HIPAA: Surrogate Decision Making and Advance Health Care Directives

Carolyn Heyman-Layne, Esq.

Dorsey & Whitney LLP

December 20, 2007

Third-Party Access to Records

Personal Representatives (HIPAA Concept)– Patient advocate, patient proxy, attorney-in-fact

Advance Health Care Directive– Health Care Power of Attorney– Living Will & Other Directives

Alaska Native representatives Deceased Individuals Implementing Personal Representative

Policies

HIPAA: Personal Representatives

“If under applicable law a person has authority to act on behalf of an individual who is an adult or an emancipated minor in making decisions related to health care, a covered entity must treat such person as a personal representative under this subchapter, with respect to protected health information relevant to such personal representation.” 45 CFR 164.502(g)(2)

General Rule: A covered entity should treat a personal representative as though they are the individual. State law ultimately determines who.

Rights of Personal Representative Same as the individual’s HIPAA rights:

– Uses and disclosures– Accounting of disclosures– Access to protected health information– Authorization of disclosures

Exceptions:– Abuse, neglect or endangerment– Limitations in Advance Health Care Directive

Best Interest Standard

Covered Entity can still restrict access for personal representatives if:– Danger to patient– Domestic abuse– Violence

Need to look out for the best interest of the patient

Advance Health Care Directive

Power of Personal Representative limited to powers in Advance Health Care Directive

Advance Health Care Directive covers:– Health Care Power of Attorney– End-of-Life Decisions– Organ Donation– Mental Health Treatment– Physician Designation

Personal Representative v. Health Care Power of Attorney Personal

Representative:– Includes, but not

limited to, health care power of attorney, parents, legal guardians, etc.

– Authority derived from authority to make health care decisions under applicable law

Health Care Power of Attorney:– Personally chosen by

individual and may include anyone with legal capacity

– Authority derived from Advance Health Care Directive (or, if prior to January 1, 2005 – Health Care Power of Attorney)

Regular Power of Attorney

A standard power of attorney does not substitute for an advance directive.

Representative must have the power to act for healthcare reasons.

Does not apply to decedents: persons just required to have authority under law to act for decedent or estate.

Who are the Personal Representatives?

Adults/Emancipated Minors: If necessary, persons with legal authority to make health care decisions on behalf of the individual. May not be as clear, or specifically designated in documents/law.

Incompetent Adults: Persons with legal authority to make health care decisions on behalf of the individual. Can pursue legal decision, if necessary.

Deceased persons: Persons with legal authority to make decisions for the decedent or estate.

Legally Incompetent Persons Even if an individual is deemed

incompetent under State or other law to act on his or her own behalf, covered entities may decline a request by a personal representative for protected health information if the individual objects to the disclosure, and the disclosure is merely permitted, but not required, under the Rule.

Required disclosures still required (acctng., etc.)

Best interest standard applies.

Deceased Individuals: Protected Health Information is still

protected. Personal representatives have rights, in

addition to:– Legally authorized executor or administrator.– Persons otherwise legally authorized to act on

behalf of deceased or his estate, if relevant.– Family members requiring PHI for treatment

purposes.– Government representatives needing

information for purposes specified in HIPAA (disease reporting, crime, etc.)

Alaska Native Representatives

Personal representatives include persons with “authority to act on behalf of an individual”

Authority may be provided under State or other applicable law – e.g., tribal law

System of health care in rural areas may result in persons acting “in loco parentis”, who may still have access consistent with law, if decision made by licensed health care professional

Personal Representative Compliance

HIPAA requires covered entities to verify a personal representative’s authority (45 CFR 164.514(h)– Make sure HIPAA policies address personal

representatives– Review document authorizing personal

representative and/or health care power of attorney for scope of authority

– State and other applicable laws not changed by HIPAA unless HIPAA provides more protection – state law is used to determine the appropriate representative

Additional Information:

45 CFR164.502(g) U.S. Department of Health and Human Services

Frequently Asked Questions on HIPAA http://www.hhs.gov/hipaafaq/

OCR HIPAA Privacy Factsheets: Personal Representatives http://www.hhs.gov/ocr/hipaa/guidelines/personalrepresentatives.pdf

Carolyn Heyman-Layne: (907) 257-7870