Obtaining patient authorization for use or disclosure of health information? Check the expiration date

CDA’s updated consent and authorization forms are compliant with state law
October 8, 2024
677
QUICK SUMMARY: Under California's Confidentiality of Medical Information Act, a patient's consent for the use or disclosure of their health information is valid only for one year from the date they sign. This time limit also applies to a health care provider's use of patient testimonials and photographs in articles, advertisements and other such purposes. CDA members can use our compliant patient consent and authorization forms.

Under California’s Confidentiality of Medical Information Act, dental practices in the state are required to obtain patients’ authorization to use or disclose their patient health information for purposes not expressly stated in state law. HIPAA has similar requirements. The authorization, which may be in a patient’s handwriting, must contain specific information, be presented in a specific format and notify patients of certain rights.

CMIA now limits the validity of the authorization to one year or less, unless the individual signing the authorization requests a date beyond a year or when the authorization relates to an approved clinical trial or research study.

Updated consent form for use or disclosure of PHI

CDA’s expert analysts have updated a form that dentists can provide to patients to obtain their consent to use or disclose their health information. The fillable and printable PDF form is compliant with the updated state law and comes with instructions for dental practices and a summary of the requirements under CMIA.

The dental office must provide the patient with a copy of the completed and signed form.

The resource includes specifics about when the authorization is valid under the law and the limited instances when health care providers can disclose PHI without patient authorization.

CDA members can log in to begin using the Consent Form for Use or Disclosure of Patient Health Information.

Sample patient testimonial and photograph authorization forms

Dental practices that wish to reproduce, print, publish or transmit patient testimonials in any format for use in articles, lectures, advertisements and marketing campaigns must also comply with the California Medical Information Act and HIPAA rules on patient privacy.

Likewise, dental practices must adhere to state and federal privacy rules when reproducing, printing, publishing or transmitting photographs, video recordings and other imaging of a patient’s face, teeth and mouth for use in articles, lectures, advertisements and marketing campaigns.

Dental practices must obtain and document the patient’s authorization in all these instances. The authorization expires one year from the date the patient signs unless the patient requests a different date or until the completion of a clinical trial or medical research study.

Two forms from CDA help dental practices obtain the required authorization in compliance with state and federal laws. Patients complete and sign the form, which includes information about their rights.

CDA members can log in to start using:

Clear procedures will help the practice track expired forms

Practices that adopt strong front-office procedures with clear roles for individual team members are more likely to catch expired forms and avoid noncompliance with CMIA and other acts and laws.

For example, practices might set calendar reminders and designate one employee to input and track the effective and expiration dates of consent and authorization forms. The designated employee would then follow up on any expired patient authorization forms by removing patient photos and testimonials from the practice’s website, social media posts, advertising and any other shared location.

Feedback

Was this resource helpful?