DHHS Home Page NC DHHS On-Line Manuals  
     DHHS Manual Home Manual Admin Letters Change Notices Archive Search Index Help Feedback


Previous Page Table Of Contents Next Page


Section VIII: Security and Privacy
Title: Privacy Manual
Chapter: Use and Disclosure Policies, Authorizations
Current Effective Date: 5-1-05
Revision History: 10-09-03
Original Effective Date: 4-14-03


The purpose of this policy is to specify requirements for authorization to disclose individually identifiable health information and to develop a standard authorization form that must be used by all Department of Health and Human Services (DHHS) agencies that serve clients.

Any of the following DHHS agencies that serve clients must comply with this policy:


Each DHHS agency shall make reasonable efforts to protect individually identifying health information maintained by that agency. Therefore, no DHHS agency shall disclose, or be required to disclose, in individually identifiable format, information about any such individual without that individual’s explicit authorization, unless for specifically enumerated purposes such as emergency treatment, public health, law enforcement, audit/oversight purposes, or unless state or federal law allows specific disclosures.


DHHS agencies as identified in the Purpose Section of this policy shall disclose individually identifying health information only upon authorization by the client (or personal representative), unless state or federal law allows for specific exceptions. Authorizations obtained or received for disclosure of individually identifiable health information must be consistent with authorization requirements identified in this policy. An authorization permits, but does not require, a DHHS agency to disclose individually identifiable health information.


DHHS Standard Authorization

All DHHS agencies shall utilize the standard authorization form, Authorization to Disclose Health Information and available in Spanish. The standard authorization form is written in plain and simple language that a client or personal representative can easily read and understand. The standard authorization shall be made available in languages understood by a substantial number of clients served by each agency. At a minimum, the department shall ensure the standard authorization in Spanish translation is available to DHHS agencies. Braille authorization forms shall be available to clients who are blind from the Division of Services for the Blind, upon request for such format.

DHHS divisions and offices may add their agency’s identification information and form number to the standard form; however, any other alterations to the standard form must be prior approved by the DHHS Privacy Officer, who is responsible for the development and maintenance of the DHHS standard authorization form. Each agency is responsible for printing its own authorization forms.

Valid Authorization

The DHHS standard authorization form shall contain the core elements listed below. Any authorization form received by a DHHS agency from an agency/individual outside of DHHS shall be honored only if it contains the following elements:

In addition to the required elements, the authorization form must contain statements that inform the client of the following:

Each agency must provide a copy of the signed authorization to the client (or personal representative) upon request.

Invalid Authorization

An authorization shall be considered invalid if the document has any of the following deficiencies:

Psychotherapy Notes

A separate authorization must be obtained for disclosure of the personal notes of a mental health professional that are

separated from the rest of a client’s record, except as follows:

Questions regarding the agency’s authority to disclose psychotherapy notes without a valid authorization should be referred to the DHHS Privacy Officer.

Compound Authorization

An authorization for disclosure of individually identifiable health information shall not be combined with any other written legal permission from the client (e.g., Consent for Treatment, Assignment of Benefits); however, research studies that include treatment may combine authorizations for the same research study, including consent to participate in the study.

An authorization for disclosure of psychotherapy notes may not be combined with any other authorization; however, psychotherapy notes that are needed from more than one provider or are disclosed to more than one recipient may be combined.

Agencies may use a single authorization for disclosure to multiple agencies involved in coordination of care.

An authorization that specifies a condition for the provision of treatment, payment, enrollment in a health plan or eligibility for benefits may not be combined with any other authorization.

Conditioning of Authorization

The provision of treatment, payment, enrollment in a health plan or eligibility for benefits shall not be conditioned on whether or not a client signs an authorization form, except as follows:


Each authorization must be signed and dated by the client (or personal representative). If a client’s personal representative signs the authorization form, a description of such authority to act for the client must also be documented on the form.

In any of the Mental Health/Developmental Disabilities/Substance Abuse Services institutions operated under the authority of DHHS, whenever the health information of a minor or incompetent adult is to be disclosed to an external client advocate, both the client and the personal representative must sign the authorization.

In the psychiatric hospitals and Alcohol and Drug Abuse Treatment Centers operated under the authority of DHHS, when minors are receiving treatment for alcohol or substance abuse, based upon the consent of their personal representative, the minor and personal representative must both sign the authorization.

G.S. 90-21.5 allows a provider to treat a minor client without consent of a parent or personal representative. When the minor consents to treatment, only the minor is required to sign the authorization.

Should a client (or personal representative) be unable to sign his/her name, an “x” or other mark/symbol is acceptable in place of a signature, as long as it is witnessed and documented, attesting to the validity of the signature.


Each authorization must state an expiration date or event, such as a specific time (e.g., January 1, 2003); a specific time period (e.g., one year from the date of signature); or an event directly relevant to the client or the purpose of the disclosure (e.g., 60 days following discharge from the facility). Unless revoked sooner by the client, an authorization will be valid for a period up to one year, except for financial transactions, wherein the authorization shall be valid indefinitely.

The expiration date or event for each authorization must be acknowledged and actions taken on that authorization must be consistent with such limitations.

Revocation of Authorization

The authorization must state that a client has the right to revoke the authorization at any time, except to the extent that the DHHS agency has already taken action based upon the authorization. The department strongly recommends that clients be encouraged to sign a revocation statement that becomes a permanent part of the record. Should a client refuse to sign a request for revocation, the verbal revocation statement should be witnessed by a third-party and documentation of the request should be placed in the client’s record. The authorization form must include instructions on how the client may revoke an authorization.

Retention Period

DHHS agencies that maintain authorization forms in their client records must adhere to the retention period in the agency’s retention and disposition schedule for client records.

If authorization forms are maintained separately from client records, the authorization forms must be maintained in accordance with the General Schedule for State Agency Records issued by the North Carolina Department of Cultural Resources, Division of Archives and History, Archives and Records Section, Government Records Branch.

Photocopy/Facsimile Authorizations

An original authorization form is preferred for disclosure of individually identifiable health information; however, a clear and legible photocopy/facsimile is acceptable.

Contractor Authorizations

The authorization requirements contained in this policy also apply to contractors who perform a service for or on behalf of a DHHS agency. Such contractors are limited to those disclosures permitted in an agreement with the agency. Contractors are responsible for ensuring these policy requirements are enforced with any sub-contractors they may use.

Reference: DHHS Directive Number III-11; 45 CFR 164.508; 10 NCAC 18D; 10 NCAC 24B; 45 CFR 431.306; NCGS 122 C-51-57; NCGS 130A-143; 42 CFR 2.31

Relevant forms:

Authorization to Disclose Health Information and Spanish version
For questions or clarification on any of the information contained in this policy, please contact DHHS Privacy Officer. For general questions about department-wide policies and procedures, contact the Office of Policy & Planning.


Previous Page Top Of Page Next Page

  For questions or clarification on any of the policy contained in these manuals, please contact the local district office.

     DHHS Manual Home Manual Admin Letters Change Notices Archive Search Index Help Feedback