DHHS Home Page NC DHHS On-Line Manuals  
     DHHS Manual Home Manual Admin Letters Change Notices Archive Search Index Help Feedback

Previous PageTable of ContentsNext Page

DHHS POLICIES AND PROCEDURES

________________________________________________________________________________________________________________

Section VIII:

Privacy and Security

Title:

Privacy Manual

Chapter:

Use and Disclosure Policies, Authorizations

Current Effective Date:

2/1/16, 11/15/15, 5/1/05

Revision History:

10/9/03, 11/15/15

Original Effective Date:

4/14/03

________________________________________________________________________________________________________________

Purpose

The purpose of this policy is to specify requirements for authorization to disclose individually identifiable health information. Each DHHS agency shall make reasonable efforts to protect individually identifying health information maintained by that agency. Therefore, no DHHS agency shall disclose, or be required to disclose, in individually identifiable format, information about any such individual without that individual’s explicit authorization, unless for specifically enumerated purposes such as emergency treatment, public health, law enforcement, audit/oversight purposes, or unless state or federal law allows specific disclosures.

Policy

DHHS agencies as identified in the Purpose Section of this policy shall disclose individually identifying health information only upon authorization by the client (or personal representative), unless state or federal law allows for specific exceptions. Authorizations obtained or received for disclosure of individually identifiable health information must be consistent with authorization requirements identified in this policy. An authorization permits, but does not require, a DHHS agency to disclose individually identifiable health information.

Implementation

DHHS agencies shall disclose individually identifying health information only upon authorization by the client (or personal representative), unless state or federal law allows for specific exceptions. Authorizations obtained or received for disclosure of individually identifiable health information must be consistent with authorization requirements identified in this policy. An authorization permits, but does not require, a DHHS agency to disclose individually identifiable health information.

All DHHS agencies shall utilize the standard authorization form, it is written in plain and simple language that a client or personal representative can easily read and understand. The standard authorization shall be made available in languages understood by a substantial number of clients served by each agency. At a minimum, the department shall ensure the standard authorization in Spanish translation is available to DHHS agencies. Braille authorization forms shall be available to clients who are blind from the DHHS Division of Services for the Blind, upon request for such format.

DHHS divisions and offices may add their agency’s identification information and form number to the standard form; however, any other alterations to the standard form must be prior approved by the DHHS Privacy Officer, who is responsible for the development and maintenance of the DHHS standard authorization form. Each agency is responsible for printing its own authorization forms.

The DHHS standard authorization form shall contain the core elements listed below. Any authorization form received by a DHHS agency from an agency/individual outside of DHHS shall be honored only if it contains the following elements:

  • A specific and meaningful description of the information to be used or disclosed;
  • The name or other specific identification of the person or class of persons authorized to make the requested use or disclosure of the information;
  • The name or other specific identification of the person or class of persons to whom the use or disclosure can be made;
  • A description of each purpose of the requested disclosure (the statement “at the request of the client” is a sufficient description of the purpose when a client initiates the authorization and does not, or elects not to, provide a statement of the purpose);
  • An expiration date or event that relates to the client or the purpose of the use or disclosure. The following statements meet the requirements for an expiration date or an expiration event if the appropriate conditions apply:
  • The statement “end of the research study” or similar language is sufficient if the authorization is for use or disclosure of individually identifying health information for research.
  • The statement “none” or similar language is sufficient if the authorization is for the agency to use or disclose individually identifying health information for the creation and maintenance of a research database or research repository; and
  • Signature of the client and the date of the signature. If a client’s personal representative signs the authorization form, a description of the personal representative’s authority to act on behalf of the client must also be provided.

In addition to the required elements, the authorization form must contain statements that inform the client of the following:

  • The client’s right to revoke the authorization, the exceptions to the right to revoke, and a description of how the client may revoke the authorization;
  • The consequences (as identified in the “Conditioning of Authorizations” section of this policy) to the client for refusal to sign the authorization form; and
  • The potential for information to be subject to redisclosure by the recipient and no longer protected by state or federal law.

Each agency must provide a copy of the signed authorization to the client (or personal representative) upon request.

An authorization shall be considered invalid if the document has any of the following deficiencies:

  • The expiration date has passed or the expiration event is known to have occurred;
  • The authorization form is not completely filled out;
  • The authorization form does not contain the core elements of a valid authorization;
  • The authorization is known to have been revoked;
  • Any information recorded on the authorization form is known to be false; or
  • An authorization for psychotherapy notes is combined with a request for disclosure of information other than psychotherapy notes.

A separate authorization must be obtained for disclosure of the personal notes of a mental health professional that are separated from the rest of a client’s record, except as follows:

  • Use by the originator of the psychotherapy notes for treatment purposes;
  • Use or disclosure by a DHHS agency for its own training programs in which students, trainees or practitioners in mental health learn under supervision to practice or improve their skills in group, joint, family or individual counseling;
  • Use or disclosure by the DHHS agency to defend itself in a legal action or other proceeding brought by a client;
  • Investigations by the Secretary of the US Department of Health and Human Services;
  • Use or disclosure required by law;
  • Health oversight activities;
  • Coroners and medical examiners; or
  • Institution review board or Privacy Board approval for waiver of authorization for research purposes.

Questions regarding the agency’s authority to disclose psychotherapy notes without a valid authorization should be referred to the DHHS Privacy Officer.

An authorization for disclosure of individually identifiable health information shall not be combined with any other written legal permission from the client (e.g., Consent for Treatment, Assignment of Benefits); however, research studies that include treatment may combine authorizations for the same research study, including consent to participate in the study.

An authorization for disclosure of psychotherapy notes may not be combined with any other authorization; however, psychotherapy notes that are needed from more than one provider or are disclosed to more than one recipient may be combined.

Agencies may use a single authorization for disclosure to multiple agencies involved in coordination of care.

An authorization that specifies a condition for the provision of treatment, payment, enrollment in a health plan or eligibility for benefits may not be combined with any other authorization.

The provision of treatment, payment, enrollment in a health plan or eligibility for benefits shall not be conditioned on whether or not a client signs an authorization form, except as follows:

  • The provision of research-related treatment can be conditioned on a client authorizing the use or disclosure of individually identifiable health information for such research;
  • Provision of health care solely for the purpose of creating individually identifiable health information for disclosure to a third party (e.g., physical exam for life insurance); or

Prior to enrollment in a health plan if authorization is for eligibility or enrollment determinations and the authorization is not for disclosure of psychotherapy notes.

Signatures

Each authorization must be signed and dated by the client (or personal representative). If a client’s personal representative signs the authorization form, a description of such authority to act for the client must also be documented on the form.

In any of the mental health/developmental disabilities/substance abuse services institutions operated under the authority of DHHS, whenever the health information of a minor or incompetent adult is to be disclosed to an external client advocate, both the client and the personal representative must sign the authorization.

In the psychiatric hospitals and alcohol and drug abuse treatment centers operated under the authority of DHHS, when minors are receiving treatment for alcohol or substance abuse, based upon the consent of their personal representative, the minor and personal representative must both sign the authorization.

G.S. 90-21.5 allows a provider to treat a minor client without consent of a parent or personal representative. When the minor consents to treatment, only the minor is required to sign the authorization.

Should a client (or personal representative) be unable to sign his/her name, an “x” or other mark/symbol is acceptable in place of a signature, as long as it is witnessed and documented, attesting to the validity of the signature.

Dates

Each authorization must state an expiration date or event, such as a specific time (e.g., January 1, 2003); a specific time period (e.g., one (1) year from the date of signature); or an event directly relevant to the client or the purpose of the disclosure (e.g., 60 days following discharge from the facility). Unless revoked sooner by the client, an authorization will be valid for a period up to one (1) year, except for financial transactions, wherein the authorization shall be valid indefinitely.

The expiration date or event for each authorization must be acknowledged and actions taken on that authorization must be consistent with such limitations.

Revocation of Authorization

The authorization must state that a client has the right to revoke the authorization at any time, except to the extent that the DHHS agency has already taken action based upon the authorization. The department strongly recommends that clients be encouraged to sign a revocation statement that becomes a permanent part of the record. Should a client refuse to sign a request for revocation, the verbal revocation statement should be witnessed by a third-party and documentation of the request should be placed in the client’s record. The authorization form must include instructions on how the client may revoke an authorization.

Retention Period

DHHS agencies that maintain authorization forms in their client records must adhere to the retention period in the agency’s retention and disposition schedule for client records.

If authorization forms are maintained separately from client records, the authorization forms must be maintained in accordance with the General Schedule for State Agency Records issued by the North Carolina Department of Cultural Resources, Division of Archives and History, Archives and Records Section, Government Records Branch.

Photocopy/Facsimile Authorizations

An original authorization form is preferred for disclosure of individually identifiable health information; however, a clear and legible photocopy/facsimile is acceptable.

Contractor Authorizations

The authorization requirements contained in this policy also apply to contractors who perform a service for or on behalf of a DHHS agency. Such contractors are limited to those disclosures permitted in an agreement with the agency. Contractors are responsible for ensuring these policy requirements are enforced with any sub-contractors they may use.


For questions or clarification on any of the information contained in this policy, please contact DHHS Privacy Officer. For general questions about department-wide policies and procedures, contact the DHHS Policy Coordinator.



Previous PageTop Of PageNext Page



 


     DHHS Manual Home Manual Admin Letters Change Notices Archive Search Index Help Feedback