More on Privacy Rule

A. The privacy rule under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) refers to both “consents” and “authorizations” with regard to releasing protected information. Although in common practice these terms are frequently used interchangeably, under the privacy rule they are distinct and separate concepts with clear definitions and requirements.

Patient “consents” permit the release of protected information for the purposes of treatment, payment, and health care operations only. “Treatment, payment, or health care operations” include the following activities:

• Payment

• Utilization review

• Peer review

• Quality assurance

• Continuity of care (disclosures to “providers,” health care facilities, and others for treatment purposes)

Physicians are allowed to refuse services/treatment, except in emergency situations, if a patient refuses to sign a consent form for the physician to use and disclose protected health information for treatment, payment, or health care operations.

Consents must be in writing, and a patient has the right to revoke an existing consent in writing.

The privacy rule authorizes the release of information for treatment, payment, or health care operations without consents only in limited situations, as specified in the privacy rule.

Patient “authorizations” are required for all other disclosures; in other words, for all disclosures made for purposes other than treatment, payment, or health care operations. For example, an authorization is needed when a patient requests records to be released to his or her attorney. Unlike consents, physicians cannot condition services/treatment on the receipt of an authorization form from the patient. Patient authorizations must be in writing and in specific terms. Patients can revoke authorizations in writing.

The privacy rule also requires that physicians obtain patient authorization, with additional, specified elements when patient information is to be used for the physician’s own uses and disclosures. For example, additional elements (such as any remuneration that the provider will receive) must be included in an authorization prior to the provider’s disclosing protected health information to a pharmaceutical company.

Protecting confidential patient information is familiar territory for psychiatrists. Liability for releasing certain kinds of information without proper authorization or consent (that is, breaching confidentiality) already exists under state and federal laws. Ideally, psychiatrists should already be requiring patients to authorize, or consent to, the release of confidential information for all purposes, including for treatment and payment.

However, under the privacy rule, psychiatrists will be required to use specific documents designated as “consents” and “authorizations.” Fortunately, the rule explicitly lists the necessary elements for both consent and authorization forms. Furthermore, the Department of Health and Human Services has indicated that it will provide additional guidance on drafting consent and authorization forms in the future.

There are several resources available from the Psychiatrists’ Program for APA members to learn more about HIPAA and specifically how the privacy rule affects psychiatrists.

More information on the seminars is available by calling Cynthia Smith at (800) 245-3333, ext. 347, or visiting www.prms.com on the Web. More information on joining the Psychiatrists’ Program, the APA-endorsed Professional Liability Insurance Program, is available by calling PRMS at (800) 245-3333, ext. 389, or visiting its Web site at www.apa-plip.com. ▪