DHHS Home Page NC DHHS On-Line Manuals  
     DHHS Manual Home Manual Admin Letters Change Notices Archive Search Index Help Feedback

Previous PageTable of ContentsNext Page

DHHS POLICIES AND PROCEDURES

__________________________________________________________________________________________________________________________

Section VII:

Privacy and Security

Title:

Privacy Manual

Chapter:

Use & Disclosure Policies, Consent for Treatment, Payment, and Health Care Operations

Current Effective Date:

2/1/16, 11/15/15

Revision History:

10/30/03, 11/15/15

Original Effective Date:

4/14/03

__________________________________________________________________________________________________________________________

Purpose

The purpose of this policy is to provide direction to facilities within the North Carolina Department of Health and Human Services (NC DHHS) in the use and disclosure of health information for treatment, payment, and health care operations (TPO) and to ensure compliance with NC General Statutes, as required.

POLICY

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule allows covered health care components to use individually identifiable health information within the facility and to disclose individually identifiable health information outside the facility without consent from the client or the client's personal representative for the purposes of treatment, payment, and health care operations. NC General Statute (GS) 122C-53(a) requires written consent for disclosure of confidential information unless there are other state laws that permit such disclosures without consent; therefore, NC law preempts the HIPAA Privacy Rule and consent must be obtained prior to release of individually identifying health information for specific treatment, payment, and health care operation purposes not otherwise allowed by law.

The DHHS Consent for TPO allows staff in each facility to share and use the health information of clients who are receiving treatment in their facility and to disclose individually identifiable health information outside the facility for treatment, payment, and health care operation purposes. This consent does not replace each facility's Consent for Treatment, nor does it replace the DHHS Authorization to Disclose Health Information for disclosing individually identifiable health information for purposes other than treatment, payment, or health care operations.

Facilities operated by DMH/DD/SAS shall obtain written consent from the client or personal representative prior to use and disclosure of individually identifiable health information for the purposes of treatment, payment, and health care operations. No covered health care component may condition treatment on the client providing consent for treatment, payment, and health care operations.

Without such consent, no individually identifiable health information may be disclosed outside the covered health care component unless there is an authorization from the client.

The signed DHHS Consent for TPO shall be considered valid for the period of time needed to fulfill its purpose for treatment and health care operations for up to one (1) year, after which time a new consent must be completed and signed. Any time during the year whenever a new person or agency not covered in the consent form is identified as a recipient of individually identifiable health information for TPO, a new DHHS Consent for TPO or an authorization from the client must be completed. For payment purposes, the consent is valid until the need for disclosure is satisfied.

The department shall provide a template for use by all facilities in developing their consent forms for using and/or disclosing individually identifiable health information for treatment, payment, or health care operations. The consent template shall contain the basic elements required by state and federal laws and regulations. Agencies may add additional elements to meet the needs of each facility.

Facility procedures must specify the differences in requirements and implementation of:

Procedures

Exceptions to the consent requirement permit use and disclosure without consent as follows:

Each facility must develop and implement procedures for obtaining consent for treatment, payment, and health care operations from all new clients at the time of admission after the effective date of this policy. Facilities must also develop a policy and procedure for consent requirements when the same client is readmitted to the facility before the original consent expires. Procedures should include the process staff should follow when a client does not wish to consent to the use of or disclosure to all of the people/agencies listed on the consent template (e.g., allowing the client to strike through and initial the changes/deletions they desire.)

It is acceptable for facilities to phase-in the consent requirement for clients who were already residing in the facility on the implementation date of this policy. For long-term clients, it is recommended that such consent be obtained at the client's annual review, unless the need to disclose information comes before the annual review, at which time the consent would be obtained. Facilities must develop the agency's process for obtaining consent from long-term clients who were already residing in the facility prior to the implementation date of this policy and must determine if consent should be obtained at the time of their annual review or sooner.

Any time a disclosure for treatment, payment, or health care operations is to be made to a person or agency that is not covered on the consent form, facilities must initiate a new DHHS Consent for TPO or an authorization that identifies the new entity. Staff must be instructed that until the DHHS Consent for TPO is obtained from clients already residing in the facility, the facility may disclose information for treatment and health care operations only as identified in the agency's Notice of Privacy Practices.

Facilities must document and implement the agency's process for informing staff of these rules.

For questions or clarification on any of the information contained in this policy, please contact DHHS Privacy Officer. For general questions about department-wide policies and procedures, contact the DHHS Policy Coordinator.

Previous PageTop Of PageNext Page



   


     DHHS Manual Home Manual Admin Letters Change Notices Archive Search Index Help Feedback