(a) Required elements for written consent. A written consent to a disclosure under the regulations in this part may be paper or electronic and must include:

(1) The name of the patient.

(2) The specific name(s) or general designation(s) of the part 2 program(s), entity(ies), or individual(s) permitted to make the disclosure.

(3) How much and what kind of information is to be disclosed, including an explicit description of the substance use disorder information that may be disclosed.

(4)

(i) The name(s) of the individual(s) to whom a disclosure is to be made; or

(ii) Entities with a treating provider relationship with the patient. If the recipient entity has a treating provider relationship with the patient whose information is being disclosed, such as a hospital, a health care clinic, or a private practice, the name of that entity; or

(iii) Entities without a treating provider relationship with the patient.

(A) If the recipient entity does not have a treating provider relationship with the patient whose information is being disclosed and is a third-party payer, the name of the entity; or

(B) If the recipient entity does not have a treating provider relationship with the patient whose information is being disclosed and is not covered by paragraph (a)(4)(iii)(A) of this section, such as an entity that facilitates the exchange of health information or a research institution, the name(s) of the entity(-ies); and

(1) The name(s) of an individual participant(s); or

(2) The name(s) of an entity participant(s) that has a treating provider relationship with the patient whose information is being disclosed; or

(3) A general designation of an individual or entity participant(s) or class of participants that must be limited to a participant(s) who has a treating provider relationship with the patient whose information is being disclosed.

(i) When using a general designation, a statement must be included on the consent form that the patient (or other individual authorized to sign in lieu of the patient), confirms their understanding that, upon their request and consistent with this part, they must be provided a list of entities to which their information has been disclosed pursuant to the general designation (see §2.13(d)).

(ii) [Reserved]

(5) The purpose of the disclosure. In accordance with §2.13(a), the disclosure must be limited to that information which is necessary to carry out the stated purpose.

(6) A statement that the consent is subject to revocation at any time except to the extent that the part 2 program or other lawful holder of patient identifying information that is permitted to make the disclosure has already acted in reliance on it. Acting in reliance includes the provision of treatment services in reliance on a valid consent to disclose information to a third-party payer

(7) The date, event, or condition upon which the consent will expire if not revoked before. This date, event, or condition must ensure that the consent will last no longer than reasonably necessary to serve the purpose for which it is provided.

(8) The signature of the patient and, when required for a patient who is a minor, the signature of an individual authorized to give consent under §2.14; or, when required for a patient who is incompetent or deceased, the signature of an individual authorized to sign under §2.15. Electronic signatures are permitted to the extent that they are not prohibited by any applicable law.

(9) The date on which the consent is signed.

(b) Expired, deficient, or false consent. A disclosure may not be made on the basis of a consent which:

(1) Has expired;

(2) On its face substantially fails to conform to any of the requirements set forth in paragraph (a) of this section;

(3) Is known to have been revoked; or

(4) Is known, or through reasonable diligence could be known, by the individual or entity holding the records to be materially false.