Focus on Forms

American Medical Association

Jacqueline M. Darrah, M.A., J.D.

Mary Kuffner, J.D.

Preemption

• HIPAA “trumps” if state law is “contrary”

• State law “trumps” if it is “more stringent”

• Generally, state law “wins” if more restrictive or gives patients additional rights

Forms Are “More Stringent”

• With respect to form or substance

• Narrow the scope or duration

• Increase the privacy protections afforded

• Reduce coercive effect

Recordkeeping Is “More Stringent”

• Retention or reporting of more detailed information

• Retention or reporting for a longer duration

General Standard

• With respect to any other matter

• Provides greater privacy protection for the individual

Other Exceptions to HIPAA Preemption

• Determination by the Secretary of HHS in specific categories

• State law provides for reporting and public health activities

• State law requires health plan reporting, auditing, licensing

Use of the Consent Form

• Required for health care providers

• May condition treatment on provision of consent

• May not be combined with Notice of Privacy Practices

• May be combined with other types of legal permission

Use of the Consent Form

• Before uses or disclosures of protected health information for treatment, payment and/or health care operations

• Exceptions:– Emergency

– Indirect treatment relationship

– Inmates

– Required by law

– Communication barriers

Use of the Consent Form

• Documented policies and procedures

• Retain copy for six years

• Effective only for the covered entity that obtained the consent except for joint consent

Use of the Consent Form

• Defective consents:– Lacks a required element– Revoked

• Conflicting legal permission– Disclose in accordance with more restrictive

consent or authorization– May resolve conflicts

Consent Form

• Plain language

• Informs the patient that protected health information may be used or disclosed for treatment, payment and health care operations

• Refers to the Notice of Privacy Practices

Consent Form

• Patient rights– Review the Notice of Privacy Practices before

signing– To request restrictions– To revoke consent

• Signed and dated

• Reserve right to change Notice of Privacy Practices

Use of Authorization Forms

• When consent or another exception does not apply

• Type of authorizations form depends on purpose:– Use or disclosure of PHI by your practice– Disclosure of PHI by another practice or entity to

your practice– Use or disclosure of PHI for research that

includes treatment

Use of Authorization Forms

• May not condition treatment, payment or enrollment on provision of authorization except:– Research that includes treatment

– Purpose of treatment is to create information for others

– To determine payment of claims (not psych. notes)

– Eligibility/enrollment determinations (not psych. notes)

– Underwriting/risk rating (not psych. notes)

Use of Authorization Forms

• May not combine authorizations except:– May combine authorizations for use or

disclosure of psychotherapy notes only with similar authorization

– May combine other authorizations (not psychotherapy notes) unless one conditions treatment on an authorization for research

Use of Authorization Forms

– May combine authorization for research that includes treatment with:

• Consent to participate in the research,

• Consent to use or disclose PHI for related treatment, payment and health care operations,

• Notice of Privacy practices

Use of Authorization Forms

• Documented policies and procedures

• Retain copy for six years

• Effective only for the covered entity that obtained the authorization

Authorization Forms

• All forms must include the following:– Name of authorized persons or practices – Description of information – Expiration date or event– Patient’s right to revoke, exceptions, and

procedure– Statement about potential for redisclosure– Signed and dated– Authority of personal representative (if applies)

Authorization Forms

• Must be valid

• Defective authorizations:– Expiration date or event has passed

– Form is not filled out completely

– The practice knows the patient has revoked

– Lacks a required element

– Is inappropriately combined with another consent or authorization

– Contains any material information known by the practice to be false

Authorization Form A

• For use or disclosure, or both

• Description of each purpose

• Informs patient of rights:– to inspect or copy the information to be used or

disclosed– to refuse to sign– whether the information will result in

remuneration to the physician from a third party

Authorization Form A (Cont.)

• Statement that the practice will not condition treatment, payment, enrollment or eligibility of benefits (if applies) on the provision of the authorization [unless an exception applies]

• The patient must receive a copy of the form

Authorization Form B

• For disclosure of PHI from another covered entity to the practice to carry out treatment, payment or health care operations

• Description of each purpose

• Informs patient of right to refuse to sign

Authorization Form B (Cont.)

• Statement that the practice will not condition treatment, payment, enrollment or eligibility of benefits (if applies) on the provision of the authorization [unless an exception applies]

• The patient must receive a copy of the form

Authorization Form C

• For uses/disclosures of PHI created for research that includes treatment (unless otherwise permitted under Privacy Rule)

• Description of each purpose, and:– How PHI will be used or disclosed for treatment,

payment or operations– Any PHI that will not be used as permitted under

the Privacy Rule

Authorization Form C (Cont.)

• Informs patient of rights:– to inspect or copy the information to be used or

disclosed– to refuse to sign– whether the information will result in

remuneration to the physician from a third party

• Refers to consent or Notice of Privacy Practices (if not combined with authorization)

Authorization Form C (Cont.)

• Statement that the practice will not condition treatment, payment, enrollment or eligibility of benefits (if applies) on the provision of the authorization [optional]

• The patient must receive a copy of the form

Notice of Privacy Practices (“NPP”)

• Right to adequate notice

• Uses and disclosures of PHI

• Individual’s rights

• Covered Entity’s legal duties

Use of NPP

• Direct treatment relationship

• Available on request

• No later than the date of first service delivery

Use of NPP

• Available at office for patient to take with them

• Post in reasonable location in office

• Make revised notices readily available

Use of NPP

• If maintain web site with information about services

• Display notice on the website prominently

• Make available on the website

Use of NPP

• NPP may be provided by e-mail

• If the individual has agreed receive by e-mail and has not withdrawn

• If e-mail fails, paper copy must be provided

Use of NPP

• E-mail NPP must be delivered within same timeframe as paper

• If service is electronic, then must deliver NPP automatically and contemporaneously with first request for service

• Recipient may still receive paper copy of NPP

Content of NPP

• Plain language

• Specific header

• Uses and disclosures

• Separate statements - appointments and fundraising

Content of NPP

• Individual’s rights

• Covered Entities’ duties

• Reserve right to change NPP

Content of NPP

• Complaint Process

• Identify Privacy Contact

• Effective Date

Content of NPP

• Optional elements - limited uses and disclosures

• Revisions to the NPP if material change in privacy practices

• Do not implement change until NPP is revised (unless required by law)

Joint Notice

• Participation in Organized Health Care Arrangement

• Previously discussed requirements apply

• Entities included, delivery sites, and statement about TPO

• Joint notice is effective for all

Documentation Requirements

• Maintain policies and procedures

• Maintain paper or electronic copy

• Maintain for 6 years