DHHS POLICIES AND PROCEDURES
|Section VIII: Security and Privacy
Title: Privacy Manual
Chapter: Use and Disclosure Policies, Authorizations
Current Effective Date: 5-1-05
Revision History: 10-09-03
Original Effective Date: 4-14-03
The purpose of this policy is to specify requirements for authorization to disclose individually identifiable health information and to develop a standard authorization form that must be used by all Department of Health and Human Services (DHHS) agencies that serve clients.
Any of the following DHHS agencies that serve clients must comply with this policy:
Each DHHS agency shall make reasonable efforts to protect individually identifying health information maintained by that agency. Therefore, no DHHS agency shall disclose, or be required to disclose, in individually identifiable format, information about any such individual without that individual’s explicit authorization, unless for specifically enumerated purposes such as emergency treatment, public health, law enforcement, audit/oversight purposes, or unless state or federal law allows specific disclosures.
DHHS agencies as identified in the Purpose Section of this policy shall disclose individually identifying health information only upon authorization by the client (or personal representative), unless state or federal law allows for specific exceptions. Authorizations obtained or received for disclosure of individually identifiable health information must be consistent with authorization requirements identified in this policy. An authorization permits, but does not require, a DHHS agency to disclose individually identifiable health information.
DHHS Standard Authorization
All DHHS agencies shall utilize the standard authorization form, Authorization to Disclose Health Information and available in Spanish. The standard authorization form is written in plain and simple language that a client or personal representative can easily read and understand. The standard authorization shall be made available in languages understood by a substantial number of clients served by each agency. At a minimum, the department shall ensure the standard authorization in Spanish translation is available to DHHS agencies. Braille authorization forms shall be available to clients who are blind from the Division of Services for the Blind, upon request for such format.
DHHS divisions and offices may add their agency’s identification information and form number to the standard form; however, any other alterations to the standard form must be prior approved by the DHHS Privacy Officer, who is responsible for the development and maintenance of the DHHS standard authorization form. Each agency is responsible for printing its own authorization forms.
The DHHS standard authorization form shall contain the core elements listed below. Any authorization form received by a DHHS agency from an agency/individual outside of DHHS shall be honored only if it contains the following elements:
A specific and meaningful description of the information to be used or disclosed;
The name or other specific identification of the person or class of persons authorized to make the requested use or disclosure of the information;
The name or other specific identification of the person or class of persons to whom the use or disclosure can be made;
A description of each purpose of the requested disclosure (the statement “at the request of the client” is a sufficient description of the purpose when a client initiates the authorization and does not, or elects not to, provide a statement of the purpose);
An expiration date or event that relates to the client or the purpose of the use or disclosure. The following statements meet the requirements for an expiration date or an expiration event if the appropriate conditions apply:
The statement “end of the research study” or similar language is sufficient if the authorization is for use or disclosure of individually identifying health information for research.
The statement “none” or similar language is sufficient if the authorization is for the agency to use or disclose individually identifying health information for the creation and maintenance of a research database or research repository; and
Signature of the client and the date of the signature. If a client’s personal representative signs the authorization form, a description of the personal representative’s authority to act on behalf of the client must also be provided.
In addition to the required elements, the authorization form must contain statements that inform the client of the following:
The client’s right to revoke the authorization, the exceptions to the right to revoke, and a description of how the client may revoke the authorization;
The consequences (as identified in the “Conditioning of Authorizations” section of this policy) to the client for refusal to sign the authorization form; and
The potential for information to be subject to re-disclosure by the recipient and no longer protected by state or federal law.
Each agency must provide a copy of the signed authorization to the client (or personal representative) upon request.
An authorization shall be considered invalid if the document has any of the following deficiencies:
The expiration date has passed or the expiration event is known to have occurred;
The authorization form is not completely filled out;
The authorization form does not contain the core elements of a valid authorization;
The authorization is known to have been revoked;
Any information recorded on the authorization form is known to be false; or
An authorization for psychotherapy notes is combined with a request for disclosure of information other than psychotherapy notes.
A separate authorization must be obtained for disclosure of the personal notes of a mental health professional that are
separated from the rest of a client’s record, except as follows:
Use by the originator of the psychotherapy notes for treatment purposes;
Use or disclosure by a DHHS agency for its own training programs in which students, trainees or practitioners in mental health learn under supervision to practice or improve their skills in group, joint, family or individual counseling;
Use or disclosure by the DHHS agency to defend itself in a legal action or other proceeding brought by a client;
Investigations by the Secretary of the US Department of Health and Human Services;
Use or disclosure required by law;
Health oversight activities;
Coroners and Medical Examiners; or
Institution Review Board or Privacy Board approval for waiver of authorization for research purposes.
Questions regarding the agency’s authority to disclose psychotherapy notes without a valid authorization should be referred to the DHHS Privacy Officer.
An authorization for disclosure of individually identifiable health information shall not be combined with any other written legal permission from the client (e.g., Consent for Treatment, Assignment of Benefits); however, research studies that include treatment may combine authorizations for the same research study, including consent to participate in the study.
An authorization for disclosure of psychotherapy notes may not be combined with any other authorization; however, psychotherapy notes that are needed from more than one provider or are disclosed to more than one recipient may be combined.
Agencies may use a single authorization for disclosure to multiple agencies involved in coordination of care.
An authorization that specifies a condition for the provision of treatment, payment, enrollment in a health plan or eligibility for benefits may not be combined with any other authorization.
Conditioning of Authorization
The provision of treatment, payment, enrollment in a health plan or eligibility for benefits shall not be conditioned on whether or not a client signs an authorization form, except as follows:
The provision of research-related treatment can be conditioned on a client authorizing the use or disclosure of individually identifiable health information for such research;
Provision of health care solely for the purpose of creating individually identifiable health information for disclosure to a third party (e.g., physical exam for life insurance); or
Prior to enrollment in a health plan if authorization is for eligibility or enrollment determinations and the authorization is not for disclosure of psychotherapy notes.
Each authorization must be signed and dated by the client (or personal representative). If a client’s personal representative signs the authorization form, a description of such authority to act for the client must also be documented on the form.
In any of the Mental Health/Developmental Disabilities/Substance Abuse Services institutions operated under the authority of DHHS, whenever the health information of a minor or incompetent adult is to be disclosed to an external client advocate, both the client and the personal representative must sign the authorization.
In the psychiatric hospitals and Alcohol and Drug Abuse Treatment Centers operated under the authority of DHHS, when minors are receiving treatment for alcohol or substance abuse, based upon the consent of their personal representative, the minor and personal representative must both sign the authorization.
G.S. 90-21.5 allows a provider to treat a minor client without consent of a parent or personal representative. When the minor consents to treatment, only the minor is required to sign the authorization.
Should a client (or personal representative) be unable to sign his/her name, an “x” or other mark/symbol is acceptable in place of a signature, as long as it is witnessed and documented, attesting to the validity of the signature.
Each authorization must state an expiration date or event, such as a specific time (e.g., January 1, 2003); a specific time period (e.g., one year from the date of signature); or an event directly relevant to the client or the purpose of the disclosure (e.g., 60 days following discharge from the facility). Unless revoked sooner by the client, an authorization will be valid for a period up to one year, except for financial transactions, wherein the authorization shall be valid indefinitely.
The expiration date or event for each authorization must be acknowledged and actions taken on that authorization must be consistent with such limitations.
Revocation of Authorization
The authorization must state that a client has the right to revoke the authorization at any time, except to the extent that the DHHS agency has already taken action based upon the authorization. The department strongly recommends that clients be encouraged to sign a revocation statement that becomes a permanent part of the record. Should a client refuse to sign a request for revocation, the verbal revocation statement should be witnessed by a third-party and documentation of the request should be placed in the client’s record. The authorization form must include instructions on how the client may revoke an authorization.
DHHS agencies that maintain authorization forms in their client records must adhere to the retention period in the agency’s retention and disposition schedule for client records.
If authorization forms are maintained separately from client records, the authorization forms must be maintained in accordance with the General Schedule for State Agency Records issued by the North Carolina Department of Cultural Resources, Division of Archives and History, Archives and Records Section, Government Records Branch.
An original authorization form is preferred for disclosure of individually identifiable health information; however, a clear and legible photocopy/facsimile is acceptable.
The authorization requirements contained in this policy also apply to contractors who perform a service for or on behalf of a DHHS agency. Such contractors are limited to those disclosures permitted in an agreement with the agency. Contractors are responsible for ensuring these policy requirements are enforced with any sub-contractors they may use.
Reference: DHHS Directive Number III-11; 45 CFR 164.508; 10 NCAC 18D; 10 NCAC 24B; 45 CFR 431.306; NCGS 122 C-51-57; NCGS 130A-143; 42 CFR 2.31
Authorization to Disclose Health
Information and Spanish version
For questions or clarification on any of the information contained in this policy, please contact DHHS Privacy Officer. For general questions about department-wide policies and procedures, contact the Office of Policy & Planning.
For questions or clarification on any of the policy contained in these
manuals, please contact the local district office.