ERK4499 - SECTION 13: THE HIPAA COMPLIANT RELEASE OF INFORMATION
Section 13: The HIPAA Compliant Release of Information
By far, the most common way in which mental health clinicians are going to come into contact with problems with HIPAA concerns the way that information is going to be released with the client’s consent in the course of treatment. Accordingly, one would think that most mental health clinicians would therefore have a clear idea of what constitutes a HIPAA compliant release of information form. Below is an example of such a release form, with discussion to follow:
Pat R. Clinician, LCSW
220 Therapy Lane Somewhere, GA 30000
404-555-7777
AUTHORIZATION FOR RELEASE OF INFORMATION
Pat R. Clinician, LCSW is hereby granted permission to release ___ exchange ___ information to/with:
Name of person, agency: _______________________________________
Address:_________________________________________________________
Purpose or need for disclosure:
__________________________________________________________________________________________________________________________________________________________________________________
Specific information to be disclosed:
__________________________________________________________________________________________________________________________________________________________________________________
This consent may be revoked by the person giving authorization at any time by signing and dating the revocation statement below, or by giving notification by phone or written statement of your wish to revoke consent. This does not apply to any action that has already been taken in reliance hereon. If not revoked earlier, this consent shall terminate one year from the date signed below.
Notice to Recipient of Disclosed Information:
This information has been disclosed to you from records whose confidentiality is protected by Federal Law. Federal regulation prohibits you from making any further disclosure of this information unless further disclosure is expressly permitted by the written consent of the person to whom it pertains or as otherwise permitted under Federal Law.
__________________________ ____________________________________
(Print/type full name of client) (Signature of client or person authorized to sign)
_____________ _____________________________
(Date signed) (Relationship of signee to client)
__________________________ ___________________________
(Print or type name of witness) (Signature of witness)
__________________________ __________________________
Signature if consent is revoked Date consent revoked
Let us look at the eight core elements contained in this release of information and their importance for HIPAA compliance. First, the release of information form must contain a clear definition of the scope of the information that is going to be released. It is not appropriate to enter into this part of the release of information: “all information necessary to . . .”. The release must be specific in defining what is going to be released: “Assessment results, diagnosis, treatment plan, prognosis,” or other clearly defined elements of the treatment record. Once the information has been designated and agreed to by the client through his/her signature, this is the only information that can be released.
Second, the form must designate a party to whom the information may go. This must be a specific name: “Mary Doe, director of Residential Services, Bonehead Institute, Razmatazz, OK”. Third, the release form must state the purpose for the disclosure: “To coordinate care with client’s primary care physician.”
Fourth, the form must inform the client of their right to revoke the release of information at any time, and inform the client of the mechanism by which that revocation may occur. Fifth, there must be a place on the form for the client to sign in order to revoke the release of information, with as well as a space to record a date of that revocation. Sixth, the form must contain a default expiration date or expiration event: “If not revoked earlier, this consent shall terminate one year from the date signed below.” The date or event must be specific in nature. Seventh, the form must have the client’s signature and date of that signature present on the release. If a client’s parent or guardian is the signatory, the form must state the precise nature of the relationship that allows that person to sign as the Personal Representative for the client.
Eighth, the form must have specific directions concerning the re-release of information: “This information has been disclosed to you from records whose confidentiality is protected by Federal Law. Federal regulation prohibits you from making any further disclosure of this information unless further disclosure is expressly permitted by the written consent of the person to whom it pertains or as otherwise permitted under Federal Law.” This notification of re-disclosure guidelines serves a dual purpose: it clarifies to the client what his/her rights are with regard to the re-release of confidential information and clarifies to the party receiving the disclosed information that the information is covered under Federal Law.
If the release of information does not have all of these elements – or any of the noted items are not filled in properly - it is not considered a valid release of information. Additionally, a release of information may be invalid if the expiration date of the release has passed, the release has been revoked by the client or the client’s Personal Representative, the release contains information that the clinician knows to be false, there are conditions placed into the release that violate HIPAA guidelines or the release combines two or more releases within a single form. Without that valid release of information, the clinician who releases information is committing a HIPAA violation.
In addition to having the release of information properly composed and filled out, the clinician also has an obligation to provide a copy of the release of information to the client for his/her records.