By Bonnie R Benitez, Attorney
Former CAMFT Attorney

The Therapist
(May/June 2000)

Updated on June 2012 by Sara Kashing, J.D., Staff Attorney 

Many members inquire about issues relating to confidentiality and the proper form to be used when releasing confidential information. The general rule, of course, is not to release any information without the written authorization of the patient. However, therapists may sometimes overlook what constitutes a proper written authorization. This article will attempt to clearly spell out what therapists need to do prior to disclosing information about their patients.

It may be obvious to most therapists, but I think it is important to state upfront that a verbal authorization is about as useful as no authorization at all. Don't be fooled into believing that you are protected just because you documented in your notes that patient Jane Doe gave you permission to speak with her husband, attorney, or anyone else for that matter. While there are some circumstances within which a therapist can release patient information without a written authorization, these circumstances are strictly limited and clearly spelled out in the law. Before any of the exceptions are given, it's important to understand the rule. "The rule," quite simply, is the Confidentiality of Medical Information Act, located in the Civil Code, Sections 56 through 56.37. The Act sets forth the particulars that must be included in a written authorization.

To properly understand the Act's requirements for a written authorization, therapists must first understand certain key terms defined in Section 56.05. "Authorization" is defined as permission granted (in accordance with accompanying sections) for the disclosure of medical information. "Medical Information" is defined as any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company or contractor  regarding a patient's medical history, mental or physical condition, or treatment. "Patient" means any natural person, whether or not still living, who received health care services from a provider of health care and to whom medical information pertains. "Provider of health care" is defined, in pertinent part, as any person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code. This would include Marriage and Family Therapists. There are a few considerations that are important to note here. First, the information covered under the Act includes virtually anything that pertains to an identifiable patient. This would include the very fact that the patient is in treatment. Second, confidentiality survives the death of the patient. Therefore, should a patient or former patient die, an authorization would still be required prior to releasing any confidential information. In the case of a deceased patient, the person signing the authorization must be the beneficiary or personal representative of the decedent. Finally, each and every patient is entitled to confidentiality under the Act. For example, if a therapist were treating a family, each member of that family (or their representative(s)) would be required to sign an authorization prior to any information being released. Likewise, even if one or more of the patients has discontinued treatment, an authorization would still be required from each patient or prior patient.

With these definitions in mind, Section 56.11 provides that an authorization for the release of medical information by a provider of health care must meet the following criteria to be valid.

1. It must be handwritten by the person who signs it or is in a typeface no smaller than 14-point type.
2. It must be clearly separate from any other language present on the same page and executed by a signature, which serves no other purpose than to execute the authorization.
3. It must be signed and dated by one of the following:

a) The patient. A patient who is a minor may only sign an authorization for the release of medical information obtained by a provider of health care in the course of furnishing services to which the minor could lawfully have consented under Section 6924 of the Family Code.
b) The legal representative of the patient, if the patient is a minor or an incompetent. Except as outlined above.
c) The spouse of the patient or the person financially responsible for the patient, where the medical information is being sought for the sole purpose of processing an application for health insurance or for enrollment in a nonprofit hospital plan, a health care service plan, or an employee benefit plan, and where the patient is to be an enrolled spouse or dependent under the policy or plan.
d) The beneficiary or personal representative of a deceased patient.  

4. It must state the specific uses and limitations on the types of medical information to be disclosed.
5. It must state the name or functions of the provider of health care that may disclose the medical information.
6. It must state the name or functions of the persons or entities authorized to receive the medical information.
7. It must state the specific uses and limitations on the use of the medical information by the persons or entities authorized to receive the medical information.
8. It must state a specific date after which the provider of health care is no longer authorized to disclose the medical information.
9. It must advise the person signing the authorization of the right to receive a copy of the authorization.

In addition to using a valid authorization, to release confidential information, therapists should also be aware of additional requirements contained in the Act.

First, the law provides that upon demand by the patient or the person who signed the authorization, a provider of health care possessing the authorization shall furnish a true copy to the patient or person (Section 56.12). Therefore, if the person who signed the authorization or the patient requests a copy of that authorization, the therapist must provide them with a copy.

Second, a recipient of medical information pursuant to an authorization may not further disclose that medical information except in accordance with a new authorization that meets the requirements specified above, or as specifically required or permitted by law (Section 56.13). Thus, the recipient of the confidential information can only release the information to another party after receiving his/her own written authorization, unless he/she is otherwise are permitted or required by law to do so.

Third, a provider of health care that discloses medical information pursuant to an authorization shall communicate to the person or entity to which it discloses the medical information any limitations regarding the use of the medical information. Providers who attempt in good faith to comply with this provision shall not be liable for any unauthorized use of the medical information by the person or entity to which the provider disclosed the medical information (Section 56.14). It is important that therapists clearly communicate the limitations regarding the use of the disclosed information to the recipient. So long as therapists releasing the information make a good faith effort in communicating the limitations of use, they will not be held liable for any unauthorized use.

Finally, the law provides that any cancellation or modification of an authorization shall be effective only after the provider of health care actually receives written notice of the cancellation or modification (Section 56.15). Therefore, if a patient or other person who previously signed an authorization now wants to cancel or alter that authorization in any way, he/she must do so in writing. Many therapists may find themselves with an upset patient who is saying that he/she no longer has permission to share information with a third party. This is not enough.

The exceptions to the requirement of having a written authorization are located in Section 56.10 (b). For example, a therapist may be compelled to disclose information when complying with a court order or search warrant, among other things.
There are other provisions in the Act, which may affect a therapist's ability to disclose patient information. This article has attempted to explain the most pertinent points in the Act. Please take the time to review any forms you currently use to be sure that they are in compliance with the requirements set forth in the Act.
________________________________________

This article appeared in the May/June 2000 issue of The California Therapist, the publication of the California Association of Marriage and Family Therapists, headquartered in San Diego, California. This article is intended to provide guidelines for addressing difficult legal dilemmas. It is not intended to address every situation that could potentially arise, nor is it intended to be a substitute for independent legal advice or consultation. When using such information as a guide, be aware that laws, regulations and technical standards change over time, and thus one should verify and update any references or information contained herein.