Iowa Admin. Code r. 441-9.7

Current through Regsiter Vol. 46, No. 26, June 12, 2024

Rule 441-9.7 - [Effective 7/3/2024] Consent to disclosure by the subject of a confidential record

To the extent permitted by any applicable provision of law, the subject of a confidential record may have a copy of the portion of that record concerning the subject disclosed to a third party. A request for such a disclosure must be in writing and must identify the particular record or records to be disclosed, the particular person or class of persons to whom the record may be disclosed, and the time period during which the record may be disclosed. The subject of the record and, where applicable, the person to whom the record is to be disclosed may be required to provide proof of identity. Appearance of counsel before the department on behalf of a person who is the subject of a confidential record is deemed to constitute consent for the department to disclose records about that person to the person's attorney. No confidential information about clients of the department shall be released without the client's consent, except as otherwise provided by law. Release of confidential information includes granting access to or allowing the copying of a record, providing information either in writing or orally, or acknowledging information to be true or false.

(1)Release forms.

a.Releases allowing the department to provide confidential information. Subjects should complete the Authorization for the Department to Release Information for releases that do not involve protected health information.

b.Releases allowing the department to provide confidential information, including protected health information. When consent or authorization for use or disclosure of health information is required, the department shall use Form 470-3951, Authorization to Obtain or Release Health Care Information, or a HIPAA authorization form from another source that meets HIPAA requirements. The department shall not require a subject to sign a HIPAA authorization form as a condition of treatment, payment, enrollment in a health plan, or eligibility for benefits. The department as a health care provider may require a subject to sign a HIPAA authorization form for the use or disclosure of protected health information for research, as a condition of the subject's receiving research-related treatment. A subject may revoke a HIPAA authorization at any time, provided that the revocation is in writing using the Request to End an Authorization form, except to the extent that the department has taken action in reliance thereon.

(2) Except as provided in subparagraph 9.7(1)"c"(1), department staff shall release mental health or substance abuse information only with authorization on the Consent to Obtain and Release Information form, a form from another source that meets requirements of law, or as otherwise allowed by law.

c.Releases allowing the department to obtain confidential information from a third party. The department is required to obtain confidential information from third parties. The department may make these requests only when the client has authorized the release on one of the following forms or when otherwise provided by law:

(1) Authorization for Release of Information.

(2) Household Member Questionnaire.

(3) Bank or Credit Union Information.

(4) Addendum for Application and Review Forms for Release of Information.

(5) Request for School Verification.

(6) Employer's Statement of Earnings.

(7) Verification of Educational Financial Aid.

(8) Financial Institution Verification.

(9) Authorization to Obtain or Release Health Care Information.

d.Releases for photographs and recordings. The department uses Authorization to Take and Use Photographs, and Authorization to Take and Use Photographs of Minor or Ward forms, for permission to use photographs in department publications. The department shall obtain authorization from the subject or person responsible (such as a guardian, custodian, or personal representative) for the subject before taking photographs or making any type of recording for any purpose other than those specifically allowed by law or for internal use within an institution.

(2)Exceptions to use of release forms.

a.Public official. A letter from the subject to a public official which seeks the official's intervention on behalf of the subject in a matter that involves the department shall be treated as an authorization to release information upon receipt of appropriate authorization from the client to do so. The department shall release only the minimum amount of information necessary about the subject to the official to resolve the matter.

b.Medical emergency. Department staff may authorize release of confidential information to medical personnel in a medical emergency if the subject is unable to give or withhold consent. As soon as possible after the release of information, the subject shall be advised of the release.

c.Abuse information. Consent to release information is not required to gather information for investigations of child abuse or dependent adult abuse.

(3)Opportunity for subject to agree or object. This subrule describes when the department may use or disclose protected health information, without a written authorization, to persons involved in the subject's care and for notification purposes. However, the department shall give the subject an opportunity to agree or object, unless this requirement is waived as specified in paragraph 9.7(3)"e."

a.Involvement in the subject's care. The department may, in accordance with paragraphs 9.7(3)"c," "e," and "f," disclose protected health information that is directly relevant either to a subject's care or to payment related to the subject's care, provided payment is relevant to the person's involvement in the subject's care. The person involved must be:

(1) A family member;

(2) Another relative;

(3) A close personal friend of the subject; or

(4) Any other person identified by the subject.

b.Notification purposes. The department may use or disclose protected health information to notify, or assist in notifying, identifying or locating a family member, a personal representative of the subject, or another person responsible for the care of the subject of the subject's location, general condition or death. For disaster relief purposes, the use or disclosure shall be in accordance with paragraph 9.7(3)"f."

c.Uses and disclosures with the subject present. If the subject is present for, or available before, a use or disclosure permitted by this subrule and has the capacity to make health care decisions, the department may use or disclose the protected health information if the department:

(1) Obtains the subject's agreement;

(2) Provides the subject with the opportunity to object to the disclosure, and the subject does not express an objection; or

(3) Reasonably infers from the circumstances, based on the exercise of professional judgment, that the subject does not object to the disclosure.

d.Informing the subject. The department may orally inform the subject of and obtain the subject's oral agreement or objection to a use or disclosure permitted by this subrule.

e.Limited uses and disclosures when the subject is not present. When the subject is not present, or the opportunity to agree or object to the use or disclosure cannot practicably be provided because of the subject's incapacity or an emergency circumstance, the department may, in the exercise of professional judgment, determine that disclosure is in the best interest of the subject.

(1) When the department determines that disclosure is in the subject's best interest, the department may disclose only the protected health information that is directly relevant to the person's involvement with the subject's health care.

(2) The department may use professional judgment and its experience with common practice to make reasonable inferences of the subject's best interest in allowing a person to act on behalf of the subject to pick up filled prescriptions, medical supplies, X-rays, or other similar forms of protected health information.

f.For disaster relief purposes. The department may use protected health information or disclose protected health information to a public or private organization authorized by law or by its charter to assist in disaster relief efforts for the purpose of coordinating with these organizations the uses or disclosures permitted by paragraph 9.7(3)"b." The requirements in paragraphs 9.7(3)"c" and "d" apply to these uses and disclosures to the extent that the department, in the exercise of professional judgment, determines that the requirements do not interfere with the ability to respond to the emergency circumstances.

Iowa Admin. Code r. 441-9.7

ARC 0420C, lAB 10/31/12, effective 1/1/2013

Adopted by IAB May 29, 2024/Volume XLVI, Number 25, effective 7/3/2024