Authorisation For Release Of Protected Health Information Phi Template for England and Wales

When you need to share protected health information in England and Wales, you must obtain proper authorization that complies with strict data protection laws. The Authorisation For Release Of Protected Health Information PHI provides the legal framework for healthcare providers to disclose patient data while maintaining compliance with UK GDPR and the Data Protection Act 2018.

When do you need this document?

You require this authorization whenever protected health information needs to be shared beyond the immediate healthcare team providing direct patient care. This includes situations where medical records must be disclosed to specialist consultants, legal representatives handling personal injury claims, insurance companies processing benefit applications, or researchers conducting approved studies. The document is also essential when transferring patient care between different healthcare trusts or when providing medical evidence for employment tribunals or court proceedings. Without proper authorization, healthcare providers cannot lawfully disclose protected health information, even when disclosure appears beneficial to the patient.

Key legal considerations

The authorization must clearly specify what information can be released, to whom, and for what purpose, adhering to data minimization principles under UK GDPR. You must ensure the patient has mental capacity to provide consent, or appropriate legal representatives are authorized under the Mental Capacity Act 2005. The document should include time limits for the authorization and specify whether the patient can revoke consent. Healthcare providers must verify the identity of information recipients and ensure they have legitimate grounds for processing the health data. The authorization creates legal protection for healthcare providers while establishing clear boundaries for information sharing that prevent unauthorized disclosure of sensitive medical information.

Legal requirements in England and Wales

Under England and Wales law, this authorization must comply with UK GDPR requirements for processing special category personal data, which includes all health information. The Data Protection Act 2018 provides additional specific provisions for health data processing that must be incorporated into the authorization language. Healthcare providers must ensure the document meets Access to Health Records Act 1990 requirements, particularly when dealing with deceased patients' records. The authorization must specify lawful bases for processing under both UK GDPR Article 6 and Article 9, ensuring both general data protection compliance and special category data protection. NHS trusts and private healthcare providers must also comply with Health and Social Care Act 2012 information governance requirements, maintaining detailed records of all authorized disclosures for audit and regulatory oversight purposes.