Distinguishing Consent to Treat from Notice of HIPAA Privacy Policy

The November 2003 and January 2004 issues of EMS Magazine contained related articles by Denise Graham, titled Strategic Documentation: A Key for Survival in the HIPAA Era and When They Just Say No: Documenting Patient Refusals in the Era of HIPAA, respectively. The basic concept of these articles-that good documentation helps show that what you did was appropriate, correct and required-is a sound principle and always good advice. This may especially be true in cases of "informed consent" for treatment, when such is required. However, for purposes of HIPAA, it may not be necessary. The articles by Ms. Graham were based on the Department of Health and Human Services' (HHS) publications of the final HIPAA Privacy Rule, but the subsequent HHS modifications, technical corrections and additional clarifications of the Final Rule made significant additional revisions, including removal of the actual consent requirement for the disclosure of health information. Therefore, we offer below an updated view of what HIPAA does and does not require.

What Does the Rule Require?

Originally, consent was the key requirement of the Privacy Rule. Covered healthcare providers were required to get a patient's written consent before using or disclosing protected health information (PHI) for purposes of treatment, payment or healthcare operations (TPO). Basically, for most uses and disclosures, you were required to have written consent. Remember, this applied to oral communications as well. However, under the revisions, consent is optional. Therefore, there is currently no mandate to get a patient's consent prior to disclosing his or her health information for TPO purposes.

The Notice requirement has now been revised as well. Notice now has to be accompanied by a signed acknowledgment that the patient has received the Privacy Policy Notice. There has been no major change in the amount of paperwork you are required to do, but instead of being required to get a patient's signed consent to disclose his PHI for TPO purposes, you now have to get the patient's signed acknowledgment that he or she understands that you will disclose his/her PHI for purposes of TPO, whether the patient consents to it or not.

There is an emergency exception to this requirement. You may disclose PHI for TPO purposes without written consent or a signed acknowledgment of the Notice in the case of an emergency, as defined by you using your own "professional judgment," when you are required by law to treat the individual or when there are substantial barriers to communication. In the Department of Health and Human Services' HIPAA Standards Q&A issued for the original rule, they put it this way:

"Healthcare providers must exercise their professional judgment to determine whether obtaining a written consent (or now a signed notice) would interfere with the timely delivery of necessary healthcare. If, based on professional judgment, a provider reasonably believes at the time the patient presents for treatment that a delay involved in obtaining the patient's written consent of use or disclosure of information would compromise the patient's care, the provider may use or disclose PHI that was obtained during the emergency treatment, without prior consent, to carry out TPO. The provider must attempt to obtain written consent as soon as reasonably practicable after the provision of treatment. If the provider is able to obtain the patient's consent regarding use or disclosure of information before providing care, without compromising the patient's care, we require the provider to do so."

While this Q&A was written prior to the removal of the consent requirement, the revisions make it clear that you should not seek to get the Notice of Privacy Policy acknowledgment signed if a patient is in a state of excitement. The idea is to give them notice of their rights and what their health information is to be used for, and if they are too excited or upset, they may not be able to understand these things and therefore actually receive this notice in a meaningful manner. For that reason, the tips in Ms. Graham's articles on documentation are useful to follow.