I acknowledge MyRxWallet’s NPP per 45 CFR § 164.520. PHI may be used for Treatment, Payment, and Healthcare Operations (TPO) per § 164.506. Rights retained: access records (§ 164.524), amendments (§ 164.526), accounting of disclosures (§ 164.528), restrict uses (§ 164.522), revoke authorization at any time (§ 164.508(b)(5)).

I authorize MyRxWallet as my personal representative to retrieve records from: (a) providers; (b) insurers via CMS Blue Button 2.0 / CARIN Alliance APIs; (c) TEFCA/QHIN networks via patient-as-requester; (d) federal programs (Medicare, Medicaid, VA, TriCare). Denial may constitute information blocking reportable to ONC under 21st Century Cures Act § 4004.

I authorize MyRxWallet to encrypt records using patient-controlled keys in my personal MyRx-Vault. MyRxWallet holds only encrypted ciphertext — cannot read my records without my key. HIPAA conduit exception (45 CFR § 164.501) applies. Data at rest: NIST SP 800-111. In transit: TLS 1.3 per 45 CFR § 164.312(e)(2)(ii).

No provider, insurer, employer, or researcher may access my records without: (a) a valid unexpired consent token I personally issued; (b) a stated purpose; (c) my real-time approval or denial. All consent events are recorded on MyRx-DAO consent ledger — immutable and time-stamped. Unauthorized access violates 45 CFR § 164.502, 18 U.S.C. § 1030 (CFAA).

MyRxWallet warrants: (a) HITECH § 13405(d): No PHI sold without explicit written authorization; (b) 42 CFR Part 2: SUD treatment records receive heightened protections requiring separate consent except medical emergencies; (c) HITECH § 13405(a): No PHI used for marketing; (d) Right to opt out of fundraising per 45 CFR § 164.514(f).

I authorize MyRxWallet to: (a) retrieve and display controlled substance prescription history; (b) support drug provenance verification per DSCSA (21 U.S.C. § 360eee); (c) generate FDA recall alerts via EDDS data. MyRxWallet shall NOT transmit controlled substance info to law enforcement without court order, subpoena, or my written authorization — except as required by 21 U.S.C. § 827.

I authorize MyRxWallet as my authorized individual representative for TEFCA queries via QHINs per Common Agreement v2.0 and 45 CFR § 170.401. AI agents will: (a) automatically initiate TEFCA queries on account activation; (b) encrypt retrieved records with zero human PHI review; (c) monitor for lab alerts, drug interactions, and care gaps. AI agents operate under NIST AI RMF and shall not share, sell, or monetize my data.

I consent to electronic records and signatures per E-SIGN Act (15 U.S.C. § 7001) and UETA. This form and my signature constitute valid HIPAA authorization per 45 CFR § 164.508(b). Consent event recorded per 21 CFR Part 11 on MyRx-Chain (timestamp, IP hash, SHA-256 doc hash). I consent to SMS notifications per TCPA (47 U.S.C. § 227) and ECPA (18 U.S.C. § 2510). Reply STOP to opt out.

I authorize MyRxWallet to capture and store my biometric identifiers — live facial scan and face geometry templates — solely for Face ID authentication and identity verification. Data is AES-256-GCM encrypted, stored on-device only, never sold or shared with third parties. Retention: active account + 30 days post-deletion. Revocable anytime via Settings → Security. Governed by BIPA (740 ILCS 14), CCPA Cal. Civ. Code § 1798.140(b), and NIST SP 800-76-2.

As a HIPAA-covered entity or business associate, I execute this BAA per 45 CFR Parts 160 and 164. I am authorized to bind my organization to this agreement.

I authorize activation of a Provider Credit Pool for patient reward redemptions. Pools activate on credentialing — no AKS gate required. Rewards = health outcomes, not kickbacks.

I agree to real-time and recurring federal/state credential verification (every 90 days), immutable on-chain recording of credentialing events, and auto-suspension upon any failed verification check.