Universal Patient Data Consent Form

MODEL STATE LEGISLATION

 

Patient consent requirements for release or disclosure of health records.

Subdivision 1. Release or disclosure of health records. Health records may only be disclosed as specified in this section.

Subdivision 2. Patient consent to release of records.
A provider, or a person who receives health records from a provider, may not release a patient's health records without:

(1) a signed and dated consent form as provided in this section from the patient or the patient's legally authorized representative authorizing the release;

(2) specific authorization in law; or

(3) a representation from a provider that holds a signed and dated consent form as provided in this section, from the patient authorizing the release.

Subdivision 3. Duration of consent.
A patient’s consent is valid for one year or for a period specified in the consent. A provider must provide the duration options listed in the “Universal Patient Data Consent Form” and must not condition treatment upon patient agreement to a specific duration of consent.

Subdivision 4. Required consent form for patient data disclosure.
A provider must use the following form to obtain patient consent to disclose, release, or use health care records as provided in this section:

Patient Data Consent Form.

Patient's Notice of Data Rights:

(a) Your treatment is not conditioned upon granting or refusing consent below for use, sharing, or release of health information.

(b) State law guarantees certain patient privacy and consent rights under [STATUTORY REFERENCE].

(c) You may revoke or modify your consent to share health records in writing at any time, except that a revocation or modification has no effect on any health records released prior to the date of revocation or modification.

Patient’s Medical Consent.
Please read the following carefully and check either “yes” or “no” to each item below.

....... Yes ....... No Obtaining Medical Records: I consent to [the above health care provider] communicating with my current and future health care providers to obtain any and all previous medical records necessary for my treatment as defined under the federal Health Insurance Portability and Accountability Act (HIPAA). See attached definition.

....... Yes ....... No Releasing Information for Treatment: I consent to [the above health care provider] sharing information from my medical record with current and future health care providers involved in my treatment as defined under HIPAA. See attached definition.

....... Yes ....... No Releasing Information for Payment: I consent to [the above health care provider] sharing my information for the purpose of billing and payment as defined under HIPAA. See attached definition. This sharing of information includes insurers or third parties responsible for payment of my medical bills.

....... Yes ....... No Releasing Information for Health Care Operations: I consent to
[the above health care provider] sharing my information for health care operations as defined under HIPAA. See attached definition. This includes information sharing for activities unrelated to treatment for my medical condition.

....... Yes ....... No Releasing Information for Medical or Scientific Research: I consent
to [the above health care provider] releasing my medical information for medical or scientific research.

....... Yes ....... No Disclosure of Presence: I authorize [the above health care provider] to disclose my presence to any person who inquires about me using my full name. This disclosure is limited to acknowledging my presence and a one-word description of my condition: critical, serious, fair, or good.

Health Information Exchange.
....... Yes ....... No Access: I authorize [the above health care provider] to use a health

information exchange (HIE), record locator service (RLS), patient information service (PIS), clinical data repository (CDR), or master patient index (MPI) for the purpose of accessing my patient identifying information and information about the location of my medical records. See attached definitions.

....... Yes ....... No Release: I authorize [the above health care provider] to release my patient identifying information and information about where my medical records are located to an HIE, RLS, PIS, CDR, or MPI. See attached definitions.

Consent Duration.

I understand that under state law, my consent to release my health records is limited by my determination below, unless specifically authorized in state law for a differing length of time.
For all other purposes described above, I authorize my consent to be valid for the following length of time:
....... One year
....... Three years
....... Indefinitely (unless I revoke or modify)

PATIENT SIGNATURE

Patient Name: .......................................... Date of Birth: ......./......./.......
If patient is not signing, name and relationship to patient: .......................................... Signature: .......................................... Date: ......./......./.......

Federal HIPAA Definitions (Code of Federal Regulations, title 45, section 164.501)

(a) “Health care operations” means any of the following activities of the covered entity to the extent that the activities are related to covered functions:

(1) conducting quality assessment and improvement activities, including
outcomes, evaluation, and development of clinical guidelines, provided that the obtaining
of generalizable knowledge is not the primary purpose of any studies resulting from
the activities; patient safety activities, as defined in Code of Federal Regulations, title 42, section 3.20; population-based activities relating to improving health or reducing health care costs, protocol development, case management and care coordination, contacting of health care providers and patients with information about treatment alternatives; and related functions that do not include treatment;
(2) reviewing the competence or qualifications of health care professionals, evaluating practitioner and provider performance, health plan performance, conducting training programs in which students, trainees, or practitioners in areas of health care learn under supervision to practice or improve their skills as health care providers, training of nonhealth care professionals, accreditation, certification, licensing, or credentialing activities;
(3) except as prohibited under Code of Federal Regulations, title 45,
section 164.502(a)(5)(i), underwriting, enrollment, premium rating, and other activities related to the creation, renewal, or replacement of a contract of health insurance or health benefits, and ceding, securing, or placing a contract for reinsurance of risk relating to claims for health care, including stop-loss insurance and excess of loss insurance, provided that
the requirements of Code of Federal Regulations, title 45, section 164.514(g), are met,
if applicable;
(4) conducting or arranging for medical review, legal services, and auditing
functions, including fraud and abuse detection and compliance programs;
(5) business planning and development, such as conducting cost-management and planning- related analyses related to managing and operating the entity, including
formulary development and administration, development, or improvement of methods of payment or coverage policies; and
(6) business management and general administrative activities of the entity, including, but not limited to:

(i) management activities relating to implementation of and compliance with
the requirements of this subchapter;
(ii) customer service, including the provision of data analyses for policyholders, plan sponsors, or other customers, provided that protected health information is not disclosed to the policyholder, plan sponsor, or customer;

(iii) resolution of internal grievances;
(iv) the sale, transfer, merger, or consolidation of all or part of the covered entity with another covered entity, or an entity that following the activity will become a covered entity and due diligence related to the activity; and
(v) consistent with the applicable requirements of Code of Federal Regulations, title 45, section 164.514, creating de-identified health information or a limited data set, and fund-raising for the benefit of the covered entity.

(b) “Payment” means:
(1) the activities undertaken by:

(i) a health plan to obtain premiums or to determine or fulfill its responsibility for coverage and provision of benefits under the health plan, except as prohibited under Code of Federal Regulations, title 45, section 164.502(a)(5)(i); or (ii) a health care provider or health plan to obtain or provide reimbursement for

the provision of health care; and
(2) the activities in clause (1) relate to the individual to whom health care is provided and include, but are not limited to:

(i) determinations of eligibility or coverage (including coordination of benefits or the determination of cost-sharing amounts), and adjudication or subrogation of health benefit claims;
(ii) risk-adjusting amounts due based on enrollee health status and demographic characteristics;

(iii) billing, claims management, collection activities, obtaining payment under a
contract for reinsurance (including stop-loss insurance and excess of loss insurance), and related health care data processing;
(iv) review of health care services with respect to medical necessity, coverage under a health plan, appropriateness of care, or justification of charges;
(v) utilization review activities, including precertification and preauthorization of services, concurrent and retrospective review of services; and
(vi) disclosure to consumer reporting agencies of any of the following protected health information relating to collection of premiums or reimbursement:

(A) Name and address;
(B) Date of birth;
(C) Social Security number;
(D) Payment history;
(E) Account number; and
(F) Name and address of the health care provider or health plan.

(c) “Treatment” means the provision, coordination, or management of health care and related services by one or more health care providers, including the coordination or management of health care by a health care provider with a third party; consultation between health care providers relating to a patient; or the referral of a patient for health care from one health care provider to another.

[STATE] Definitions ([STATUTORY REFERENCE]).

(a) “Clinical data repository” means a real time database that consolidates data from a variety of clinical sources to present a unified view of a single patient and is used by a state-certified health information exchange service provider to enable health information exchange among health care providers that are not related health care entities as defined in [STATUTORY REFERENCE]. This does not include clinical data that are submitted for public health purposes required or permitted by law, including any rules adopted by the commissioner.

(b) “Health care provider” means a person, hospital, or health care facility, organization, or corporation that is licensed, certified, or otherwise authorized by the laws of this state to provide health care.

(c) “Health information exchange” means a legal arrangement between health care providers and group purchasers to enable and oversee the business and legal issues involved in the electronic exchange of health records between the entities for the delivery of patient care.

(d) “Master patient index” means an electronic database that holds unique identifiers of patients registered at a care facility and is used by a state-certified health information exchange service provider to enable health information exchange among health care providers that are not related health care entities as defined in [STATUTORY REFERENCE]. This does not include data that are submitted for public health purposes required or permitted by law, including any rules adopted by a state public health entity.

(e) “Patient information service” means a service providing the following query options: a record locator service or a master patient index or clinical repository.

(f) “Record locator service” means an electronic index of patient-identifying information that directs providers in a health information exchange to the location of patient health records held by providers and group purchasers.

Subd. 2. Failure to check “Yes” or “No.” A failure to check “Yes” or “No” on a form prepared pursuant to this section is presumed to be a “No” and a provider must not disclose or release any health record under the relevant paragraph.

Subd. 3. Exceptions. (a) This section does not apply to a release of or a request for psychotherapy notes as defined under Code of Federal Regulations, title 45, section 164.501,
as amended. Pursuant to federal law, providers must use a separate consent form. (b) Patient records may not be shared with an insurance company if the patient pays out-of-pocket in full and requests nondisclosure, as required in Code of Federal Regulations, title 45, section 164.522(a)(1)(vi).