§ 2.31 Consent requirements.

(a) Required elements for written consent. A written consent to a use or disclosure under the regulations in this part may be paper or electronic and must include:

(1) The name of the patient.

(2) The name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure.

(3) A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion.

(4)

(i) General requirement for designating recipients. The name(s) of the person(s), or class of persons, to which a disclosure is to be made (“recipient(s)”). For a single consent for all future uses and disclosures for treatment, payment, and health care operations, the recipient may be described as “my treating providers, health plans, third-party payers, and people helping to operate this program” or a similar statement.

(ii) Special instructions for intermediaries. Notwithstanding paragraph (a)(4)(i) of this section, if the recipient entity is an intermediary, a written consent must include the name(s) of the intermediary(ies) and:

(A) The name(s) of the member participants of the intermediary; or

(B) A general designation of a participant(s) or class of participants, which must be limited to a participant(s) who has a treating provider relationship with the patient whose information is being used or disclosed.