AUTHORIZATION TO DISCLOSE HEALTH INFORMATION
DHHS-1000, Authorization to Disclose Health Information
DHHS POLICIES AND PROCEDURES
Section VIII: Security and Privacy
Title: Privacy Manual
Chapter: Use and Disclosure Policies, Authorizations
Current Effective Date: May 1, 2005
Revision History: October 09, 2003
Original Effective Date: April 14, 2003
The purpose of this policy is to
specify requirements for authorization to disclose individually identifiable
health information and to develop a standard authorization form that must be
used by all Department of Health and Humans Services (DHHS) agencies that serve
Any of the following DHHS agencies that serve clients must comply with this policy:
Each DHHS agency shall make reasonable efforts to protect individually identifying health information maintained by that agency. Therefore, no DHHS agency shall disclose, or be required to disclose, in individually identifiable format, information about any such individual without that individual’s explicit authorization, unless for specifically enumerated purposes such as emergency treatment, public health, law enforcement, audit/oversight purposes, or unless state or federal law allows specific disclosures.
DHHS agencies as identified in the Purpose Section of this policy shall disclose individually identifying health information only upon authorization by the client (or personal representative), unless state or federal law allows for specific exceptions. Authorizations obtained or received for disclosure of individually identifiable health information must be consistent with authorization requirements identified in this policy. An authorization permits, but does not require, a DHHS agency to disclose individually identifiable health information.
All DHHS agencies shall utilize the
standard authorization form, Authorization to Disclose Health Information
and available in Spanish. The standard authorization form is written in plain
and simple language that a client or personal representative can easily read
and understand. The standard authorization shall be made available in languages
understood by a substantial number of clients served by each agency. At a minimum,
the department shall ensure the standard authorization in Spanish translation
is available to DHHS agencies. Brailled
authorization forms shall be available to clients who are blind from the Division
of Services for the Blind, upon request for such format.
DHHS divisions and offices may add their agency’s identification information and form number to the standard form; however, any other alterations to the standard form must be prior approved by the DHHS Privacy Officer, who is responsible for the development and maintenance of the DHHS standard authorization form. Each agency is responsible for printing its own authorization forms.
The DHHS standard authorization form shall contain the core elements listed below. Any authorization form received by a DHHS agency from an agency/individual outside of DHHS shall be honored only if it contains the following elements:
In addition to the required elements, the authorization form must contain statements that inform the client of the following:
Each agency must provide a copy of the signed authorization to the client (or personal representative) upon request.
A separate authorization must be obtained for disclosure of the personal notes of a mental health professional that are separated from the rest of a client’s record, except as follows:
Questions regarding the agency’s authority to disclose psychotherapy notes without a valid authorization should be referred to the DHHS Privacy Officer.
An authorization for disclosure of
individually identifiable health information shall not be combined with any
other written legal permission from the client (e.g., Consent for Treatment, Assignment
of Benefits); however, research studies that include treatment may combine authorizations
for the same research study, including consent to participate in the study.
An authorization for disclosure of psychotherapy notes may not be combined with any other authorization; however, psychotherapy notes that are needed from more than one provider or are disclosed to more than one recipient may be combined.
Agencies may use a single authorization for disclosure to multiple agencies involved in coordination of care.
An authorization that specifies a condition for the provision of treatment, payment, enrollment in a health plan or eligibility for benefits may not be combined with any other authorization.
The provision of treatment, payment, enrollment in a health plan or eligibility for benefits shall not be conditioned on whether or not a client signs an authorization form, except as follows:
Each authorization must be signed and dated by the client (or personal representative). If a client’s personal representative signs the authorization form, a description of such authority to act for the client must also be documented on the form.
In any of the Mental Health/Developmental Disabilities/Substance Abuse Services institutions operated under the authority of DHHS, whenever the health information of a minor or incompetent adult is to be disclosed to an external client advocate, both the client and the personal representative must sign the authorization.
In the psychiatric hospitals and
Alcohol and Drug Abuse Treatment Centers operated under the authority of DHHS,
when minors are receiving treatment for alcohol or substance abuse, based upon
the consent of their personal representative, the minor and personal representative
must both sign the authorization.
G.S. 90-21.5 allows a provider to treat a minor client without consent of a parent or personal representative. When the minor consents to treatment, only the minor is required to sign the authorization.
Should a client (or personal representative) be unable to sign his/her name, an “x” or other mark/ symbol is acceptable in place of a signature, as long as it is witnessed and documented, attesting to the validity of the signature.
Each authorization must state an
expiration date or event, such as a specific time (e.g., January 1, 2003); a
specific time period (e.g., one year from the date of signature); or an event
directly relevant to the client or the purpose of the disclosure (e.g., 60 days
following discharge from the facility). Unless revoked sooner by the client,
an authorization will be valid for a period up to one year, except for financial
transactions, wherein the authorization shall be valid indefinitely.
The expiration date or event for each authorization must be acknowledged and actions taken on that authorization must be consistent with such limitations.
The authorization must state that a client has the right to revoke the authorization at any time, except to the extent that the DHHS agency has already taken action based upon the authorization. The department strongly recommends that clients be encouraged to sign a revocation statement that becomes a permanent part of the record. Should a client refuse to sign a request for revocation, the verbal revocation statement should be witnessed by a third-party and documentation of the request should be placed in the client’s record. The authorization form must include instructions on how the client may revoke an authorization.
DHHS agencies that maintain authorization
forms in their client records must adhere to the retention period in the agency’s
retention and disposition schedule for client records.
If authorization forms are maintained separately from client records, the authorization forms must be maintained in accordance with the General Schedule for State Agency Records issued by the North Carolina Department of Cultural Resources, Division of Archives and History, Archives and Records Section, Government Records Branch.
An original authorization form is preferred for disclosure of individually identifiable health information; however, a clear and legible photocopy/facsimile is acceptable.
The authorization requirements contained in this policy also apply to contractors who perform a service for or on behalf of a DHHS agency. Such contractors are limited to those disclosures permitted in an agreement with the agency. Contractors are responsible for ensuring these policy requirements are enforced with any sub-contractors they may use.
Reference: DHHS Directive Number III-11; 45 CFR 164.508; 10 NCAC 18D; 10 NCAC 24B; 45 CFR 431.306; NCGS 122 C-51-57; NCGS 130A-143; 42 CFR 2.31
For questions or clarification on any of the policy contained in these
manuals, please contact the local district office.