How to Fill Out and Submit the Nova Healthcare Authorization Form

The Nova Healthcare authorization form is a HIPAA release that lets Nova Healthcare Administrators share your protected health information with a specific person or organization you name. You download it as a PDF from Nova’s website or request it by emailing memberservice@novahealthcare.com, complete all seven sections, sign it, and return it by mail, fax, or email.¹ Without a signed authorization that meets the federal requirements in 45 CFR 164.508, Nova cannot release your records to a third party.²

What to Have in Front of You

Gather these before you start. Nova rejects incomplete forms and sends them back, which restarts the clock.¹

Your Nova Member ID (from your ID card; no Social Security number is requested).
The full name, relationship, and telephone number for each person or organization you want to receive your information.
Start and end dates of service, if you want to limit the release to a specific window.
Proof of authority if someone else is signing for you: a health care proxy, certificate of guardianship, surrogate decision-maker designation, or letters of administration or testamentary.

Working Through Sections A Through G

The form has seven sections, A through G. Fields marked with an asterisk are required; miss one and the whole authorization is invalid.

Section A: Your Information

Enter your full name, date of birth, and Member ID exactly as they appear on your Nova card. Small spelling or number mismatches can trigger a rejection.¹

Section B: Who Is Authorized to Receive Information

List everyone you’re authorizing. For each, provide name, relationship to you, and a phone number. At least one recipient is required. If you run out of space, attach a second page.¹

Section C: What Information Is Released

Pick one of three options:

C-1 authorizes disclosure of any health information the people in Section B request. It is the broadest choice but does not automatically cover the sensitive categories listed in C-3.
C-2 limits disclosure to specific records, such as claims from a particular provider or information tied to a certain diagnosis.
C-3 covers sensitive categories: alcohol and substance abuse, HIV-related information, pregnancy and reproductive health, mental health, sexually transmitted diseases, and genetic testing. You must initial each category you want released. Checking C-1 alone does not release these records.¹

Substance use disorder records in particular are protected under 42 CFR Part 2 and generally require explicit, specific patient consent.³

Section D: Purpose and Date Range

State why you’re authorizing the release. Federal rules require a purpose, but “at my request” is sufficient if you’d rather not elaborate.² Enter start and end dates of service if you want a narrow window. Leave the date fields blank to authorize access to records from the start of your plan coverage onward.¹

Section E: Expiration

A HIPAA authorization needs an expiration date or triggering event to be valid.⁴ The Nova form has a built-in default: the authorization expires one year after your enrollment ends, upon your death, when a named minor turns 18, or when Nova receives a written revocation. You only need to write in a date if you want a shorter window.¹

Sections F and G: Representative Information and Signature

Section G is where the patient signs and dates. If someone else is signing as your personal representative, Section F must also be filled in with that person’s name, relationship, and phone number, along with proof of legal authority (health care proxy, certificate of guardianship, surrogate decision-maker designation, or letters of administration or testamentary).¹ Federal rules also require a description of the representative’s authority to act for the individual.²

Signing is voluntary. Nova cannot condition your payment, enrollment, or eligibility for benefits on whether you sign. If you don’t sign, they simply won’t release the information.¹

Where to Send the Completed Form

Nova accepts the signed authorization three ways:¹

Mail: Nova Healthcare Administrators, P.O. Box 408, Buffalo, NY 14231
Fax: (716) 250-7193
Email: memberservice@novahealthcare.com

Fax and email arrive faster than mail. If you need help filling out the form, call the member services number on your Nova ID card or use the email address above. Nova reviews each submission for completeness, and a missing required field makes the authorization invalid and sends it back to you for correction.

Canceling an Authorization You Already Signed

You can revoke the authorization at any time by sending a written revocation to Nova at the same mailing address: P.O. Box 408, Buffalo, NY 14231.¹ Federal rules require the revocation to be in writing.²

Revocation stops future disclosures only. Anything Nova already shared stays with the recipient, and a covered entity that acted in reliance on the authorization before receiving the revocation is not in violation of the privacy rules.²

Two Situations the Form Does Not Fully Cover

Psychotherapy Notes

The “Mental Health” box in Section C-3 covers general mental health treatment records. It does not release psychotherapy notes. Federal rules require a completely separate authorization for psychotherapy notes, and that authorization cannot be combined with any other disclosure request.² Psychotherapy notes are a therapist’s private session notes kept separate from the main medical record and do not include diagnosis codes, treatment plans, or medication prescriptions, which are part of the standard record.⁵ If you need both, submit two authorizations.

Minor Children

A parent generally qualifies as a minor child’s personal representative and can sign on their behalf. Federal rules identify three exceptions: when the minor lawfully consented to care without parental consent, when the minor received care at the direction of a court, or when the parent agreed to a confidential relationship between the minor and the provider.⁶ State law may also grant minors independent privacy rights for reproductive health, mental health, or substance abuse treatment. An authorization signed on behalf of a minor automatically expires when that minor turns 18.¹

If You Think Your Privacy Was Violated

If Nova or another covered entity shares records without a valid authorization, ignores your revocation, or releases more than you authorized, you can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. The complaint must be filed within 180 days of when you discovered the violation, though OCR may grant an extension for good cause. You can file through the OCR Complaint Portal at ocrportal.hhs.gov, by email to OCRComplaint@hhs.gov, or by mail to Centralized Case Management Operations, U.S. Department of Health and Human Services, 200 Independence Avenue S.W., Room 509F HHH Bldg., Washington, D.C. 20201.⁷

1
Nova Healthcare Administrators. Authorization to Disclose Protected Health Information (PHI)
2
eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
3
eCFR. Confidentiality of Substance Use Disorder Patient Records
4
U.S. Department of Health and Human Services. Must an Authorization Include an Expiration Date?
5
U.S. Department of Health and Human Services. HIPAA Privacy Rule and Sharing Information Related to Mental Health
6
U.S. Department of Health and Human Services. Does the HIPAA Privacy Rule Allow Parents the Right to See Their Children’s Medical Records?
7
U.S. Department of Health and Human Services. How to File a Health Information Privacy or Security Complaint