Clients' Written Consent - Is That HIPAA Form Sufficient?

Chances are, your facility has received some sort of subpoena along with a partially completed Authorization or "HIPPA" form signed by a client or former client of your facility.

If you submitted any client records in response to those boilerplate documents, you may have violated Federal Law and exposed your facility and staff to criminal fines ranging from $500 to $5,000. See 42 C.F.R. § 2.4.

The Drug Abuse Prevention, Treatment and Rehabilitation Act protects the confidentiality of alcohol and substance abuse treatment records by prohibiting the disclosure of a client's identity, assessment, diagnosis, treatment and other recorded information generated and maintained by treatment facilities. See 42 U.S.C. § 290dd-2; 42 CFR § 2.16.

In a nutshell, this law provides that any disclosure of confidential records can only be made under specifically detailed circumstances. These circumstances (exceptions) include a client's written Consent and circumstances involving internal communications of a treatment program, information that doesn't identify a client, medical emergencies, properly authorized court orders, information of criminal activity occurring on the premises of the program or against staff members, suspicion of child abuse/neglect, qualified service organization agreements, research, audits and military/veteran records.

An authorization or HIPAA Form signed by a client is intended to represent the CONSENT exception. However, upon close examination, very few actually meet the confidentiality restrictions placed on alcohol and substance abuse treatment facilities.

Unfortunately, many facilities commonly mistake the Health Insurance Portability and Accountability Act (HIPAA Law) with the Drug Abuse Prevention, Treatment and Rehabilitation Act! See 45 CFR § 164.512(e)(1)(ii); 45 CFR § 164.508. While similar, these two laws are not the same.

The bottom line here rests on the specific contents of the client's written consent. The reason a boilerplate authorization or HIPAA form may not be sufficient to meet the confidentiality restrictions placed on alcohol and substance abuse facilities is based on the following facts:

improper identification of treatment facility,

improper name of agency seeking the information,

improper identification of the client,

insufficient purpose for disclosure,

failure to state how much and what specific information is to be disclosed,

questionable signature of client,

missing date the written consent was signed,

failure to state that client can revoke consent at any time,

no indication of the date or event upon which the consent will expire,

no statement indicating that client's information cannot be redisclosed,

no indication whether the facility can or cannot condition treatment based on whether the client signs the consent,

failure to state that the client has received a copy of the signed written consent, and

no indication that the facility will maintain a copy of the signed written consent for the required time period.

While this is indeed an exhaustive list, it sufficiently covers the requirements of a client's written consent. Next time a subpoena for client records is submitted with an authorization or HIPAA form, be sure to give it a careful read.