Q. A patient signed an authorization eight months ago, and her attorney is now submitting it to obtain a copy of her medical records. Is this authorization still valid, or do we need to get the patient to sign a new authorization?
A. The HIPAA Privacy Rule does not specify the maximum period of time for which an authorization is valid, but some states do. Under Texas law, for example, authorizations are valid for up to 120 days. If your state does not specify a maximum time period for authorizations to be considered valid, you may establish your own policy. Many organizations consider authorizations to be valid for up to one year after signature unless the patient specifies an earlier expiration date or event.