ordinary email. I understand ordinary email can be read by others.

3. What information may be shared

Check each item you want shared.

☐ My visit notes and my clinician’s summary

☐ The medicines I was prescribed (name, strength, directions and pharmacy)

☐ My health history and my answers on my intake forms

☐ Lab results ordered through the Practice

☐ My messages with my clinician

☐ Other (describe):

Extra-protected information. The law gives extra protection to some kinds of information, such as mental health, HIV or AIDS, substance use, genetic and reproductive health information. This form does not share these unless you check the box and initial. [VERIFY: state consent rules for these categories in the states served]

☐ I also allow sharing of this extra-protected information: Initials:

4. Why I am asking

I am asking that my information be shared so my other clinician knows about my care. This is at my request.

5. When this permission ends

Choose one. This is required.

☐ 90 days after I sign

☐ 1 year after I sign

☐ When my care with the Practice ends

☐ On this date:

6. Your rights

• You do not have to sign. The Practice and WellPeps will not refuse care, a prescription, an order, payment or sign-up because you did not sign this form.
• You can cancel at any time. To cancel, send a message in your patient portal, email [PRIVACY EMAIL], mail a letter to [BUSINESS ADDRESS], or use Form 4. Canceling starts when the Practice or WellPeps gets your request. It does not undo sharing that already happened while the permission was in effect.
• Others can share it again. Information shared under this form may be shared again by the person who gets it. Once that happens, federal privacy law (HIPAA) may no longer protect it.
• You get a copy. You will get a copy of this signed form.

Signature

By typing my name below, I agree that my electronic signature has the same legal effect as my handwritten signature. I have already agreed to use electronic records and signatures. I have read this form, I filled in every blank that applies to me, and I understand it.

If you are signing for the patient (for example, as a legal guardian or under a power of attorney), also give your name, your relationship, and the legal authority that lets you sign. We may ask for proof.

Signing on paper instead? Sign and date here, and send it to [BUSINESS ADDRESS] or upload it in your patient portal.

You will get a copy of this signed form. A copy will be saved in your patient portal and sent to the email on your account.

Form 2. Permission to Use My Story, Photos or Information in WellPeps Marketing

Version [VERSION] | Effective [EFFECTIVE DATE] | Last updated [LAST UPDATED]

About you

1. Who may share my information

[PRACTICE NAME] (the Practice) may share the information I check below with WellPeps, a Wyoming corporation, for this purpose. I may also give WellPeps information directly.

2. What information may be used

Check each item you allow.

☐ My first name or first initial, and my state or city

☐ My full name

☐ A photo of me. ☐ My face is visible. ☐ My face is not visible.

☐ Before and after photos

☐ A video or audio recording of me

☐ My written story or review. I want to see the final words before they are used. ☐ Yes ☐ No

☐ The fact that I am a patient and the type of treatment I use. I understand this tells the audience something about my health.

☐ Other (describe):

WellPeps does not publish weight, dose or other number results. [WELLPEPS TO CONFIRM: policy of publishing no weight, dose or other numeric result claims] We may shorten or edit for clarity, and we will ask you before we change what you mean. Do not include another person’s name, photo or information.

3. Who may receive it

The public, and the companies that help WellPeps run its marketing. WellPeps may use what I allow on its website, in email newsletters, on social media, in ads (including paid ads on advertising platforms), in print and in video, and may share it with advertising agencies and platforms that help run those ads.

4. Why

To advertise and promote WellPeps and its services.

5. Payment and benefits

☐ I am not getting anything of value for this.

☐ I am getting: (for example, a free product, a discount or a payment). WellPeps will tell the audience when a story is paid for or rewarded, as the law requires.

WellPeps does not require a positive review in return for anything. WellPeps will not receive payment from any other company for using my information in marketing. [WELLPEPS TO CONFIRM: no third-party payment; if one exists, HIPAA requires this form to say so] If that ever changes, we will ask you to sign a new form.

6. My story is true

What I say is true and is my own honest opinion and experience. I used the treatment I describe. I understand my results may not be typical, and the ad may say so. I was not asked to say anything I do not believe.

7. When this permission ends

[24 months] after I sign, or sooner if I cancel it.

8. Permission to use

I give WellPeps permission to use the items I checked, in the ways described above, without further payment, for the time above. I still own my story and photos. WellPeps may edit them as described in section 2. [VERIFY: scope of the release, ownership of content and right-of-publicity consent rules for the states served]

9. Your rights

• You do not have to sign. The Practice and WellPeps will not refuse care, a prescription, an order, payment or sign-up because you did not sign this form.
• You can cancel at any time. To cancel, send a message in your patient portal, email [PRIVACY EMAIL], mail a letter to [BUSINESS ADDRESS], or use Form 4. Canceling starts when the Practice or WellPeps gets your request. It does not undo sharing that already happened while the permission was in effect. After you cancel, WellPeps will stop new uses within [5 business days] and remove items on websites and social accounts it controls within [10 business days]. We cannot take back printed material already given out or copies other people made.
• Public information can be copied. Information used under this form may be seen, copied and shared by others. Once that happens, federal privacy law (HIPAA) may no longer protect it.
• You get a copy. You will get a copy of this signed form.

Signature

By typing my name below, I agree that my electronic signature has the same legal effect as my handwritten signature. I have already agreed to use electronic records and signatures. I have read this form, I filled in every blank that applies to me, and I understand it.

If you are signing for the patient (for example, as a legal guardian or under a power of attorney), also give your name, your relationship, and the legal authority that lets you sign. We may ask for proof.

Signing on paper instead? Sign and date here, and send it to [BUSINESS ADDRESS] or upload it in your patient portal.

You will get a copy of this signed form. A copy will be saved in your patient portal and sent to the email on your account.

Form 3. Permission to Share My Information With a Person I Choose

Version [VERSION] | Effective [EFFECTIVE DATE] | Last updated [LAST UPDATED]

About you

1. Who may share my information

[PRACTICE NAME] (the Practice) may share information about my care. WellPeps, a Wyoming corporation, and the technology platform that runs my patient portal may share information about my orders, shipping, billing and account.

2. Who may receive it

We may ask this person to prove who they are before we share anything.

3. What information may be shared

Check each item you allow.

☐ General information about my care and treatment

☐ My medicines and the status of my prescriptions

☐ Visit scheduling and my order, shipping and tracking status

☐ Billing and payment information

☐ My lab results

☐ My full medical record

☐ Other (describe):

Extra-protected information. Mental health, HIV or AIDS, substance use, genetic and reproductive health information are not shared under this form unless you check this box and initial. [VERIFY: state consent rules for these categories in the states served]

☐ I also allow sharing of this extra-protected information: Initials:

4. What this person may and may not do

☐ Talk with the Practice about my care

☐ Talk with WellPeps support about my orders, shipping and billing

☐ Ask WellPeps to change or cancel my orders for me

This form does not make this person my legal representative. It does not let them make medical decisions, sign consents or change my account unless I check the box above. If you need someone to decide for you, talk to a lawyer about a power of attorney.

5. Why

This is at my request. I want the person named above to have this information.

6. When this permission ends

Choose one. This is required.

☐ 1 year after I sign

☐ When my care with the Practice ends

☐ On this date:

7. Your rights

• You do not have to sign. The Practice and WellPeps will not refuse care, a prescription, an order, payment or sign-up because you did not sign this form.
• You can cancel at any time. To cancel, send a message in your patient portal, email [PRIVACY EMAIL], mail a letter to [BUSINESS ADDRESS], or use Form 4. Canceling starts when the Practice or WellPeps gets your request. It does not undo sharing that already happened while the permission was in effect.
• Others can share it again. Information shared under this form may be shared again by the person who gets it. Once that happens, federal privacy law (HIPAA) may no longer protect it.
• You get a copy. You will get a copy of this signed form.

Signature

By typing my name below, I agree that my electronic signature has the same legal effect as my handwritten signature. I have already agreed to use electronic records and signatures. I have read this form, I filled in every blank that applies to me, and I understand it.

If you are signing for the patient (for example, as a legal guardian or under a power of attorney), also give your name, your relationship, and the legal authority that lets you sign. We may ask for proof.

Signing on paper instead? Sign and date here, and send it to [BUSINESS ADDRESS] or upload it in your patient portal.

You will get a copy of this signed form. A copy will be saved in your patient portal and sent to the email on your account.

Form 4. Cancel (Revoke) My Permission

Version [VERSION] | Effective [EFFECTIVE DATE] | Last updated [LAST UPDATED]

About you

1. Which permission are you canceling?

☐ Form 1: release to a clinician. Name of the clinician: Date I signed:

☐ Form 2: WellPeps marketing or testimonials. Date I signed:

☐ Form 3: sharing with a person I chose. Name of the person: Date I signed:

☐ All permissions I have given on these forms.

2. If WellPeps is using my story or photos

Please remove them. If you know where they appear (web addresses or a description), tell us here:

3. When this starts

When [PRACTICE NAME] (the Practice) or WellPeps gets this request.

4. What happens next

• The Practice and WellPeps will stop sharing or using your information under the permission you cancel. WellPeps will do this within [5 business days]. For Form 2, we will remove items on websites and social accounts we control within [10 business days].
• We will confirm in writing. We keep a record that you signed and canceled.
• We cannot take back printed material already given out, copies other people made, or information already shared while the permission was in effect.

5. How to send this form

Send a message in your patient portal at [PORTAL URL], email [PRIVACY EMAIL], or mail it to [BUSINESS ADDRESS]. WellPeps will pass it to the Practice the same business day.

Signature

By typing my name below, I agree that my electronic signature has the same legal effect as my handwritten signature. I have already agreed to use electronic records and signatures. I have read this form, I filled in every blank that applies to me, and I understand it.

If you are signing for the patient (for example, as a legal guardian or under a power of attorney), also give your name, your relationship, and the legal authority that lets you sign. We may ask for proof.

Signing on paper instead? Sign and date here, and send it to [BUSINESS ADDRESS] or upload it in your patient portal.

You will get a copy of this signed form. A copy will be saved in your patient portal and sent to the email on your account.

For office use only

Technical and drafting notes

Part 1. Instructions for WellPeps and the Practice (remove before publishing)

1.1 What is in this packet

1.2 Rules for using these forms

• None is a condition of anything. Do not attach any form to a product as a Required form in GEN Health (that would gate checkout). Do not pre-check boxes. Do not offer a discount, priority or other reward for signing Form 2 unless it is disclosed on the form and in the ad.
• Each form stands alone. Do not fold an authorization into the Patient Terms of Service, the Informed Consent to Telehealth Services, the Notice of Privacy Practices acknowledgment or the Electronic Records, Signatures and Communications Consent. [VERIFY: the HIPAA rule on combining authorizations with other documents, and when conditioning is allowed]
• No blanks that matter. An authorization with a missing recipient, description or expiration is not valid. Do not add “any person” or “until revoked”. [VERIFY: whether an open-ended expiration is acceptable for a non-research authorization; these forms use a fixed period or an event]
• Treatment disclosures need no form. The Practice may send information to another clinician treating the patient without an authorization, as the Notice of Privacy Practices explains. [VERIFY: whether any state served requires patient consent before telehealth records go to a primary care physician]
• Do not use these forms for psychotherapy notes or for substance-use-disorder program records covered by 42 CFR Part 2. Neither is expected. [VERIFY: 42 CFR Part 2 consent requirements, only if such records are ever held]
• Verify who is signing. For a personal representative, record the proof of authority.
• No health information in ordinary email. Use the portal or another secure channel unless the patient has chosen ordinary email on the form.

1.3 Building the forms in GEN Health

Create each form under Forms, Patient Consents, as a consent form. Use Rich Text for the text, Checkbox questions for the choices, Short Text for the typed name and Date for dates. Four points from the platform guide:

• A consent signature stays current until a new version is published; GEN does not expire it by date. Track expiration dates in the register in section 1.4.
• Publishing an edit creates a new version and asks every patient to sign again. Batch edits and record the version number on every signed copy.
• Only Active consent forms attach to a product as Required forms. Keep these four off that list. [VERIFY: whether GEN can present an optional consent outside checkout, or whether Client Staff must send it as a follow-up form or a PDF through portal messages]
• Capture typed name, date and time, version and IP address against the patient record, and keep a PDF of every signed form.

1.4 Recordkeeping and retention

Keep every signed form, and every revocation, in the Practice’s patient record. Retain each for six years from the date it was signed or last in effect, whichever is later, or for the period in the agreement with the Practice section 3 (the Term plus seven years), whichever is longer, and for any longer period state law requires. [VERIFY: HIPAA’s six-year documentation retention rule as applied to authorizations and revocations]

Keep a register. Suggested columns:

1.5 Handling a cancellation

1. Log the date received. Accept any clear written message, including a portal message. If someone asks by phone (only if a phone line is live), ask them to confirm in writing.
2. Send it to the Practice’s privacy contact the same business day. The Practice decides what to stop.
3. Stop new uses and disclosures under that permission within [5 business days]. For Form 2, remove items on sites and accounts WellPeps controls within [10 business days].
4. Tell any recipient who can still act on it. Confirm to the patient in writing.
5. Keep the revocation with the original form. Do not delete the original.

1.6 Form 2: marketing rules

• Review every story and photo against the advertising rules before use: no outcome or weight-loss numbers, no claim a compounded medicine is FDA-approved, no brand names to describe compounded products, and “prescription required; a prescription is not guaranteed” wherever a treatment is mentioned.
• The endorser must have used the product and must speak honestly. Disclose any payment, free product or discount. Do not require a positive review for anything. [VERIFY: current FTC Endorsement Guides (16 CFR Part 255) and the FTC rule on reviews and testimonials: disclosure of material connections and of typical results]
• Keep a substantiation file for each use. Do not use a story in any state where the product is not offered.
• A story a visitor sends through the website, outside any patient relationship, is not PHI, but still needs the release in this form and the consent text in the Consumer Health Data Privacy Policy. [VERIFY: whether Washington My Health My Data consent to collect and share must be separate from this form]

1.7 Element checklist (45 CFR 164.508)