Confidentiality, Privacy and Security

Double Verbal Release Authorization

Anmarie Masters, M.Ed., Human Resource Studies,B.S., Health Informa6 days ago

  • 1.  Double Verbal Release Authorization

    Posted 6 days ago
    I work for a behavioral health hospital that treats adolescents and adults for mental health and substance use disorders. I have always required a "wet" signature of the parent of a minor child on the release authorization form. My staff and our copy service have consistently denied release of PHI, even to continuing care providers without the signature. Today we received the ROI of a patient who discharged yesterday. The signature line contains the simple statement that two staff confirmed the parent's verbal authorization. The Clinical Services Director informed me that for 2 or 3 minor patients each week the SW is unable to obtain an actual signature from the parent for various reasons (distance, parents don't use a phone, parents not engaged in patient's treatment until discharge, etc.). I see nothing in the regulations allowing or disallowing this practice. What are others doing?

    Anmarie Masters
    Director, Him & Facility Privacy Officer
    Centennial Peaks Hospital

  • 2.  RE: Double Verbal Release Authorization

    Posted 6 days ago

    If the PHI were being requested by an attorney or a school, I'd be scrutinizing the Authorization, and probably contacting a parent directly to check their needs and intent.

    In this scenario, Another care provider is requesting the PHI needed to assign a therapist, continue medications, initiate care. You could send that information WITHOUT an Authorization, just using T, P, and O information-sharing and the Referral provisions of HIPAA. Just have your Clinical Director, or clinical team supervisor, or appropriate other senior clinician, instruct HIM which documents and notes should constitute the "standard aftercare coordination package." At minimum, I'd assume: All admission notes & evaluations, SW evaluation, Medication notes, Discharge summaries. Confirm that the request is from an aftercare provider that's a Covered Entity, and send the standard package, just upon the request of the facility. 


    It is always important to step through a policy's impact on patient care, and also across the spectrum of your patients. HIPAA is meant to serve the patient, and protect the patient's rights. HIPAA is also meant to ensure that each health-services provider has access to the PHI that's essential to serve the patient safely and appropriately.

    If all your patient population is wealthy and can afford private-pay followup, then this "wet-ink" level of documentation requirement will be an inconvenience and a slight delay.

    If any of your patient population includes single working parents, parents who've lost jobs in the pandemic, parents who for any reason don't have control over their time and gas money, then the policy may be inflicting significant hardship and creating serious delays in aftercare, or may stop aftercare entirely. Very bad things can happen in a patient's life when they walk out of the hospital doors and don't get ongoing care.

    Requiring a parent to drive to a clinic just to sign a request? That can force many parents to take hours off work, or give up an entire shift. For some people it would cause them to be fired. If parent "doesn't use a phone" I'm guessing they don't have a phone. If a person can't afford a phone, how likely is it that they own a working car? Having to pay a neighbor to drive them is a large barrier. Money for gas is becoming a large barrier. Many parents already struggle to afford enough gas money to get to work. k

    (In many states, Medicaid has some kind of contract to pay for transportation - but only to APPOINTMENTS, not to do paperwork. Often a ride has to be requested several days in advance. And it often kills a day because they have to wait for the ride both coming and going, and sit in the vehicle while others are picked up and dropped off.)

    So, in this scenario, staff at an OP clinic are working within 24 hours trying to get aftercare set up and prepare for the intake. They're also probably arranging for the family to bring child in, and again if Medicaid, a responsible adult will have to come with the child. E.g., detail in the SW assessment may be crucial to contacting the right people and linking up with the right other agencies, docs, courts, etc. A one-page, skeletal, Discharge Sheet handed to a parent is not enough information.

    Over all hospitals and all populations, there is significant drop-off in participation between hospital care and OP "aftercare". There's a second terrible drop-off after the first OP session. And you know that with current conditions, many patients are discharged as soon as they are barely "stabilized" and with all the serious problems they suffered from when they came in the door.

    If a child is bad-enough off to require hospitalization, then getting connected in to ongoing care may be lifesaving, and will certainly be essential for stabilization.

    Too few organizations put the right people in a room to talk about how policies need to adjust to serve our patients and families. When a HIM/HIPAA officer can sit down with a key Social Worker, a Psychiatrist, a Primary Therapist, a Case Manager, and someone who takes phone calls from families and OP providers, everybody learns something, and usually a few changes can be worked out that reduce barriers and improve care - and often also smooth out recurring annoyances that waste staff time.

    Forgive such a long response, but as HIPAA Privacy Officer at a large outpatient group, and a clinical-manager backup for problematic cases, I just saw so many gaps between our patients' realities and what staff assumed. 

    Hope some of this is helpful.

    Ruth Czirr
    Retired Privacy Officer / Compliance Officer