Outlineof this section
1.Comments and requirements for a "Consent" document.
2.Two sample "Consent" forms
Prepared by M.P. Dunlap for HIPAA Training
ConsentsAccording to Hipaa
Inthe December 2000 version of the Privacy rule,HIPAA required a consent. As of themost recent ruling on August 14,2002, the consent requirement was eliminated. However, the HHS did issue someregulation if a covered entity chooses to use a consentas noted in the direct quotes below:
1) “This final rule allowscovered entities that choose to have a consent process complete discretion indesigning that process….Covered entities that choose to obtain consent mayrely on industry practices to design a voluntary consent process that works bestfor their practice area and consumers, but they are not required to do so.”(Fed Reg Vol 67, No 157, p. 53211)
2) “Although covered entitieswill not be required to obtain an individual’s consent, any uses ordisclosures of protected health information for treatment, payment, or healthcare operations must still beconsistent with the covered entity’s notice of privacy practices.”(p. 53211)
3) “…the removal of the consent requirement applies only to consent fortreamtent, payment, and health care operations; it does not alter the requirement to obtain an authorization…foruses and disclosures of protected health information not otherwise permitted bythe Privacy Rule or any other requirements for the use or disclosure ofprotected health information….” (p. 53211)
4) In response to comments about the elimination of the consent, HHS wrote,“The Privacy Ruleprovides a floor of privacy protection. Statelaws that are more stringent remain in force. Inorder not to interfere with such laws and ethical standards, this Rule permitscovered entities to obtain consent. Noris the Privacy Rule intended to serve as a “best practices” standard. Thus professional standardsthat are more protective of privacy retain their vitality.”(p. 53212)
Though the August 14, 2002version of the Privacy Rule overturned the requirement for consent, Oregonlaws and the ethics of all mental health professions require that we have clientconsent to disclose their information for treatment, payment or any otherpurpose. Our ethics require usto protect the privacy of our clients, or, at the very least, educate them aboutthe risks when they use third party payment that can cause them problems due tothe privacy loopholes under HIPAA.
Belowwe offer one sample of “Consent” language that may help protect youwhen the information you disclose for insurance reimbursement leaves yourcontrol and warns your client of the privacy they have at risk. Generally, consents should be simple to understand, presented in clearlanguage, dated, and signed by clients. It’s a good idea to give a copyof your version of a consent form to your client.
SampleLanguage for Consent forms
Forgeneral guidelines for the construction of consents, we refer you to thelist of criteria that HIPAA had previously required (Elementsof a valid consent under HIPAA as of12-2000 but no longer required as of 8-2002)
1. “Must be written inplain language”.
1. Must state purpose of the “use” or “disclosure”: Treatment,payment, and/or healthcare
3. Must a) refer the clientto a separate privacy practices notice,b) state that the client’s “right”to review” the privacy practices notice beforesigning the consent, c) indicatethe privacy practices may changeif the CE has reserved that right in their privacy notice, and d)“describe how” to “obtain a revised notice” of the privacy practices.
4. Mustinclude 1) a “right to request restrictions” on a CE’s privacy practicesand state both 2) that the CE “is not required to agree” but 3) if the CE agreesthe “restriction is binding”.
5. Must have signature and date (electronic signature will suffice).
6. Must be visually and/or organizationally separatefrom other consents or authorizations (exception for research combined withTreatment).
7. Must state it is revocable in writing at any time “except to the extent that thecovered entity has taken action in reliance thereof”.
8. Leavingout onethese elements invalidates the consent
Other possiblevariations in the language for sample consents:
Thisform will authorize the release of information from my confidential treatmentrecord to my health insurance carrier or its agents for the purposeof submitting billings for health insurance benefits, or reimbursements, orother similar decisions pertaining to my insurance coverage.
I understand that, by law, I need not consent tothe release of this information. This information is not required for mytreatment. However, I choose to do so willingly for the purposes specifiedabove. I understand that I may revoke this Consent in writing at any time,except to the extent that action has been taken in reliance on my consent.Further, I understand that copies of all billings, reports or similar documentsreleased to my insurance company or its agent shall also be available to me.
As more fully explained in our/my Notice of Privacy Practices, you mayhave the right to request restrictions on how we use and disclose your protectedhealth information for treatment, payment, and health care operations. We are not required to agree to your request, but if we do agree, we arerequired to comply with your request unless the information is needed to provideemergency treatment to you.
Consentsmay also include an informedconsent to receive treatment, assign benefits, and cite state lawsrequiring sharing of info, e.g., about HIV. This list below is offered as anexample of a common format you may have seen if, e.g., you’ve ever hadsurgery:
1. Statement of purpose, e.g.: “this info is provided for you to make aninformed decision about…”
2. Whether this treatment isan elective or emergency procedure
5. Client’s acceptance: “Thedetails have been presented to me about...and I give permission...”
Birthdate: _______________________________ SS#:____________________________
IConsent to the release of information from my confidential treatment record fortreatment, payment, and healthcare operations. [See definitions below.]
Iunderstand that, by law, I need not consent to the release of this information.This Consent for disclosure of information is not required for my treatment. However, I choose to do so willingly for the purposes specified above. Iunderstand that I may revoke this Consent, in writing, at any time, except tothe extent that action has been taken in reliance on my consent. Further, I understand that copies of all billings, reports orsimilar documents released to my insurance company or its agent shall also beavailable to me.
Pleasereview the definitions below, and this practice’s NoticeOf Privacy Practicesfor additional information about the uses and disclosures of informationdescribed in this Consent prior to signing this Consent.
Signature:_____________________________ Date: ______
Client, or parent or legal guardian of client.
Pleaseverify that you have received a copy of our Notice of Privacy Practices bysigning your initials here: ______