We have recently received inquiries from several clients regarding obtaining patient consent, especially as it relates to providing telehealth services. Ray Martin, our Senior Privacy Analyst, has provided the following feedback:
- Make a good faith effort to adhere to regulatory and contractual requirements and document efforts to mitigate when not reasonably practical.
- Develop written procedures for obtaining consent forms and distributing required documents.
- Train staff on this and other emergency procedures.
Some potential mitigations:
- DocuSign or Adobe E-Sign
- Mail paper documents and form(s) to the patient with a stamped return envelope. Follow up to verify receipt, forms signed and returned, etc.
- Get verbal consent from patient by trained staff members and fully document
- Request permission from the patient to record the “consent” phone call (be advised, many States require permission to record phone calls)
- Email/internet/faxing/texting of authorization
- Remediate as soon as reasonably practical
- Track exceptions made during the emergency and document remediation (i.e. get signed forms, deliver documents, etc.)
Pertaining to HIPAA:
- HIPAA– No later than the date of first service delivery, a Notice of Privacy Practice (NPP) [with any State or Section 1557 addendums] needs to be provided to a patient.
BUT in an emergency treatment situation, the provider is just expected to make a good faith effort to obtain the individual’s written acknowledgment of receipt of the notice. If an acknowledgment cannot be obtained, the provider must document their efforts to obtain the acknowledgment and the reason why it was not obtained.
*When first service delivery to an individual is provided over the Internet, through e-mail, or otherwise electronically, the provider must send an electronic notice automatically and contemporaneously in response to the individual’s first request for service. The provider must make a good faith effort to obtain a return receipt or other transmission from the individual in response to receiving the notice.
*In an emergency treatment situation, provide the notice as soon as it is reasonably practicable to do so after the emergency has ended. In these situations, providers are not required to make a good faith effort to obtain a written acknowledgment from individuals.
A covered entity may e-mail the notice to an individual if the individual agrees to receive an electronic notice.
