Q. What is the difference between a "consent" and an "authorization" under the HIPAA’s privacy rule?

A. The privacy rule under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) refers to both "consents" and "authorizations" with regard to releasing protected information. Although in common practice these terms are frequently used interchangeably, under the privacy rule they are distinct and separate concepts with clear definitions and requirements.

Patient "consents" permit the release of protected information for the purposes of treatment, payment, and health care operations only. "Treatment, payment, or health care operations" include the following activities:

• Payment

• Utilization review

• Peer review

• Quality assurance

• Continuity of care (disclosures to "providers," health care facilities, and others for treatment purposes)

Physicians are allowed to refuse services/treatment, except in emergency situations, if a patient refuses to sign a consent form for the physician to use and disclose protected health information for treatment, payment, or health care operations.

Consents must be in writing, and a patient has the right to revoke an existing consent in writing.

The privacy rule authorizes the release of information for treatment, payment, or health care operations without consents only in limited situations, as specified in the privacy rule.

Patient "authorizations" are required for all other disclosures; in other words, for all disclosures made for purposes other than treatment, payment, or health care operations. For example, an authorization is needed when a patient requests records to be released to his or her attorney. Unlike consents, physicians cannot condition services/treatment on the receipt of an authorization form from the patient. Patient authorizations must be in writing and in specific terms. Patients can revoke authorizations in writing.

The privacy rule also requires that physicians obtain patient authorization, with additional, specified elements when patient information is to be used for the physician’s own uses and disclosures. For example, additional elements (such as any remuneration that the provider will receive) must be included in an authorization prior to the provider’s disclosing protected health information to a pharmaceutical company.

Protecting confidential patient information is familiar territory for psychiatrists. Liability for releasing certain kinds of information without proper authorization or consent (that is, breaching confidentiality) already exists under state and federal laws. Ideally, psychiatrists should already be requiring patients to authorize, or consent to, the release of confidential information for all purposes, including for treatment and payment.

However, under the privacy rule, psychiatrists will be required to use specific documents designated as "consents" and "authorizations." Fortunately, the rule explicitly lists the necessary elements for both consent and authorization forms. Furthermore, the Department of Health and Human Services has indicated that it will provide additional guidance on drafting consent and authorization forms in the future.

There are several resources available from the Psychiatrists’ Program for APA members to learn more about HIPAA and specifically how the privacy rule affects psychiatrists.

• "HIPAA Help" provides HIPAA facts and figures such as a comprehensive HIPAA diagram and a listing of important HIPAA-related resources. Also available is a copy of "How to Handle HIPAA Hype," reprinted from APA’s Psychiatric Practice and Managed Care (volume 7, number 2).

• "HIPAA in the News" gives advisories and updates.

• "HIPAA—You Asked For It" is a 15-minute presentation explaining the major events that culminated in the creation of HIPAA’s privacy rule. It was written by PRMS Risk Management Consultant Donna Vanderpool, J.D., M.B.A. (This document is available at the Online Education Center for program participants only.)

• "An Overview of HIPAA’s Privacy Rule," also written by Vanderpool, is a 36-minute presentation explaining the basic requirements of the privacy rule. It also offers downloadable handouts and a checklist to assist you in complying with the privacy rule. (This program is available at the Online Education Center for program participants only.)

Professional Risk Management Services will present a series of one-day seminars titled "What Mental Health Professionals Need to Know About HIPAA’s Privacy Rule." The seminar will include information on special protections for psychotherapy notes, the new federal patient rights, disclosure of patient information pursuant to the privacy rule, and compliance requirements. The seminars are scheduled as follows:

• March 22: The Conference Center at Sheppard Pratt, Baltimore/Towson, Md.

• April 26: Batterymarch Conference Center, Boston

• June 28: JPMorgan Chase Conference Center, New York City

This column is provided as a service to the membership by the Psychiatrists’ Purchasing Group Inc., operator of the APA-endorsed Professional Liability Program. Send your questions to Pnews@psych.org.

More information on the seminars is available by calling Cynthia Smith at (800) 245-3333, ext. 347, or visiting www.prms.com on the Web. More information on joining the Psychiatrists’ Program, the APA-endorsed Professional Liability Insurance Program, is available by calling PRMS at (800) 245-3333, ext. 389, or visiting its Web site at www.apa-plip.com. ▪