[Code of Federal Regulations]
[Title 45, Volume 1]
[Revised as of October 1, 2001]
From the U.S. Government Printing Office via GPO Access
[CITE: 45CFR164.506]
[Page 696-698]
TITLE 45--PUBLIC WELFARE
SUBTITLE A--DEPARTMENT OF HEALTH
AND HUMAN SERVICES
PART 164--SECURITY AND PRIVACY--Table of Contents
Subpart E--Privacy of Individually Identifiable Health Information
Sec. 164.506 Consent for uses or disclosures to carry out treatment, payment, or health care operations.
(a) Standard: Consent requirement. (1) Except as provided in
paragraph (a)(2) or (a)(3) of this section, a covered health care
provider must obtain the individual's consent, in accordance with this
section, prior to using or disclosing protected health information to
carry out treatment, payment, or health care operations.
(2) A covered health care provider may, without consent, use or
disclose protected health information to carry out treatment, payment,
or health care operations, if:
(i) The covered health care provider has an indirect treatment
relationship with the individual; or
(ii) The covered health care provider created or received the
protected health information in the course of providing health care to
an individual who is an inmate.
(3)(i) A covered health care provider may, without prior consent,
use or disclose protected health information created or received under
paragraph (a)(3)(i)(A)-(C) of this section to carry out treatment,
payment, or health care operations:
(A) In emergency treatment situations, if the covered health care
provider attempts to obtain such consent as soon as reasonably
practicable after the delivery of such treatment;
(B) If the covered health care provider is required by law to treat
the individual, and the covered health care provider attempts to obtain
such consent but is unable to obtain such consent; or
(C) If a covered health care provider attempts to obtain such
consent from the individual but is unable to obtain such consent due to
substantial barriers to communicating with the individual, and the
covered health care provider determines, in the exercise of professional
judgment, that the individual's consent to receive treatment is clearly
inferred from the circumstances.
(ii) A covered health care provider that fails to obtain such
consent in accordance with paragraph (a)(3)(i) of
[[Page 697]]
this section must document its attempt to obtain consent and the reason
why consent was not obtained.
(4) If a covered entity is not required to obtain consent by
paragraph (a)(1) of this section, it may obtain an individual's consent
for the covered entity's own use or disclosure of protected health
information to carry out treatment, payment, or health care operations,
provided that such consent meets the requirements of this section.
(5) Except as provided in paragraph (f)(1) of this section, a
consent obtained by a covered entity under this section is not effective
to permit another covered entity to use or disclose protected health
information.
(b) Implementation specifications: General requirements. (1) A
covered health care provider may condition treatment on the provision by
the individual of a consent under this section.
(2) A health plan may condition enrollment in the health plan on the
provision by the individual of a consent under this section sought in
conjunction with such enrollment.
(3) A consent under this section may not be combined in a single
document with the notice required by Sec. 164.520.
(4)(i) A consent for use or disclosure may be combined with other
types of written legal permission from the individual (e.g., an informed
consent for treatment or a consent to assignment of benefits), if the
consent under this section:
(A) Is visually and organizationally separate from such other
written legal permission; and
(B) Is separately signed by the individual and dated.
(ii) A consent for use or disclosure may be combined with a research
authorization under Sec. 164.508(f).
(5) An individual may revoke a consent under this section at any
time, except to the extent that the covered entity has taken action in
reliance thereon. Such revocation must be in writing.
(6) A covered entity must document and retain any signed consent
under this section as required by Sec. 164.530(j).
(c) Implementation specifications: Content requirements. A consent
under this section must be in plain language and:
(1) Inform the individual that protected health information may be
used and disclosed to carry out treatment, payment, or health care
operations;
(2) Refer the individual to the notice required by Sec. 164.520 for
a more complete description of such uses and disclosures and state that
the individual has the right to review the notice prior to signing the
consent;
(3) If the covered entity has reserved the right to change its
privacy practices that are described in the notice in accordance with
Sec. 164.520(b)(1)(v)(C), state that the terms of its notice may change
and describe how the individual may obtain a revised notice;
(4) State that:
(i) The individual has the right to request that the covered entity
restrict how protected health information is used or disclosed to carry
out treatment, payment, or health care operations;
(ii) The covered entity is not required to agree to requested
restrictions; and
(iii) If the covered entity agrees to a requested restriction, the
restriction is binding on the covered entity;
(5) State that the individual has the right to revoke the consent in
writing, except to the extent that the covered entity has taken action
in reliance thereon; and
(6) Be signed by the individual and dated.
(d) Implementation specifications: Defective consents. There is no
consent under this section, if the document submitted has any of the
following defects:
(1) The consent lacks an element required by paragraph (c) of this
section, as applicable; or
(2) The consent has been revoked in accordance with paragraph (b)(5)
of this section.
(e) Standard: Resolving conflicting consents and authorizations. (1)
If a covered entity has obtained a consent under this section and
receives any other authorization or written legal permission from the
individual for a disclosure of protected health information to carry out
treatment, payment, or health care operations, the covered entity may
disclose such protected health information only in accordance with the
more restrictive consent, authorization, or
[[Page 698]]
other written legal permission from the individual.
(2) A covered entity may attempt to resolve a conflict between a
consent and an authorization or other written legal permission from the
individual described in paragraph (e)(1) of this section by:
(i) Obtaining a new consent from the individual under this section
for the disclosure to carry out treatment, payment, or health care
operations; or
(ii) Communicating orally or in writing with the individual in order
to determine the individual's preference in resolving the conflict. The
covered entity must document the individual's preference and may only
disclose protected health information in accordance with the
individual's preference.
(f)(1) Standard: Joint consents. Covered entities that participate
in an organized health care arrangement and that have a joint notice
under Sec. 164.520(d) may comply with this section by a joint consent.
(2) Implementation specifications: Requirements for joint consents.
(i) A joint consent must:
(A) Include the name or other specific identification of the covered
entities, or classes of covered entities, to which the joint consent
applies; and
(B) Meet the requirements of this section, except that the
statements required by this section may be altered to reflect the fact
that the consent covers more than one covered entity.
(ii) If an individual revokes a joint consent, the covered entity
that receives the revocation must inform the other entities covered by
the joint consent of the revocation as soon as practicable.