West Virginia WIC Policy & Procedure 5.16 Effective Date: 3/6/2026

5.16 WVHIN – Authorization for Release of Health Information Form

POLICY:

Each WIC participant, parent, or guardian must complete an Authorization for Release of Health Information Form (ARHI) (Attachment #1 or Spanish Version Attachment #2) to authorize WIC staff access to their West Virginia Health Information Network (WVHIN) record. Applicant and participant medical records may be accessed via the WVHIN to streamline certifications, assess medical history for a comprehensive nutrition assessment, and/or prevent replication of anthropometric measures if relevant to the WIC appointment. This process will be tracked on the Tracking Form (Attachment #3) The participant, parent, or guardian can choose to decline WIC authorization to access the WVHIN by filling out the WVHIN Declination Form (Attachment #4) The WVHIN Declination Form will be add to the Tracking Form (Attachment #3) upon signing. Declining authorization for WIC to access medical records via the WVHIN does not remove the participation from the WVHIN as established through a healthcare provider. WIC benefits cannot be withheld due to declining authorization for the WIC Program to access medical records within the WVHIN. A participant, parent, or guardian can change authorization at any time; a new ARHI Form must be completed. A new ARHI Form must be completed if there is a custody change except for participants within the custody of the State of West Virginia Department of Human Services. Participants in the custody of the State of West Virginia Department of Human Services (i.e. kinship or foster care, or their temporary caretaker, are not eligible to authorize WIC staff access to their WVHIN record. WIC Authorized WVHIN Users must obtain a new ARHI Form when conducting any custody changes except for those within state custody. The Local Agency (LA) will be responsible for distributing, receiving, and documenting completed Authorization for Release of Health Information Forms (ARHI). ARHI forms will need to be stored in a locked file cabinet for six (6) years. If the ARHI form is to be discarded, it will need to be shredded in a secure manner. The LA staff will also ensure that the participant has a current Remote Services Acknowledgement Form (RASF) on file. The RSAF (Attachment #7 for English or Attachment #8 for Spanish) must be signed by the participant and allows staff to provide some services remotely (refer to Policy 3.09 Issuing Benefits Remotely). Without a RSAF on file for a participant, virtual services will not be provided. These forms will need to be tracked on Attachment #3 to ensure that all participants have an RSAF form. These forms need to be stored for a minimum of three (3) years and one-hundred and fifty (150) days (refer to Policy 1.04 Record Retention for further details). PROCEDURE:

A. Authorization for Release of Health Information Form (ARHI), Attachment #1 or Spanish Version, Attachment #2)

Page 1 of 5

West Virginia WIC Policy & Procedure 5.16 Effective Date: 3/6/2026

5.16 WVHIN – Authorization for Release of Health Information Form

1. The Local Agency will distribute the Authorization for Release of Health Information Form (ARHI) to each applicant/participant. Prior to collecting the ARHI form for a participant, review the family alerts for the participant or review the ARHI Tracking form. When having a participant sign the ARHI form, ensure that both a family alert is created and the form is tracked on the ARHI tracking sheet.

a. A separate ARHI Form must be completed for each applicant/participant, by the participant, parent, or guardian. b. The ARHI Form may be sent via mail, email, or electronic signature platform (DocuSign). c. If not returned, LA staff should seek to complete during the next clinic visit.

2. The WVHIN record cannot be accessed until the ARHI Form is completed and returned to the Local Agency.

a. A new ARHI Form received via the WIC clinic email should be marked Unread. These emails should only be marked Read by the the WIC Authorized WVHIN User. Forms signed via email must be printed out and given to the WIC Authorized WVHIN User and stored the same as if it was signed in person - in a secure location like a locked cabinet. b. Forms signed via an electronic signature platform (Docusign) are automatically downloaded into the shared folder for the agency that sent the form after completion. c. A new ARHI Form received via mail or in person should be given to the WIC Authorized WVHIN User. Forms signed in person or via mail must be given to the WIC Authorized WVHIN User and stored in a secure location like a locked cabinet.

i. A new WIC HIN Declination Form(Attachment #4 or Spanish Version Attachment #5) received in-person or filled out by WIC staff for a verbal declination should be given to the WIC Authorized WVHIN User.

d. The completed ARHI Form, giving authorization or declination, must be added as family alert and filed in a secure location.

e. If the ARHI Form and RSAF Form are completed via satellite or community sites (i.e. hospitals, healthcare provider offices, mobile units, etc.), the completed ARHI Form and RSAF Form, giving authorization, must be scanned and emailed to the corresponding Page 2 of 5

West Virginia WIC Policy & Procedure 5.16 Effective Date: 3/6/2026

5.16 WVHIN – Authorization for Release of Health Information Form

agency’s the WIC Authorized WVHIN User. Satellite or community site staff will track these forms on Attachment #3 ARHI Tracking Form. i. Each certification staff member will need to use the respective Local Agency’s Attachment #3 Tracking form found in the WIC Authorized WVHIN User folder on their Local Agency Shared Drive.

f. Paper ARHI, RSAF, and Declination forms should be filed alphabetically by participant last name. These forms will need to be locked in a file cabinet in a secure location. The ARHI forms and Declination forms need to be kept for a minimum of six (6) years. The RSAF forms will need to be kept for a minimum of three (3) years and one-hundred and fifty (150) days per policy 1.04 Record Retention.

g. Electronic ARHI, RSAF, and Declination forms should be labeled and kept in the DocuSign folders on the Local Agency’s shared drive. The ARHI and Declination forms should be labeled as the following: ARHI_WV#_Date Signed. The RSAF form should be labeled as the following: F#_RSAF_Date Signed. All electronic forms will be found in the DocuSign folder on the Local Agency Shared Drive. The electronic ARHI and Declination forms must be kept for a minimum of six (6) years. The electronic RSAF must be kept for a minimum of three (3) years and one-hundred and fifty (150) days. These electronic forms must remain on the Local Agency Shared Drive and must not be copied and saved on the desktop or another location.

h. When an ARHI Form is sent to a family, a Family Alert must be added to the participant’s file in the Crossroads Computer System:

i. When an ARHI Form is sent: Title: ARHI Forms sent for family, MM/DD/YYYY and WIC staff initials Text Box: ARHI-form sent for family, MM/DD/YYYY and WIC staff initials. Family alerts should remain active until the participant is no longer in the program. The only time an RSAF or ARHI form needs to be renewed is when the participant leaves and returns to the WIC program or when custody changes. When there is a new form signed the family alert needs to be updated with the date the new form was signed. Please note that individuals that are in the custody of the state of West Virginia (foster care) cannot be looked up in the WVHIN.

i. When a new ARHI Form or WIC HIN Declination Form is received, the Family Alert must be updated in the family record in the Crossroads Computer System: Page 3 of 5

West Virginia WIC Policy & Procedure 5.16 Effective Date: 3/6/2026

5.16 WVHIN – Authorization for Release of Health Information Form

i. When a completed ARHI Form is received update the existing family alert title and add a line in the alert text box: Title: ARHI – forms need scanned for family, MM/DD/YYYY and WIC staff initials Text Box: ARHI -forms need to be scanned for (participant’s name(s)), MM/DD/YYYY and WIC staff initials.

ii. If a participant, parent, or guardian revokes authorization or declines participating in the WVHIN, update the existing family alert or if there is not an existing family alert, create one: Title: WVHIN declined MM/DD/YYYY and WIC staff initials. Text Box: Parent declined WVHIN authorization MM/DD/YYYY and WIC staff initials.

iii. When the completed ARHI Form is scanned, update the existing family alert title and add a line in the alert text box: Title: ARHI - forms scanned for family MM/DD/YYYY, WIC staff initials. Text Box: ARHI scanned for participant name(s) MM/DD/YYYY and WIC staff initials. Note: Do not delete the Family Alert.

3. Any changes to the ARHI Form or the WIC HIN Declination Form, the above documentation must be repeated. a. The participant, parent, or guardian can verbally decline WIC authorization to access the HIN. WIC staff must fill out the WIC HIN Declination Form and use the above documentation (see A. 2. f. ii.). b. The participant, parent, or guardian cannot verbally authorize WIC staff access to their WVHIN record; the ARHI Form must be completed by the participant, parent, or guardian. B. Local Agency Documentation of the Authorization for Release of Health Information Form (ARHI)

2. The Local Agency WIC Authorized WVHIN User will document all completed ARHI Forms on the ARHI Tracking Form (Attachment #3).

a. ARHI Tracking Form must be completed weekly. i. This will be updated on the Shared Drive by Friday, close of business. ii. The ARHI Tracking Form (Attachment #3) must remain on the Local Agency Shared drive. No copies of this form should be made. Page 4 of 5

West Virginia WIC Policy & Procedure 5.16 Effective Date: 3/6/2026

5.16 WVHIN – Authorization for Release of Health Information Form

b. The completed ARHI Tracking Form will be maintained for three (3) years, one-hundred fifty days (see Policy 1.04 Record Retention). c. These forms must be accessible for Internal and External Monitoring.

3. Any data that needs to be reviewed will be available via a Crossroads report. Refer to policy 5.15 West Virginia Health Information Network Authorized Users, Access, and Audits for further information and to utilize the framework/decision tree.

C. Local Agency Documentation of the Remote Services Acknowledgement Form (RSAF) 4. The Local Agency will document the Remote Services Acknowledgment Form (RSAF) on Attachment #3. a. All participants should sign a RSAF or virtual services will not be provided. b. If a participant does not already have a RSAF on file, the Local Agency will need to obtain a signed RSAF.

Note: The Local Agency Director must fill out the WVHIN Continuance Document (Attachment #6) listing the individuals that they wish to have WVHIN access. This form must be completed prior to authorization being given.

ATTACHMENTS:

Attachment #1: Authorization for Release of Health Information Form (ARHI) Attachment #2: Authorization for Release of Health Information Form (ARHI) Spanish Version Attachment #3: ARHI Tracking Form Attachment #4: WIC HIN Declination Form Attachment #5: WIC HIN Declination Form Spanish Version Attachment #6: WVHIN Continuance Document Attachment #7: Remote Services Acknowledgement Form (RSAF) in English Attachment #8: Remote Services Acknowledgement Form (RSAF) in Spanish

Page 5 of 5