The Release Form That Names Everything
A patient enrolled in a partial hospitalization program signs a release at the front desk authorizing disclosure of "all records" to her sister, who is also her emergency contact. The sister calls the next day asking for the full chart, saying, "She told me it's fine, just send it." The chart contains substance use disorder treatment notes from a co-occurring program, HIV status, and psychiatric evaluations. State law requires separate, specific authorization for HIV-related and behavioral health information. The patient's signature on the front-desk form does not name any category of record, purpose, or expiration date, and she is currently in group and cannot be reached.
1. Can the records be released to the sister based on this form? Identify what is deficient and what may be released, if anything.
Read the worked answer
No - not as written, and not in full.
Defects in the authorization:
- Substance use disorder records are governed by federal confidentiality rules (42 CFR Part 2), which require written consent that identifies the specific program making the disclosure, the recipient by name, the purpose, the scope of information, and the patient's right to revoke, among other elements. A general 'all records' release does not satisfy this. A verbal 'she said it's fine' satisfies nothing.
- HIV and behavioral health information require a separate, specific authorization under state law. The front-desk form names no category, so it cannot support those disclosures.
- The form also lacks an expiration date and a stated purpose, both of which most state forms require.
What may be released: only information covered by a valid authorization. In practice that may mean general demographic and appointment information, and even that should be limited to the minimum necessary for the sister's stated purpose - which she has not stated.
Correct handling: tell the sister the request cannot be processed today and explain why in general terms without confirming any diagnosis. Offer to have the patient complete a compliant, category-specific authorization when she is available, and document the call, the request, and the reason for not fulfilling it.
2. The sister becomes insistent and says, "I have medical power of attorney, so you have to tell me." How should the associate respond, and what must be verified?
Read the worked answer
A claim of power of attorney is not self-authenticating and does not automatically make the sister a personal representative for every purpose.
Response substance: "I understand this is frustrating. If you have a document that gives you authority for her care, I need to review it before I can share anything. I cannot confirm what is or is not in her record either way until then. Can you send or bring in the document? I'll flag the account so it's handled the same day it arrives."
What must be verified:
- The actual executed document - a general financial power of attorney does not confer health information rights; a health care power of attorney or health care proxy may.
- Whether the document is currently in effect. A health care agent's authority typically begins on a determination of incapacity; the associate should not assume incapacity, and staff should confirm with the attending clinician or the privacy officer.
- Identity of the requester against the named agent.
Note the tell: the request has now shifted from 'she said it was fine' to a legal authority claim. That escalation is exactly when staff stop improvising. Route it to the privacy officer, keep the disclosure at zero, and document both contacts.