Many of the confidentiality laws that apply to North Carolina’s social services agencies, mental health facilities, healthcare providers, local health departments, and substance use disorder treatment providers permit disclosure of confidential information with client or patient consent. However, these confidentiality laws and regulations use different terms, create different restrictions, provide different exceptions to those restrictions, and apply to different types of information or different entities. These differences make it challenging to draft a single form by which a client may authorize multiple agencies or organizations to share confidential information about that client with each other.

The School of Government has released a new bulletin, “Creating Release of Information Forms for Use by Multidisciplinary Teams: Disclosure of Health, Mental Health, Social Services, and Substance Use Disorder Information with Client Consent,” which aims to help attorneys and other professionals weave together the requirements for individual consent across many confidentiality laws so that they can draft legally compliant release of information (ROI) forms. In cases where it is possible to obtain informed and voluntary consent, a multiparty ROI form may serve as a powerful tool for sharing confidential information across different organizations and agencies working together to serve a common goal. For example, information sharing can help organizations coordinate services and treatment for clients and patients, identify gaps in services, protect clients and others in the community, and build capacity to serve more individuals.

The new bulletin includes information regarding:

• Foundational principles for obtaining client consent to disclose confidential information. To sign an ROI form, a patient or client (or the patient or client’s legal representative, if allowed by applicable law) must have the mental capacity to give informed, voluntary consent. The bulletin discusses requirements and best practices around obtaining valid consent to disclose confidential information.

• Requirements for releasing information via client consent under federal and state confidentiality laws. Each confidentiality law has its own requirements around obtaining a client’s authorization to disclose confidential information. The bulletin discusses these requirements for the following confidentiality laws:
  • the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA);
  • North Carolina’s communicable disease confidentiality statute (G.S. 130A-143);
  • the federal law governing the confidentiality of substance use disorder (SUD) patient records (42 C.F.R. Part 2);
  • North Carolina’s mental health, developmental disabilities, and substance abuse confidentiality law (G.S. 122C-52 through -56.1), and
  • North Carolina’s social services confidentiality law (G.S. 108A-80).

• Weaving together legal requirements to create a single ROI form. The bulletin identifies common requirements for ROI forms across the confidentiality laws referenced above, while also highlighting some requirements that are unique to particular laws.

• Using multiparty ROI forms in the multidisciplinary team context. The bulletin discusses best practices for using multiparty ROI forms in the context of a multidisciplinary team, including collectively developing such a form, agreeing on how the form will be used, understanding requirements for storage of signed forms, tracking expiration dates or revocations, updating the form as needed, and training individuals on how the form should be used.

This bulletin may be particularly helpful for multidisciplinary teams–groups of professionals from different disciplines working together to achieve a common goal—that serve individuals with complex needs. Attorneys representing organizations or agencies involved in multidisciplinary collaboration to serve clients and patients may find the bulletin useful for creating a multiparty ROI that addresses the requirements of multiple confidentiality laws. Readers who are not attorneys and who are interested in creating or implementing multiparty ROI forms will find information about legal requirements and best practices in the bulletin, but should also consult an attorney as part of the process of developing their own ROI forms.