Congress passed the Health Insurance Portability and Accountability Act, commonly known as HIPAA, in 1996. The HIPAA Privacy Rule is a set of standards created by the United States Department of Health and Human Services to implement the requirements of HIPAA. The Privacy Rule permits you to control the use and disclosure of your Protected Health Information (PHI).
PHI includes information that relates to your past, present, or future physical or mental health or condition, health care, or payment for health care. There are several different “identifiers” that constitute PHI. They include everything from your name to your license plate number. HIPAA does not preempt state laws that are more stringent. But state rules generally cannot be less restrictive.
Anyone who is authorized under state law to act on your behalf in making health care decisions is your “personal representative” for HIPAA purposes. Generally, the parents of unemancipated minors are authorized to exercise the rights of those children under HIPAA, but there are some exceptions. The administrator or executor of your estate is also treated as a personal representative under the HIPAA Privacy Rule to the extent that PHI is relevant to his or her duties. You may also provide a valid authorization for the release of PHI.
The Privacy Rule requires covered entities to treat your personal representative or designated agent just as they would treat you. A health care provider is not required to disclose your PHI to a personal representative if the provider reasonably believes that you have been or may be the victim of domestic violence, abuse, or neglect by the personal representative and that such disclosure would not be in your best interest.
Although your health care providers are not required to disclose PHI to your family members who are not personal representatives, there are times when a provider may do so. For example, if you were injured and could not consent to treatment, the medical provider can share your PHI with a family member or friend who is not a personal representative if the provider believes such disclosure would be in your best interest.
HIPAA does not require a specific HIPAA waiver in health care powers of attorney. However, there are two reasons why we prepare a separate HIPAA release. The first is that that making health care decisions is a different matter than obtaining information. You may have several family members that you would like to be able to talk to your doctors, but one specific person who should make health care decisions when you can’t do it yourself. The second reason is that you may want someone to be considered a personal representative for HIPAA purposes before your health care power of attorney becomes effective. HIPAA states that anyone who has authority to act on your behalf in making health care decisions is a personal representative. We typically state that your health care power of attorney becomes effective when your treating physician determines that you can no longer make health care decisions. This could leave some ambiguity as to whether or not your health care agent is a personal representative for HIPAA purposes. Spelling it out makes it clear. Health care providers are cautious about sharing PHI with others. If you specify in a notarized writing that you have designated certain persons as personal representative, there is no question.