Source: https://www.natlawreview.com/article/hipaa-should-you-ask-patients-consent-to-disclose-information
Timestamp: 2019-04-18 21:10:15+00:00

Document:
HIPAA: Should You Ask Patients for Consent to Disclose Information?
Tell the patient that the provider will only disclose the patient’s information to those persons identified by the patient, thereby precluding disclosures to others who are not identified.
Ask the patient to list those to whom the provider may disclose information, thereby expressly or impliedly suggesting that they will not disclose information to others.
Ask that the patient authorize disclosures to payers and/or other providers, thereby expressly or impliedly agreeing that they will not disclose information to payers or providers if not authorized by the patient.
They do so under the mistaken belief that HIPAA requires such. In reality, such practices may actually increase potential HIPAA liability.
Lists of Persons To Whom Disclosures May Be Made. Similarly, upon registration, many providers ask the patient to identify those persons to whom the provider may disclose the patient’s information, e.g., family members, other providers, etc. By doing so, the provider may expressly or impliedly represent that it will not disclose information to persons and entities who are not identified. Again, the patient’s list likely will not include many entities to whom the provider routinely discloses information for purposes of treatment, payment or healthcare operations, including payers, other providers, or business associates—entities to whom disclosures may be made without the patient’s consent but for the contrary representation or agreement of the provider. (45 CFR § 164.506).
Asking the patient for such a list is generally unnecessary under HIPAA. HIPAA already allows healthcare providers to disclose information to family members and others involved in the patient’s care or payment for care without written permission so long as (1) the patient was given the opportunity to object to such disclosures and the patient did not object, or the provider reasonably infers from the circumstances that the individual does not object to such disclosures, (2) the information disclosed is limited to that which is directly relevant to such person’s involvement with the patient’s healthcare or payment, and (3) disclosure is reasonable under the circumstances. (See 45 CFR § 164.510(b)). A well-crafted notice of privacy practices informs the patient that the provider may disclose information to family members or others involved in the patient’s care unless the patient objects. (See 45 CFR § 164.520(b)(ii)). Arguably, such notice provides the patient with the opportunity to object so as to satisfy § 164.510(b), thereby allowing disclosures to family members and others involved in the patient’s care or payment for care so long as the patient does not object and it is reasonable under the circumstances. Accordingly, asking a patient for a specific list of persons to whom disclosure may be made is unnecessary, may invite objections that would not otherwise be made, and limit otherwise permissible disclosures, thereby increasing HIPAA risks.
Asking the patient to identify persons to whom disclosures may be made is not necessarily a bad practice so long as the provider makes it clear that the list is not exclusive, i.e., the provider expressly reserves the right to disclose information to others who may not be on the list if and to the extent allowed by HIPAA, including but not limited to disclosures for treatment, payment or healthcare operations. By doing so, the provider may avoid the situation in which the patient, rightly or wrongly, assumes that the list of permissible disclosures is exclusive. However, asking for such a list still invites the patient to object to disclosures to family members or others who are not on the list, thereby restricting permissible disclosures. Consequently, if the provider is going to obtain such a list, it should train its personnel to regularly review the list to ensure that they do not disclose information to family members or friends who are not on the list. From a HIPAA perspective, it is likely safer to avoid creating the list altogether.
Consent to Disclose in Registration Forms. Providers usually include on their patient registration forms a section in which the patient consents to disclosures to payers and/or other providers. Again, such a consent is unnecessary because HIPAA already allows such disclosures without the patient’s consent for purposes of treatment or payment.2 (45 CFR § 164.506). By asking for the patient’s consent, the provider may expressly or impliedly represent that such disclosures will not be made unless the patient consents. What happens if the patient fails or refuses to sign the consent? Or the statement may suggest that other disclosures require consent. Again, to resolve any doubt and minimize liability, providers should consider removing such unnecessary consents.
Beware Your Notice of Privacy Practices. Providers should also ensure that their notice of privacy practices does not restrict their right to make otherwise permissible uses or disclosures of information. HIPAA requires providers to create and give to patients a notice of privacy practices explaining the provider’s permissible uses and disclosures of patient information. (45 CFR § 164.520). Among other things, the notice must describe the uses and disclosures that the provider may make without that patient’s authorization. (Id. at § 164.520(b)(ii)). The notice must include “a statement that other uses and disclosures not described in the notice will be made only with the individual’s written authorization…” (Id. at § 164.520(b)(ii)(E)). Although not required, the provider may choose to make its privacy practices more restrictive than HIPAA; however, if it does so, it must comply with its more restrictive practices as stated in the notice. (Id. at § 164.520(b)(viii)). The notice must contain a statement that the provider “is required to abide by the terms of [its] notice….” (Id. at § 164.520(b)(ii)(E) and (v)(B)). Thus, the notice functions like a contract between the provider and the patient: the provider’s failure to abide by its terms may subject the provider to HIPAA penalties. If they have not done so recently, providers should review their notice of privacy practices to ensure that (1) the notice adequately identifies the situations in which disclosures may be made without the patient’s consent or written authorization (presumably all of those situations identified in 45 CFR §§ 164.506, -.510, and -.512), and (2) the notice does not impose greater limitations than required by HIPAA or other applicable law.
Beware Business Associate Agreements. Agreeing to unnecessary restrictions also affects business associate agreements (“BAA”) because the business associate may not use or disclose protected health information in a manner that would violate HIPAA if done by the provider. (45 CFR §§164.502(a)(3) and 164.504(e)(2)(ii)). Any restriction that the provider agrees to or undertakes must be passed through to the business associate. That creates logistical problems in communicating with and getting the business associate to implement such restrictions, especially if it would cause the business associate to change its normal operations. BAAs often require the provider to disclose such restrictions to the business associate, and may obligate the provider to forego such restrictions to the extent they adversely affect the business associate. The net effect is that any restrictions undertaken by the provider also creates risks for and potential liability to the business associate.
Remember More Restrictive Laws. The foregoing analysis applies to HIPAA. To the extent that there is another law that is more restrictive than HIPAA, including state laws or regulations, the provider must comply with the more restrictive law. It may be that a particular state or other agency requires specific patient consent even though HIPAA does not. If that is the case, then the provider must comply with the more restrictive law.
Conclusion. For the foregoing reasons, voluntarily agreeing to restrictions that are not otherwise required by HIPAA increases the burden and potential liability of healthcare providers and business associates. Providers should review their forms, processes, and notice of privacy practices to ensure that they do not impose more restrictions than necessary or required by HIPAA.
1A limited exception exists for situations in which the patient pays for his own episode of care and requests that the provider not disclose information concerning that episode of care to the patient’s insurer for purposes of treatment. In such cases, the provider must comply with the patient’s request to limit disclosures for treatment purposes. (45 CFR § 164.522(a)(1)(vi)).
2An exception may exist for Medicare claims. It appears that Medicare regulations have not caught up with HIPAA, and may still technically require consent to disclose to Medicare for payment. Providers should confirm Medicare requirements applicable to their situation.

References: § 164
 § 164
 § 164
 § 164
 § 164
 § 164
 § 164
 § 164
 § 164
 § 164
 § 164