HIPAA does not require any consent for the use and disclosure of protected health information (PHI) for Treatment, Payment and Health Care Operations (TPO). However, HIPAA commentary stated that this position was not supposed to impede existing privacy rights for clients. There has been debate about whether New York law does require a general consent for the use or disclosure of PHI for TPO. A general discussion about OMH’s interpretation of this provision is available here – https://www.omh.ny.gov/omhweb/hipaa/faq/privacy.htm. There are still provisions in New York Law that arguably require consent for these purposes. The majority of ACLAIMH’s Members have reported that they always get consent for the disclosure of PHI for treatment updated every six months or on a one-time basis, and that they get consents for disclosure of PHI for payment through the residency agreement (updated yearly). They also give clients the right to revoke consent. Receiving some consent in these cases is best practice.