Protecting your patient and practice: Creating and using a medical release form
As a former U.S. First Lady often said (and wrote), “it takes a village” to care for a person. Especially in an increasing era of medical specialization and expanded circles of family and other caregivers, that’s more true than ever.
However.
Sharing a patient’s information with the appropriate persons during your busy day can be a daunting task, with definitive consequences to the practice and staff if you get it wrong. Legislation such as the Health Insurance Portability and Accountability Act (HIPAA) in the U.S. and the Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada are serious about patient privacy. Very.
HIPAA and PIPEDA
In fact, as particular as some U.S. providers feel that HIPAA is, PIPEDA covers much more — basically the inappropriate sharing of any personal data, health or otherwise, regardless of the type of private-sector organization. This data is called personally identifiable information or PII. Alberta, British Columbia and Quebec have their own laws deemed substantially similar to PIPEDA. And Ontario, New Brunswick, Nova Scotia and Newfoundland and Labrador have also adopted substantially similar legislation regarding the collection, use and disclosure of protected health information (PHI).
Under these acts, the respective government can impose significant sanctions on healthcare personnel who violate their rules and mishandle patient information. See this recap of the levels of HIPAA violations, which as of this posting, can total up to $1.8 million per year and up to 10 years in jail. Total settlements and civil financial penalties for 2021 were almost $6 million. For violations of the Canada Health Act (CHA), the Office of the Privacy Commissioner of Canada (OPC) can refer information relating to the possible commission of an offense to the Attorney General of Canada, who would be responsible for any ultimate prosecution.
This recap of both laws shows why a medical release form isn’t just the right thing to do for the patient, but a lifesaver for the provider…legally, ethically and financially.
What does constitute a medical release form?
The form gives healthcare professionals permission to share a patient’s medical information with certain other parties. HIPAA regulations refer to it as an authorization.
According to the U.S. Dept. of Health and Human Services, “An authorization is a detailed document that gives covered entities permission to use protected health information for specified purposes, which are generally other than treatment, payment or health care operations, or to disclose protected health information to a third party specified by the individual.”
A release doesn’t simply give the healthcare staff permission to share information with just anyone. Depending on the scope of the document, the form may authorize releasing of specific types of a patient’s medical record or condition with the patient’s family, insurance providers, other doctors, attorneys, or anyone who is authorized to make healthcare decisions on behalf of the patient, such as a school, a parent or guardian, someone designated by the patient as a dedicated healthcare agent, and so on).
Verbal medical release agreements aren’t sufficient because they’re impossible to verify if there’s ever a disagreement. Healthcare staff need a written copy on record with a signature of the signee (and relationship noted, if not the patient) to protect themselves and their patient. If you’re ever instructed to share healthcare information on behalf of a patient, ensure you have them sign a release form.
HIPAA and PIPEDA
In fact, as particular as some U.S. providers feel that HIPAA is, PIPEDA covers much more — basically the inappropriate sharing of any personal data, health or otherwise, regardless of the type of private-sector organization. This data is called personally identifiable information or PII. Alberta, British Columbia and Quebec have their own laws deemed substantially similar to PIPEDA. And Ontario, New Brunswick, Nova Scotia and Newfoundland and Labrador have also adopted substantially similar legislation regarding the collection, use and disclosure of protected health information (PHI).
Under these acts, the respective government can impose significant sanctions on healthcare personnel who violate their rules and mishandle patient information. See this recap of the levels of HIPAA violations, which as of this posting, can total up to $1.8 million per year and up to 10 years in jail. Total settlements and civil financial penalties for 2021 were almost $6 million. For violations of the Canada Health Act (CHA), the Office of the Privacy Commissioner of Canada (OPC) can refer information relating to the possible commission of an offense to the Attorney General of Canada, who would be responsible for any ultimate prosecution.
This recap of both laws shows why a medical release form isn’t just the right thing to do for the patient, but a lifesaver for the provider…legally, ethically and financially.
What does constitute a medical release form?
The form gives healthcare professionals permission to share a patient’s medical information with certain other parties. HIPAA regulations refer to it as an authorization.
According to the U.S. Dept. of Health and Human Services, “An authorization is a detailed document that gives covered entities permission to use protected health information for specified purposes, which are generally other than treatment, payment or health care operations, or to disclose protected health information to a third party specified by the individual.”
A release doesn’t simply give the healthcare staff permission to share information with just anyone. Depending on the scope of the document, the form may authorize releasing of specific types of a patient’s medical record or condition with the patient’s family, insurance providers, other doctors, attorneys, or anyone who is authorized to make healthcare decisions on behalf of the patient, such as a school, a parent or guardian, someone designated by the patient as a dedicated healthcare agent, and so on).
Verbal medical release agreements aren’t sufficient because they’re impossible to verify if there’s ever a disagreement. Healthcare staff need a written copy on record with a signature of the signee (and relationship noted, if not the patient) to protect themselves and their patient. If you’re ever instructed to share healthcare information on behalf of a patient, ensure you have them sign a release form.
Consider the patient’s mental soundness to sign
A medical release form can only be completed by a patient who is considered of sound mind and body. If you have a reason to believe a patient isn’t mentally capable of making the decision to release medical information, or if they have a physical condition (such as intense pain) that might influence their decision-making abilities, you can’t accept the release form.
Worse yet, you may be held accountable for improperly sharing medical information if it can be proven you were aware the patient wasn’t capable of making the decision to release the information, and you did so regardless. If you aren’t sure about the patient’s soundness to make medical decisions, have an underage patient’s parent or guardian (or anyone else who can make decisions in their stead), or a spouse or someone else with a healthcare power of attorney for an adult also sign the form. intakeQ medical release forms can note that a patient didn’t complete the form.
Elements of a release form
(Image source of example below: sampletemplates.com)
These are the main elements of a patient release form. The information may vary depending on your practice, industry and patients. Request any additional information you need. The goal is to protect yourself from potential liability.
If you use online forms for your releases, check out tips to optimize your forms.
1. Patient information
Naturally, the release should require the patient’s information so it’s clear who the form refers to. Create forms that require the patient’s name, phone number, physical/mailing address, email address, date of birth, Social Security (U.S.) or Social Insurance Number (Canada) number, and any other identifying information you think would be valuable.
Sometimes a parent will need to release medical information on behalf of their child. Often this information is sent to the child’s other physicians, schools, athletic leagues, insurance companies or others.
These organizations that impact the underage patient’s life need the information to be aware of contagious diseases such as COVID and to verify immunizations. School nurses or EMTs may need the information to treat illness or injuries on site. Ensure your forms have proper lineage for the child’s information.
Sometimes a parent will need to release medical information on behalf of their child. Often this information is sent to schools, athletic leagues, insurance companies or other doctors. They need this information to be aware of contagious diseases and verify immunizations. School nurses or EMTs may need it to treat illness or injuries on site. Make sure your forms have proper lineage for the child’s information.
2. Receiving party’s information
Ensure that the patient or guardian clearly lists who may access the medical information. This should include names, titles, relationship to the patient, addresses, and contact information so you are precisely clear.
Some patients aren’t private with their medical information and may want to give you permission to share their records with anyone. Never do that! Insist they give you explicit permission for each party, so there’s no confusion.
We recommend that you have your patients complete a new form for each receiving party. Separate forms enable you to pair different types of information with different receivers.
For instance, a patient may want information shared from his general practitioner to his ENT (ear, nose and throat) specialist, but only information that relates to his ears. He wouldn’t want to share last year’s x-rays of his broken foot. A specific medical release form for the ear specialist would limit the type of information shared for that receiver.
Be absolutely clear who should receive the information by creating fields for business name, name of the healthcare provider, address, email, phone number, place of business, and other pertinent identifying information.
3. Information to be shared
Have the patient explicitly check off or list the types of information to be shared — tests, results, scans, images, notes, medications, allergies, etc. The patient can limit information any way they please, such as by body part, condition (cancer, HIV, physiological disorder, pregnancy, etc.), date, and so on. Ask them to be clear and thorough.
4. Purpose of the release
The patient should indicate why their healthcare information is being released. These fields on the form are important to eliminate confusion and prevent the unintended spreading of information. Typical options include:
- U.S. Social Security or Canadian personal health number
- Medical disability claim
- Insurance claim
- Workers compensation claim
- Information for a child’s school nurse
- College immunization notification
- Specialist consultation
5. Expiration of authorization
This field gives the patient an opportunity to record a date when the release form expires. It’s smart to add a note that if a date isn’t provided — common when the patient doesn’t know the outcome of treatment or how long it will take — the form will expire by whatever length of time is your default.
It’s true that this means you may have to request additional release forms when the authorization form has expired, but it’s smart to protect your business and your staff by getting as much written approval as possible.
6. Disclaimers
Disclaimers give patients information about how the form will be used and their rights. Make the patient aware that they are under no obligation to release their information and can revoke their release form at any time. List any fees associated with copying and distributing information.
7. Date and signature
Finally, end your release form with a signature field and date. If you use an online form, patients can sign them with an e-Signature.
Interested in seeing an example medical intake form? Check out our free template.
(This document is only a sample. If you are a HIPAA Covered Entity, refer to your Institution’s Privacy Policy document for specific information pertaining to HIPAA Authorization requirements and your business.)
Electronic or paper
HIPAA is a good law that’s designed to protect patients’ privacy, but it comes with some challenges. It’s difficult to safely and securely transfer healthcare information, even when the transfer is well-intentioned.
For example, a niece is caring for her sick aunt. The niece wants to consult her aunt’s doctor about a potential medication reaction, but the doctor can’t discuss the aunt’s treatment with the niece because he doesn’t have authorization to do so. In this case, the aunt needs to sign a medical release form, but she’s too sick to travel to the doctor’s office.
This is why it’s important to make your medical release forms easily and securely accessible to your patients. Paper release forms are a huge headache for everyone, due to lack of easy access, or the ability to electronically track when it was added to the patient’s medical record or accessed by staff…and specifically by whom. Again, like any other part of the patient’s medical record, release forms are best managed electronically. The benefits of electronic medical records are significant…including saving you money).
You can use online forms for your medical releases in two ways:
- Link to it on your website or within the patient’s record on your patient portal. You can direct anyone to the link when they request a form. Upon submitting the form, the information will appear in your patient’s medical record.
- Email a link to the form to your patient. This is the more-effective method because it reduces the number of steps for your patient to take.
Using our earlier example, the doctor could email the form to the aunt and receive authorization in minutes. The aunt receives appropriate care and the doctor is protected. Everyone wins. (Just ensure that your emails are secure and HIPPA– or PIPEDA-compliant.)
With our intakeQ forms-only solution, totally integrated with our full practiceQ practice-management solution, you can quickly make medical release forms for your patients. Try practiceQ (forms and PM solutions) or intakeQ (forms-only) for 14 days.