Courses: 0

Total: $00.00

Permissible Communications Consent/Authorization Back to Course Index

Permissible Communications Consent/Authorization:

The best way to ensure communications are permissible under 42 C.F.R. Part 2 is to have the individual sign a consent/authorization form that complies with the requirements of both HIPAA and 42 C.F.R. Part 2.  

The elements of a consent/authorization form that must be included are listed below.  In addition, it also includes applicable state law as well.



  • Name or general designation of the program or person permitted to make the disclosure
  • Name or title of the individual or name of the organization to which disclosure is to be made
  • Name of the patient
  • Purpose of the disclosure
  • How much and what kind of information is to be disclosed
  • Signature of the patient (and, in some states, a parent or guardian)
  • The date on which consent is signed
  • A statement that the consent is subject to revocation at any time except to the extent that the program has already acted on it
  • Date, event, or condition upon which consent will expire if not previously revoked

Qualified Service Organizations/Business Associate Agreements: Under both 42 C.F.R. Part 2 and HIPAA, programs can disclose information without consent to outside organizations that provide services to the program or its patients. These organizations are called Qualified Service Organizations (QSOs) and Business Associate Agreements (B.A.A.s) under 42 C.F.R. Part 2 and HIPAA, respectively. Only two parties may enter into these agreements, and two alcohol and drug programs may not enter into a QSO or B.A.A. with one another. Student Assistance Programs (SAPs) can enter into QSO/BA agreements with the school’s administrative office or principal’s office.

Once these agreements have been entered into, the program and the outside agency can communicate freely as long as the information is limited to what is necessary for the B.A.A. or QSO to provide services to the program.

Both 42 C.F.R. Part 2 and HIPAA allow communications between individuals within a program and an entity that has direct administrative control over the program on a need-to-know basis. Most student assistance programs (SAP) are under the direct administrative control of the principal’s office. Since information can only be disclosed under this section on a need-to-know basis, an SAP can share information necessary to obtain permission for students to attend the program, for example, but not to a principal who is considering disciplinary action. A program can be structured in a way that a school’s SAP counselors, guidance counselor, school nurse, teacher representative, and a representative of the principal’s office are all considered to be part of the program as key individuals concerned with the student’s overall social, health and educational functioning. The program must be defined and structured to include these individuals as part of the program. Students should be made aware that these individuals will receive information about them but that they are bound by HIPAA and 42 C.F.R. Part 2.