§ 2.31 - Consent requirements.

§ 2.31 Consent requirements.

Cross Reference

Link to an amendment published at 89 FR 12625, Feb. 16, 2024.

(a) Required elements for written consent. A written consent to a use or disclosure under the regulations in this part may be paper or electronic and must include:

(1) The name of the patient.

(2) The specific name (s) or general designation(s) of the part 2 programor other specific identification of the person(s), entity(ies), or individual(s) permitted or class of persons, authorized to make the requested use or disclosure.

(3) How much and what kind of information is A description of the information to be disclosed, including an explicit description of the substance use disorder information that may be disclosedused or disclosed that identifies the information in a specific and meaningful fashion.

(4)

(i) General requirement for designating recipients. The name(s) of the individualperson(s), or the name(s) of the entity(-ies) class of persons, to which a disclosure is to be made (“recipient(s)”). For a single consent for all future uses and disclosures for treatment, payment, and health care operations, the recipient may be described as “my treating providers, health plans, third-party payers, and people helping to operate this program” or a similar statement.

(ii) Special instructions for entities that facilitate the exchange of health information and research institutionsintermediaries. Notwithstanding paragraph (a)(4)(i) of this section, if the recipient entity facilitates the exchange of health information or is a research institutionis an intermediary, a written consent must include the name(s) of the entityintermediary(-ies) and:

(A) The name(s) of individual or entity participant(s)the member participants of the intermediary; or

(B) A general designation of an individual or entity a participant(s) or class of participants that , which must be limited to a participant(s) who has a treating provider relationship with the patient whose information is being used or disclosed. When using a general designation, a statement must be included on the consent form that the patient (or other individual authorized to sign in lieu of the patient), confirms their understanding that, upon their request and consistent with this part, they must be provided a list of entities to which their information has been disclosed pursuant to the general designation (see § 2.13(d)).

(5) The purpose of the disclosure. In accordance with § 2.13(a), the disclosure must be limited to that information which is necessary to carry out the stated purpose.

(6) A statement that the consent is subject to revocation at any time

(iii) Special instructions when designating certain recipients. If the recipient is a covered entity or business associate to whom a record (or information contained in a record) is disclosed for purposes of treatment, payment, or health care operations, a written consent must include the statement that the patient's record (or information contained in the record) may be redisclosed in accordance with the permissions contained in the HIPAA regulations, except for uses and disclosures for civil, criminal, administrative, and legislative proceedings against the patient.

(5) A description of each purpose of the requested use or disclosure.

(i) The statement “at the request of the patient” is a sufficient description of the purpose when a patient initiates the consent and does not, or elects not to, provide a statement of the purpose.

(ii) The statement, “for treatment, payment, and health care operations” is a sufficient description of the purpose when a patient provides consent once for all such future uses or disclosures for those purposes.

(iii) If a part 2 program intends to use or disclose records to fundraise on its own behalf, a statement about the patient's right to elect not to receive any fundraising communications.

(6) The patient's right to revoke the consent in writing, except to the extent that the part 2 program or other lawful holder of patient identifying information that is permitted to make the disclosure has already acted in reliance on it. Acting in reliance includes the provision of treatment services in reliance on a valid consent to disclose information to a third-party payer

(7) The date, event, or condition upon which the consent will expire if not revoked before. This date, event, or condition must ensure that the consent will last no longer than reasonably necessary to serve the purpose for which it is provided

, and how the patient may revoke consent.

(7) An expiration date or an expiration event that relates to the individual patient or the purpose of the use or disclosure. The statement “end of the treatment,” “none,” or similar language is sufficient if the consent is for a use or disclosure for treatment, payment, or health care operations. The statement “end of the research study” or similar language is sufficient if the consent is for a use or disclosure for research, including for the creation and maintenance of a research database or research repository.

(8) The signature of the patient and, when required for a patient who is a minor, the signature of an individual a person authorized to give consent under § 2.14; or, when required for a patient who is incompetent or has been adjudicated as lacking the capacity to make their own health care decisions or is deceased, the signature of an individual a person authorized to sign under § 2.15. Electronic signatures are permitted to the extent that they are not prohibited by any applicable law.

(9) The date on which the consent is signed.

(10) A patient's written consent to use or disclose records for treatment, payment, or health care operations must include all of the following statements:

(i) The potential for the records used or disclosed pursuant to the consent to be subject to redisclosure by the recipient and no longer protected by this part.

(ii) The consequences to the patient of a refusal to sign the consent.

(b) Consent required: SUD counseling notes.

(1) Notwithstanding any provision of this subpart, a part 2 program must obtain consent for any use or disclosure of SUD counseling notes, except:

(i) To carry out the following treatment, payment, or health care operations:

(A) Use by the originator of the SUD counseling notes for treatment;

(B) Use or disclosure by the part 2 program for its own training programs in which students, trainees, or practitioners in SUD treatment or mental health learn under supervision to practice or improve their skills in group, joint, family, or individual SUD counseling; or

(C) Use or disclosure by the part 2 program to defend itself in a legal action or other proceeding brought by the patient;

(ii) A use or disclosure that is required by § 2.2(b) or permitted by § 2.15(b); § 2.53 with respect to the oversight of the originator of the SUD counseling notes; § 2.63(a); § 2.64.

(2) A written consent for a use or disclosure of SUD counseling notes may only be combined with another written consent for a use or disclosure of SUD counseling notes.

(3) A part 2 program may not condition the provision to a patient of treatment, payment, enrollment in a health plan, or eligibility for benefits on the provision of a written consent for a use or disclosure of SUD counseling notes.

(c) Expired, deficient, or false consent. A disclosure may not be made on the basis of a consent which:

(1) Has expired;

(2) On its face substantially fails to conform to any of the requirements set forth in paragraph (a) of this section;

(3) Is known to have been revoked; or

(4) Is known, or through reasonable diligence could be known, by the

individual or entity

person holding the records to be materially false.

(d) Consent for use and disclosure of records in civil, criminal, administrative, or legislative proceedings. Patient consent for use and disclosure of records (or testimony relaying information contained in a record) in a civil, criminal, administrative, or legislative investigation or proceeding cannot be combined with a consent to use and disclose a record for any other purpose.

[82 FR 6115, Jan. 18, 2017, as amended at 85 FR 43037, July 15, 2020; 89 FR 12625, Feb. 16, 2024]