Maryland Bar Bulletin
Publications : Bar Bulletin

Editor: W. Patrick Tandy

April, 2004


The HIPAA Privacy Rule and Planning for Incapacity

By Morris Klein

The federal regulation promulgated under the Health Insurance Portability and Accountability Act of 1996, P.L. 104-91, commonly known as the “HIPAA Privacy Rule,” is intended to shield personal health care information from unwanted disclosures. In brief, the rule bars health care providers from disclosing a patient’s protected health care information to most third parties unless a patient signs a specially-written authorization. Among other requirements, the authorization must contain specific information regarding the health information to be disclosed and the persons disclosing and receiving the information. Health care providers who make unauthorized disclosures face civil or criminal penalties, ranging from $100 to $100,000, imprisonment of up to five years or both. Whole volumes have been written to help health care providers comply with the rule.

Elder law attorneys view the privacy rule as an obstacle as much as a benefit. The problem is that the authorization process described above may not work when the client is incapacitated. Thus, the privacy rule makes it difficult for the person previously designated by a now incapacitated client to receive pertinent health care information. This article discusses some situations in which the elder law attorney needs to think about the privacy rule when helping a client plan for incapacity.

1.  Health care power of attorney. A person signing a health care power of attorney designates an agent to make health care decisions. Obviously, the agent must have health care information to make sound health care decisions consistent with the wishes of the principal. The concern is to make sure that the health care provider discloses such health care information without violating the privacy rule.

The privacy rule does recognize that patients incapable of exercising their privacy rights may choose to designate someone else to act on their behalf with respect to their privacy rights. The rule defines a person authorized under state law, such as a health care agent, to act on behalf of the individual in making health care-related decisions as a “personal representative.”

The privacy rule requires a health care provider to treat a personal representative exactly the same as the patient is treated with respect to uses and disclosures of the patient’s private health information as well as the patient’s other rights under the rule. This bypasses the need for the patient to issue an authorization in conformity with the privacy rule and allows the personal representative to issue authorizations on behalf of the patient. The provider may decline to accept the standing of a personal representative, however, if the provider has a reasonable belief that the personal representative may be abusing or neglecting the individual or that treating the person as the personal representative could otherwise endanger the individual.

Although the words “personal representative” do not need to be on the health care power of attorney document to be effective, it nevertheless may be useful to specify that the health care agent is also the personal representative for purposes of the privacy rule. This is because a health care agent may need to obtain information quickly. The “personal representative” language is what is used in the privacy rule, so it may be more familiar to hospital personnel, thus avoiding the delay resulting when a health care professional seeks a review from its legal counsel.

The use of the term “personal representative” is unfortunate, as this term is also used in Maryland to designate the person responsible for administrating the probate of a decedent’s estate. Of course, a client’s designation of a health care agent as a personal representative in a health care power of attorney does not mean the client is also designating a personal representative for estate administration. However, the privacy rule does permit the personal representative for the administration of an estate to obtain health care information that is needed for postmortem matters. Clients may need to be made aware of these distinctions.

2. Surrogate decision-making. In Maryland, a family member or close friend may be able to make health care decisions for a patient even when the patient did not execute a health care power of attorney. The privacy rule may allow a family member or close friend under the surrogate decision-making law to act as the personal representative to the same extent that the surrogate decision-making law allows the person to make health care decisions. The privacy rule permits the provider, however, in the exercise of professional judgment, to determine whether the disclosure is in the best interests of the patient and, if so, to disclose only the health information that is directly relevant to the involvement of the surrogate decision maker with the patient’s health care.

3. Financial Power of Attorney. The attorney-in-fact in a financial power of attorney may need certain health care information in order to pay bills. Therefore, the drafter of a financial power of attorney may also want to include language authorizing the attorney-in-fact to act as a personal representative for matters related to the client’s finances.

4. Springing powers of attorney or successor trustees. A financial power of attorney may be drafted to “spring” into effect upon the incapacity of the principal. Similarly, an agent in a power of attorney or a trustee of a trust may be required to relinquish his or her authority to a successor upon a finding of incapacity. Such documents often require a written statement by one or two physicians as evidence of incapacity as a more convenient and less costly alternative to a judge’s finding of incapacity. Under the privacy rule, however, a physician could refuse to provide such a statement to the health care agent or attorney-in-fact without the authorization of the person who is alleged to be incapacitated. To avoid this result, the document may need to include a provision authorizing someone to act as a personal representative for the limited purpose of authorizing the disclosure of health care information relating to the physician’s examination.

In conclusion, the privacy rule must be considered when drafting planning documents in circumstances where the client may be incapacitated. The U.S. Department of Health and Human Services Office of Civil Rights maintains a website ( that offers up-to-date information on the privacy regulations.

Morris Klein is a solo practitioner in Bethesda, Maryland, and a past chair of the MSBA Elder Law Section.



Publications : Bar Bulletin: April, 2004

Back to top