Consent vs. Authorization
RHIA candidates must clearly distinguish consent from authorization. Consent generally refers to a patient's general agreement to receive treatment and is not required under HIPAA for treatment, payment, or healthcare operations, though many organizations obtain it as a matter of practice. Authorization is a specific, detailed document required before PHI can be used or disclosed for purposes outside TPO, such as marketing, sale of PHI, or disclosure to a life insurance company.
Required Elements of a Valid Authorization
- A specific and meaningful description of the information to be disclosed.
- The name of the person or entity authorized to make the disclosure and the person or entity receiving it.
- A description of the purpose of the disclosure.
- An expiration date or event.
- The patient's signature and date.
- A statement of the patient's right to revoke the authorization in writing.
An authorization missing any required element is invalid and cannot be relied upon to support disclosure.
Specially Protected Information
Certain categories of health information carry heightened protection beyond standard HIPAA requirements. Substance use disorder treatment records maintained by federally assisted programs are protected under 42 CFR Part 2, which generally requires specific written consent for disclosure, even for treatment purposes in many circumstances, and prohibits redisclosure without additional consent. Similarly, many states impose extra protections for HIV status, mental health records, and genetic information, and state law governs when it is more stringent than HIPAA.
Minors and Personal Representatives
Consent and authorization questions often involve minors or incapacitated patients. Generally, a parent or guardian serves as the personal representative for a minor, but state law may grant minors the right to consent independently for certain services, such as reproductive health, mental health, or substance use treatment, which then limits parental access to those specific records.
Revocation of Authorization
A patient may revoke an authorization in writing at any time, except to the extent the covered entity has already acted in reliance on it. This is a commonly tested nuance: revocation is not retroactive.
Exam Tip
When a scenario involves substance use disorder treatment records, default to the more restrictive 42 CFR Part 2 requirements rather than standard HIPAA rules unless the question specifies otherwise.