Use and Disclosure Policies, Authorizations
Current Effective Date:
2/1/16, 11/15/15, 5/1/05
Original Effective Date:
The purpose of this policy is to specify requirements for authorization to disclose individually identifiable health information. Each DHHS agency shall make reasonable efforts to protect individually identifying health information maintained by that agency. Therefore, no DHHS agency shall disclose, or be required to disclose, in individually identifiable format, information about any such individual without that individual’s explicit authorization, unless for specifically enumerated purposes such as emergency treatment, public health, law enforcement, audit/oversight purposes, or unless state or federal law allows specific disclosures.
DHHS agencies as identified in the Purpose Section of this policy shall disclose individually identifying health information only upon authorization by the client (or personal representative), unless state or federal law allows for specific exceptions. Authorizations obtained or received for disclosure of individually identifiable health information must be consistent with authorization requirements identified in this policy. An authorization permits, but does not require, a DHHS agency to disclose individually identifiable health information.
DHHS agencies shall disclose individually identifying health information only upon authorization by the client (or personal representative), unless state or federal law allows for specific exceptions. Authorizations obtained or received for disclosure of individually identifiable health information must be consistent with authorization requirements identified in this policy. An authorization permits, but does not require, a DHHS agency to disclose individually identifiable health information.
All DHHS agencies shall utilize the standard authorization form, it is written in plain and simple language that a client or personal representative can easily read and understand. The standard authorization shall be made available in languages understood by a substantial number of clients served by each agency. At a minimum, the department shall ensure the standard authorization in Spanish translation is available to DHHS agencies. Braille authorization forms shall be available to clients who are blind from the DHHS Division of Services for the Blind, upon request for such format.
DHHS divisions and offices may add their agency’s identification information and form number to the standard form; however, any other alterations to the standard form must be prior approved by the DHHS Privacy Officer, who is responsible for the development and maintenance of the DHHS standard authorization form. Each agency is responsible for printing its own authorization forms.
The DHHS standard authorization form shall contain the core elements listed below. Any authorization form received by a DHHS agency from an agency/individual outside of DHHS shall be honored only if it contains the following elements:
In addition to the required elements, the authorization form must contain statements that inform the client of the following:
Each agency must provide a copy of the signed authorization to the client (or personal representative) upon request.
An authorization shall be considered invalid if the document has any of the following deficiencies:
A separate authorization must be obtained for disclosure of the personal notes of a mental health professional that are separated from the rest of a client’s record, except as follows:
Questions regarding the agency’s authority to disclose psychotherapy notes without a valid authorization should be referred to the DHHS Privacy Officer.
An authorization for disclosure of individually identifiable health information shall not be combined with any other written legal permission from the client (e.g., Consent for Treatment, Assignment of Benefits); however, research studies that include treatment may combine authorizations for the same research study, including consent to participate in the study.
An authorization for disclosure of psychotherapy notes may not be combined with any other authorization; however, psychotherapy notes that are needed from more than one provider or are disclosed to more than one recipient may be combined.
Agencies may use a single authorization for disclosure to multiple agencies involved in coordination of care.
An authorization that specifies a condition for the provision of treatment, payment, enrollment in a health plan or eligibility for benefits may not be combined with any other authorization.
The provision of treatment, payment, enrollment in a health plan or eligibility for benefits shall not be conditioned on whether or not a client signs an authorization form, except as follows:
Prior to enrollment in a health plan if authorization is for eligibility or enrollment determinations and the authorization is not for disclosure of psychotherapy notes.
Each authorization must be signed and dated by the client (or personal representative). If a client’s personal representative signs the authorization form, a description of such authority to act for the client must also be documented on the form.
In any of the mental health/developmental disabilities/substance abuse services institutions operated under the authority of DHHS, whenever the health information of a minor or incompetent adult is to be disclosed to an external client advocate, both the client and the personal representative must sign the authorization.
In the psychiatric hospitals and alcohol and drug abuse treatment centers operated under the authority of DHHS, when minors are receiving treatment for alcohol or substance abuse, based upon the consent of their personal representative, the minor and personal representative must both sign the authorization.
G.S. 90-21.5 allows a provider to treat a minor client without consent of a parent or personal representative. When the minor consents to treatment, only the minor is required to sign the authorization.
Should a client (or personal representative) be unable to sign his/her name, an “x” or other mark/symbol is acceptable in place of a signature, as long as it is witnessed and documented, attesting to the validity of the signature.
Each authorization must state an expiration date or event, such as a specific time (e.g., January 1, 2003); a specific time period (e.g., one (1) year from the date of signature); or an event directly relevant to the client or the purpose of the disclosure (e.g., 60 days following discharge from the facility). Unless revoked sooner by the client, an authorization will be valid for a period up to one (1) year, except for financial transactions, wherein the authorization shall be valid indefinitely.
The expiration date or event for each authorization must be acknowledged and actions taken on that authorization must be consistent with such limitations.
The authorization must state that a client has the right to revoke the authorization at any time, except to the extent that the DHHS agency has already taken action based upon the authorization. The department strongly recommends that clients be encouraged to sign a revocation statement that becomes a permanent part of the record. Should a client refuse to sign a request for revocation, the verbal revocation statement should be witnessed by a third-party and documentation of the request should be placed in the client’s record. The authorization form must include instructions on how the client may revoke an authorization.
DHHS agencies that maintain authorization forms in their client records must adhere to the retention period in the agency’s retention and disposition schedule for client records.
If authorization forms are maintained separately from client records, the authorization forms must be maintained in accordance with the General Schedule for State Agency Records issued by the North Carolina Department of Cultural Resources, Division of Archives and History, Archives and Records Section, Government Records Branch.
An original authorization form is preferred for disclosure of individually identifiable health information; however, a clear and legible photocopy/facsimile is acceptable.
The authorization requirements contained in this policy also apply to contractors who perform a service for or on behalf of a DHHS agency. Such contractors are limited to those disclosures permitted in an agreement with the agency. Contractors are responsible for ensuring these policy requirements are enforced with any sub-contractors they may use.
For questions or clarification on any of the information contained in this policy, please contact DHHS Privacy Officer. For general questions about department-wide policies and procedures, contact the DHHS Policy Coordinator.