42 CFR 2.31 – Consent requirements
(a) Required elements for written consent. A written consent to a disclosure under the regulations in this part may be paper or electronic and must include:
(1) The name of the patient.
(2) The specific name(s) or general designation(s) of the part 2 program(s), entity(ies), or individual(s) permitted to make the disclosure.
(3) How much and what kind of information is to be disclosed, including an explicit description of the substance use disorder information that may be disclosed.
(4)(i) General requirement for designating recipients. The name(s) of the individual(s) or the name(s) of the entity(-ies) to which a disclosure is to be made.
(ii) Special instructions for entities that facilitate the exchange of health information and research institutions. Notwithstanding paragraph (a)(4)(i) of this section, if the recipient entity facilitates the exchange of health information or is a research institution, a written consent must include the name(s) of the entity(-ies) and
(A) The name(s) of individual or entity participant(s); or
(B) A general designation of an individual or entity participant(s) or class of participants that must be limited to a participant(s) who has a treating provider relationship with the patient whose information is being disclosed. When using a general designation, a statement must be included on the consent form that the patient (or other individual authorized to sign in lieu of the patient), confirms their understanding that, upon their request and consistent with this part, they must be provided a list of entities to which their information has been disclosed pursuant to the general designation (see § 2.13(d)).
(5) The purpose of the disclosure. In accordance with § 2.13(a), the disclosure must be limited to that information which is necessary to carry out the stated purpose.
(6) A statement that the consent is subject to revocation at any time except to the extent that the part 2 program or other lawful holder of patient identifying information that is permitted to make the disclosure has already acted in reliance on it. Acting in reliance includes the provision of treatment services in reliance on a valid consent to disclose information to a third-party payer
(7) The date, event, or condition upon which the consent will expire if not revoked before. This date, event, or condition must ensure that the consent will last no longer than reasonably necessary to serve the purpose for which it is provided.
(8) The signature of the patient and, when required for a patient who is a minor, the signature of an individual authorized to give consent under § 2.14; or, when required for a patient who is incompetent or deceased, the signature of an individual authorized to sign under § 2.15. Electronic signatures are permitted to the extent that they are not prohibited by any applicable law.
(9) The date on which the consent is signed.
(b) Expired, deficient, or false consent. A disclosure may not be made on the basis of a consent which:
(1) Has expired;
(2) On its face substantially fails to conform to any of the requirements set forth in paragraph (a) of this section;
(3) Is known to have been revoked; or
(4) Is known, or through reasonable diligence could be known, by the individual or entity holding the records to be materially false.