Section 2.31 - [Effective 4/16/2024] Consent requirements(a)Required elements for written consent. A written consent to a use or disclosure under the regulations in this part may be paper or electronic and must include: (1) The name of the patient.(2) The name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure.(3) A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion.(4)(i)General requirement for designating recipients. The name(s) of the person(s), or class of persons, to which a disclosure is to be made ("recipient(s)"). For a single consent for all future uses and disclosures for treatment, payment, and health care operations, the recipient may be described as "my treating providers, health plans, third-party payers, and people helping to operate this program" or a similar statement.(ii)Special instructions for intermediaries. Notwithstanding paragraph (a)(4)(i) of this section, if the recipient entity is an intermediary, a written consent must include the name(s) of the intermediary(ies) and:(A) The name(s) of the member participants of the intermediary; or(B) A general designation of a participant(s) or class of participants, which must be limited to a participant(s) who has a treating provider relationship with the patient whose information is being used or disclosed.(iii)Special instructions when designating certain recipients. If the recipient is a covered entity or business associate to whom a record (or information contained in a record) is disclosed for purposes of treatment, payment, or health care operations, a written consent must include the statement that the patient's record (or information contained in the record) may be redisclosed in accordance with the permissions contained in the HIPAA regulations, except for uses and disclosures for civil, criminal, administrative, and legislative proceedings against the patient.(5) A description of each purpose of the requested use or disclosure.(i) The statement "at the request of the patient" is a sufficient description of the purpose when a patient initiates the consent and does not, or elects not to, provide a statement of the purpose.(ii) The statement, "for treatment, payment, and health care operations" is a sufficient description of the purpose when a patient provides consent once for all such future uses or disclosures for those purposes.(iii) If a part 2 program intends to use or disclose records to fundraise on its own behalf, a statement about the patient's right to elect not to receive any fundraising communications.(6) The patient's right to revoke the consent in writing, except to the extent that the part 2 program or other lawful holder of patient identifying information that is permitted to make the disclosure has already acted in reliance on it, and how the patient may revoke consent.(7) An expiration date or an expiration event that relates to the individual patient or the purpose of the use or disclosure. The statement "end of the treatment," "none," or similar language is sufficient if the consent is for a use or disclosure for treatment, payment, or health care operations. The statement "end of the research study" or similar language is sufficient if the consent is for a use or disclosure for research, including for the creation and maintenance of a research database or research repository.(8) The signature of the patient and, when required for a patient who is a minor, the signature of a person authorized to give consent under § 2.14 ; or, when required for a patient who has been adjudicated as lacking the capacity to make their own health care decisions or is deceased, the signature of a person authorized to sign under § 2.15 . Electronic signatures are permitted to the extent that they are not prohibited by any applicable law.(9) The date on which the consent is signed. (10) A patient's written consent to use or disclose records for treatment, payment, or health care operations must include all of the following statements: (i) The potential for the records used or disclosed pursuant to the consent to be subject to redisclosure by the recipient and no longer protected by this part.(ii) The consequences to the patient of a refusal to sign the consent.(b)Consent required: SUD counseling notes.(1) Notwithstanding any provision of this subpart, a part 2 program must obtain consent for any use or disclosure of SUD counseling notes, except: (i) To carry out the following treatment, payment, or health care operations:(A) Use by the originator of the SUD counseling notes for treatment;(B) Use or disclosure by the part 2 program for its own training programs in which students, trainees, or practitioners in SUD treatment or mental health learn under supervision to practice or improve their skills in group, joint, family, or individual SUD counseling; or(C) Use or disclosure by the part 2 program to defend itself in a legal action or other proceeding brought by the patient;(ii) A use or disclosure that is required by § 2.2(b) or permitted by § 2.15(b) ; § 2.53 with respect to the oversight of the originator of the SUD counseling notes; § 2.63(a) ; § 2.64 .(2) A written consent for a use or disclosure of SUD counseling notes may only be combined with another written consent for a use or disclosure of SUD counseling notes.(3) A part 2 program may not condition the provision to a patient of treatment, payment, enrollment in a health plan, or eligibility for benefits on the provision of a written consent for a use or disclosure of SUD counseling notes.(c)Expired, deficient, or false consent. A disclosure may not be made on the basis of a consent which: (2) On its face substantially fails to conform to any of the requirements set forth in paragraph (a) of this section;(3) Is known to have been revoked; or(4) Is known, or through reasonable diligence could be known, by the person holding the records to be materially false.(d)Consent for use and disclosure of records in civil, criminal, administrative, or legislative proceedings. Patient consent for use and disclosure of records (or testimony relaying information contained in a record) in a civil, criminal, administrative, or legislative investigation or proceeding cannot be combined with a consent to use and disclose a record for any other purpose.82 FR 6115, Jan. 18, 2017, as amended at 85 FR 43037, July 15, 2020 82 FR 6115, 2/17/2017; 85 FR 43037, 8/14/2020; 89 FR 12625, 4/16/2024 Approved by the Office of Management and Budget under control number 0930-0099