Authorisation To Use And Disclose Protected Health Information Form Template for England and Wales

You need an Authorisation To Use And Disclose Protected Health Information Form when your healthcare provider must share your medical information with third parties beyond your direct care team. Under England and Wales law, this document serves as your formal consent mechanism, ensuring compliance with the UK Data Protection Act 2018 and UK GDPR while protecting your privacy rights and giving you control over how your sensitive health data is used.

When do you need this document?

You'll encounter this form in various healthcare scenarios where information sharing extends beyond routine care. Medical research participation requires your explicit authorization for researchers to access relevant health records. Insurance claims often need detailed medical information to process applications or assess coverage eligibility. When transferring care between different healthcare providers or trusts, your authorization enables seamless information sharing while maintaining legal compliance. Legal proceedings involving medical evidence may require this form to permit disclosure to solicitors or courts. Mental health services particularly rely on these authorizations when coordinating care between multiple specialists or social services.

Key legal considerations

Your authorization must be specific, informed, and freely given under UK GDPR principles. The form should clearly identify what specific health information can be disclosed, avoiding broad or blanket permissions that could compromise your privacy. You retain the right to withdraw your consent at any time, though this won't affect information already shared with your permission. The authorization should specify a reasonable duration rather than being open-ended, with most forms valid for 6-24 months depending on the purpose. Healthcare providers must ensure they only share the minimum necessary information required for the stated purpose, adhering to data minimization principles. If you lack mental capacity, decisions about information disclosure must follow Mental Capacity Act 2005 procedures, potentially involving appointed representatives or best interest assessments.

Legal requirements in England and Wales

Under the UK Data Protection Act 2018 and UK GDPR, healthcare providers must demonstrate lawful basis for processing your health information, with explicit consent being the most common basis for non-care related sharing. The Access to Health Records Act 1990 governs how your information can be accessed, particularly relevant for deceased patients' records. Mental Capacity Act 2005 provisions apply when you cannot provide informed consent, requiring healthcare providers to act in your best interests or follow valid lasting power of attorney arrangements. The Health and Social Care Act 2012 framework ensures information sharing supports integrated care delivery while maintaining appropriate safeguards. Your authorization must comply with NHS information governance standards and local trust policies, which often require additional approvals for certain types of disclosure. Healthcare providers must maintain audit trails of all information sharing activities and ensure recipient organizations have appropriate data protection measures in place.