Telehealth for behavioral health care

The purpose of consent forms is to document that a discussion took place and that the patient was informed and able to understand the information provided. Informed consent can be documented in writing or electronically before the appointment and/or through verbal consent at the beginning of each session.

If someone else is joining the visit, such as a caregiver or another provider, the additional participant must also provide consent.

There are several basic steps you should follow to record informed consent:

• Reassure the patient that the information shared during the call is private.
• Discuss with children and adolescents that they can share confidential information that you will not share with their parents or guardians.
• Outline the only circumstances when information may be shared with a caregiver, associate, or other entity.
• Explain to the patient what information you do and do not have access to (for example, the electronic medical record or state prescription drug monitoring program (PDMP).
• If the patient may have a history of substance use disorder, explain that this information will not be included in their medical record without additional consent.
• Discuss the importance of finding a private and quiet place for the appointment and the use of headphones if needed to ensure privacy.
• Confirm that other members of the household are respecting the patient’s need for privacy.

If you are a provider associated with a practice, unit, or facility that screens, diagnoses, or treats substance use disorder, you will need additional patient consent to share information with other providers. For more information visit Disclosure of Substance Use Disorder Patient Records: Does Part 2 Apply to Me?

HHS released a final rule in February 2024 to streamline processes for documenting consent and sharing information related to patient records from facilities that fall under 42 CFR part 2. Key changes include:

• A single consent can be used for all future uses and disclosures for treatment, payment and health care operations
• The consent allows HIPAA covered entities and business associates that receive patient records to redisclose them in alignment with HIPAA regulations
• De-identified records can be shared with public health authorities without the patient's consent
• Without consent, these records cannot be used in civil, criminal, administrative, or legislative proceedings
• Penalties, breach notification, and patient notice requirements are aligned with those that apply to HIPAA violations
• There is a safe harbor that limits civil or criminal liability for agencies that act with reasonable

For more information, visit Fact Sheet 42 CFR Part 2 Final Rule

Tip: Make sure to have your medical and intake forms reviewed by your legal team.

More about informed consent:

• Informed Consent — from the National Policy Center, Center for Connected Health Policy
• Current State Laws & Reimbursement Policies — from the National Policy Center - Center for Connected Health Policy
• How to Obtain Informed Consent for Telehealth — from the Agency for Healthcare Research and Quality
• Easy-to-Understand Telehealth Consent Form — from the Agency for Healthcare Research and Quality