Maryland Bar
Bulletin
Publications :
Bar Bulletin
Editor: W. Patrick Tandy
April, 2004
| |
The
HIPAA Privacy Rule and Planning for Incapacity |
| By
Morris Klein |
The federal
regulation promulgated under the Health Insurance Portability and
Accountability Act of 1996, P.L. 104-91, commonly known as the “HIPAA
Privacy Rule,” is intended to shield personal health care information from
unwanted disclosures. In brief, the rule bars health care providers from
disclosing a patient’s protected health care information to most third
parties unless a patient signs a specially-written authorization. Among
other requirements, the authorization must contain specific information
regarding the health information to be disclosed and the persons
disclosing and receiving the information. Health care providers who make
unauthorized disclosures face civil or criminal penalties, ranging from
$100 to $100,000, imprisonment of up to five years or both. Whole volumes
have been written to help health care providers comply with the rule.
Elder law attorneys
view the privacy rule as an obstacle as much as a benefit. The problem is
that the authorization process described above may not work when the
client is incapacitated. Thus, the privacy rule makes it difficult for the
person previously designated by a now incapacitated client to receive
pertinent health care information. This article discusses some situations
in which the elder law attorney needs to think about the privacy rule when
helping a client plan for incapacity.
1. Health care
power of attorney. A person signing a health care power of attorney
designates an agent to make health care decisions. Obviously, the agent
must have health care information to make sound health care decisions
consistent with the wishes of the principal. The concern is to make sure
that the health care provider discloses such health care information
without violating the privacy rule.
The privacy rule
does recognize that patients incapable of exercising their privacy rights
may choose to designate someone else to act on their behalf with respect
to their privacy rights. The rule defines a person authorized under state
law, such as a health care agent, to act on behalf of the individual in
making health care-related decisions as a “personal representative.”
The privacy rule
requires a health care provider to treat a personal representative exactly
the same as the patient is treated with respect to uses and disclosures of
the patient’s private health information as well as the patient’s other
rights under the rule. This bypasses the need for the patient to issue an
authorization in conformity with the privacy rule and allows the personal
representative to issue authorizations on behalf of the patient. The
provider may decline to accept the standing of a personal representative,
however, if the provider has a reasonable belief that the personal
representative may be abusing or neglecting the individual or that
treating the person as the personal representative could otherwise
endanger the individual.
Although the words
“personal representative” do not need to be on the health care power of
attorney document to be effective, it nevertheless may be useful to
specify that the health care agent is also the personal representative for
purposes of the privacy rule. This is because a health care agent may need
to obtain information quickly. The “personal representative” language is
what is used in the privacy rule, so it may be more familiar to hospital
personnel, thus avoiding the delay resulting when a health care
professional seeks a review from its legal counsel.
The use of the term
“personal representative” is unfortunate, as this term is also used in
Maryland to designate the person responsible for administrating the
probate of a decedent’s estate. Of course, a client’s designation of a
health care agent as a personal representative in a health care power of
attorney does not mean the client is also designating a personal
representative for estate administration. However, the privacy rule does
permit the personal representative for the administration of an estate to
obtain health care information that is needed for postmortem matters.
Clients may need to be made aware of these distinctions.
2. Surrogate
decision-making. In Maryland,
a family member or close friend may be able to make health care decisions
for a patient even when the patient did not execute a health care power of
attorney. The privacy rule may allow a family member or close friend under
the surrogate decision-making law to act as the personal representative to
the same extent that the surrogate decision-making law allows the person
to make health care decisions. The privacy rule permits the provider,
however, in the exercise of professional judgment, to determine whether
the disclosure is in the best interests of the patient and, if so, to
disclose only the health information that is directly relevant to the
involvement of the surrogate decision maker with the patient’s health
care.
3. Financial Power
of Attorney. The attorney-in-fact in a financial power of attorney may
need certain health care information in order to pay bills. Therefore, the
drafter of a financial power of attorney may also want to include language
authorizing the attorney-in-fact to act as a personal representative for
matters related to the client’s finances.
4. Springing powers
of attorney or successor trustees. A financial power of attorney may be
drafted to “spring” into effect upon the incapacity of the principal.
Similarly, an agent in a power of attorney or a trustee of a trust may be
required to relinquish his or her authority to a successor upon a finding
of incapacity. Such documents often require a written statement by one or
two physicians as evidence of incapacity as a more convenient and less
costly alternative to a judge’s finding of incapacity. Under the privacy
rule, however, a physician could refuse to provide such a statement to the
health care agent or attorney-in-fact without the authorization of the
person who is alleged to be incapacitated. To avoid this result, the
document may need to include a provision authorizing someone to act as a
personal representative for the limited purpose of authorizing the
disclosure of health care information relating to the physician’s
examination.
In conclusion, the
privacy rule must be considered when drafting planning documents in
circumstances where the client may be incapacitated. The U.S. Department
of Health and Human Services Office of Civil Rights maintains a website (www.hhs.gov/ocr/hipaa)
that offers up-to-date information on the privacy regulations.
Morris Klein is a
solo practitioner in Bethesda, Maryland, and a past chair of the MSBA
Elder Law Section.
