Outline of this section

1. Comments and requirements for a "Consent" document.

2. Two sample "Consent" forms

                Prepared by M.P. Dunlap for HIPAA Training

Consents According to Hipaa   

In the December 2000 version of the Privacy rule, HIPAA required a consent.  As of the most recent ruling on August 14, 2002, the consent requirement was eliminated.  However, the HHS did issue some regulation if a covered entity chooses to use a consent as noted in the direct quotes below:

1)      “This final rule allows covered entities that choose to have a consent process complete discretion in designing that process….Covered entities that choose to obtain consent may rely on industry practices to design a voluntary consent process that works best for their practice area and consumers, but they are not required to do so.” (Fed Reg Vol 67, No 157, p. 53211)

2)      “Although covered entities will not be required to obtain an individual’s consent, any uses or disclosures of protected health information for treatment, payment, or health care operations must still be consistent with the covered entity’s notice of privacy practices.” (p. 53211)

3)     “…the removal of the consent requirement applies only to consent for treamtent, payment, and health care operations; it does not alter the requirement to obtain an authorization…for uses and disclosures of protected health information not otherwise permitted by the Privacy Rule or any other requirements for the use or disclosure of protected health information….” (p. 53211)

4)     In response to comments about the elimination of the consent, HHS wrote, “The    Privacy Rule provides a floor of privacy protection.  State laws that are more stringent remain in force.  In order not to interfere with such laws and ethical standards, this Rule permits covered entities to obtain consent.  Nor is the Privacy Rule intended to serve as a “best practices” standard.  Thus professional standards that are more protective of privacy retain their vitality.” (p. 53212)

 

 

Though the August 14, 2002 version of the Privacy Rule overturned the requirement for consent, Oregon laws and the ethics of all mental health professions require that we have client consent to disclose their information for treatment, payment or any other purpose.  Our ethics require us to protect the privacy of our clients, or, at the very least, educate them about the risks when they use third party payment that can cause them problems due to the privacy loopholes under HIPAA.

Below we offer one sample of “Consent” language that may help protect you when the information you disclose for insurance reimbursement leaves your control and warns your client of the privacy they have at risk.  Generally, consents should be simple to understand, presented in clear language, dated, and signed by clients. It’s a good idea to give a copy of your version of a consent form to your client.

 

 

 

Sample Language for Consent forms

CONSENT TO USE OR DISCLOSE CLINICAL INFORMATION  

1 authorize [Name of practitioner/provider or practice group] to use and disclose the health and clinical information of Name of patient   for the purposes of Treatment*, Payment** and Health Care Operations***.  

*Treatment (includes activities performed by[ professional/practice group] providing care to you, coordinating or managing your care with third parties, and consultations with and between other health care professionals. This consent includes treatment provided by any professional who covers this practice as an on-call professional).

**Payment (includes uses and disclosures required for determining your eligibility for health plan coverage, billing and receiving payment for your health benefit claims, and health plan management activities which may include review of your services for clinical necessity, justification of charges, pre certification and preauthorization).

***Health Care Operations (includes the administrative and business functions of this practice).

 

You should review [ professional/practice group][ or my or our] Notice Of Privacy Practices for additional information about the uses and disclosures of information described in this CONSENT prior to signing this CONSENT.

Because we reserve the right to change our privacy practices in accordance with the HIPAA Privacy Rules, the terms contained in the Notice of Privacy Practices may change also. A summary of the Notice of Privacy Practices will be posted __(stipulate where)__  indicating the effective date of our current Notice of Privacy Practices in the upper right hand corner. We will offer you a copy of the Notice of Privacy Practices on your first visit to us after the effective date of the current Notice of Privacy Practices. You will be given a copy of the Notice of Privacy Practices at your request.

As more fully explained in the Notice of Privacy Practices, you may have the right to request restrictions on how we use and disclose your protected health information for treatment, payment, and health care operations. We are not required to agree to your request.  If we agree, we are required to comply with your request unless the information is needed to provide emergency treatment to you.
Other practitioners who provide coverage for this practice are required to use and disclose your protected health information consistent with the Notice of Privacy Practices .

 

Please verify that you have received a copy of our Notice of Privacy Practices by signing your initials here______.

 

I understand that I have the right to revoke this CONSENT provided that I do so in writing, except to the extent that [ professional/practice group] has already used or disclosed the information in reliance on this CONSENT.

 

Signature of Client__________________________________________Date_______________________________ Signature of Legal Guardian or Representative_____________________________________________Date_________________________________

Please indicate the nature of your relationship to the client_______________________________________

 

For general guidelines for the construction of consents, we refer you to the list of criteria that HIPAA had previously required (Elements of a valid consent under HIPAA as of 12-2000 but no longer required as of 8-2002)

            1.  “Must be written in plain language”.

1.     Must state purpose of the “use” or “disclosure”: Treatment, payment, and/or healthcare

operations.

3.     Must a) refer the client to a separate privacy practices notice, b) state that the client’s “right” to review” the privacy practices notice before signing the consent,  c) indicate the privacy practices may change if the CE has reserved that right in their privacy notice, and d) “describe how” to “obtain a revised notice” of the privacy practices.

4.     Must include 1) a “right to request restrictions” on a CE’s privacy practices and state both 2)  that  the CE “is not required to agree” but  3) if the CE agrees the “restriction is binding”.

            5.   Must have signature and date (electronic signature will suffice).

6.     Must be visually and/or organizationally separate from other consents or authorizations (exception for research combined with Treatment).

7.     Must state it is revocable in writing at any time “except to the extent that the covered entity has taken action in reliance thereof”.

8.     Leaving out one these elements invalidates the consent

 

Other possible variations in the language for sample consents:

This form will authorize the release of information from my confidential treatment record to my health insurance carrier or its agents for the purpose of submitting billings for health insurance benefits, or reimbursements, or other similar decisions pertaining to my insurance coverage.

I understand that, by law, I need not consent to the release of this information. This information is not required for my treatment. However, I choose to do so willingly for the purposes specified above. I understand that I may revoke this Consent in writing at any time, except to the extent that action has been taken in reliance on my consent. Further, I understand that copies of all billings, reports or similar documents released to my insurance company or its agent shall also be available to me.

 

            As more fully explained in our/my Notice of Privacy Practices, you may have the right to request restrictions on how we use and disclose your protected health information for treatment, payment, and health care operations.  We are not required to agree to your request, but if we do agree, we are required to comply with your request unless the information is needed to provide emergency treatment to you.

 

Additional Optional Elements:

Consents may also include an informed consent to receive treatment, assign benefits, and cite state laws requiring sharing of info, e.g., about HIV. This list below is offered as an example of a common format you may have seen if, e.g., you’ve ever had surgery:

1.     Statement of purpose, e.g.: “this info is provided for you to make an informed decision about…”

            2.  Whether this treatment is an elective or emergency procedure

3.  Alternatives            

4.  Risks

5.     Client’s acceptance:  “The details have been presented to me about...and I give permission...”

 

________________________________________________

 

 

Sample

CONSENT to Release Confidential Information for Insurance Purposes

 

Name:____________________________________________________________________  

 

Birth date: _______________________________  SS #:____________________________

 

I Consent to the release of information from my confidential treatment record for treatment, payment, and healthcare operations.  [See definitions below.]

 

I understand that, by law, I need not consent to the release of this information. This Consent for disclosure of information is not required for my treatment.  However, I choose to do so willingly for the purposes specified above. I understand that I may revoke this Consent, in writing, at any time, except to the extent that action has been taken in reliance on my consent.  Further, I understand that copies of all billings, reports or similar documents released to my insurance company or its agent shall also be available to me.

 

Please review the definitions below, and this practice’s Notice Of Privacy Practices for additional information about the uses and disclosures of information described in this Consent prior to signing this Consent.

 

 

Signature: _____________________________  Date: ______

       Client, or parent or legal guardian of client.

 

 

Definitions:

*Treatment includes activities performed by this practice in providing care to you, coordinating or managing your care with third parties, and consultations with and between other health care professionals. This consent includes treatment provided by any professional who covers this practice as an on-call professional.

**Payment includes uses and disclosures required for determining your eligibility for health plan coverage, billing and receiving payment for your health benefit claims, and health plan management activities which may include review of your services for clinical necessity, justification of charges, pre certification and preauthorization.

***Health Care Operations includes the administrative and business functions of this practice.

 

 

Changes in Privacy Practices:

Because we reserve the right to change our privacy practices in accordance with HIPAA Privacy Rules, the terms contained in the Notice of Privacy Practices may change also.  A summary of the Notice of Privacy Practices will be posted in each professional office of this practice indicating the effective date of our current Notice of Privacy Practices in the upper right hand corner. We will offer you a copy of the Notice of Privacy Practices on your first visit to us after the effective date of the current Notice of Privacy Practices. You will be given a copy of the Notice of Privacy Practices at your request.

As more fully explained in the Notice of Privacy Practices, you may have the right to request restrictions on how we use and disclose your protected health information for treatment, payment, and health care operations. We are not required to agree to your request.  If we agree, we are required to comply with your request unless the information is needed to provide emergency treatment to you. Other practitioners who may provide coverage for this practice are required to use and disclose your protected health information consistent with the Notice of Privacy Practices.

 

 

Please verify that you have received a copy of our Notice of Privacy Practices by signing your initials here: ______