Moderator -- David Ermer, Gordon & Barnett, Washington, DC, 202-833-3400, http://www.gordon-barnett.com/
Individual ? The principal purpose of the Privacy Rule
is to safeguard an individual?s protected health information (?PHI?). Who is the individual? This is an important topic that must be
addressed in a covered entity's Privacy Policies and Procedures.
According to the HIPAA Privacy Rule, the individual is "the person who is the subject of the protected health information" (45 C.F.R. ? 164.501) or his or her personal representative (45 C.F.R. ? 164.502(g)). This approach raises operational issues, e.g., for health plans that historically have given rights to subscriber of a self and family enrollment. The complexity of the personal representative rules governing parent-child relationships impact all covered entities.
Personal representative ? Background - According to Section 164.502(g) of the Privacy Rule, covered entities must treat personal representative as the individual. Consequently, covered entities must make requested disclosures to the personal representative (subject to 45 C.F.R. ? 164.524) and must permit the personal representative to exercise the same privacy rights as the individual. Personal representative status usually is invoked when the individual is legally incapacitated or is under age of majority.
The Privacy Rule?s standards distinguish between personal representatives of adults and emancipated minors and personal representatives of unemancipated minors. The Privacy Rule generally defers to state law on all issues surrounding the issue of designation of a personal representative. Accordingly the U.S. Department of Health and Human Services (?HHS?) in its 8/14/02 modifications to the Privacy Rule expressly incorporated such deference in Section 164.502(g). Consequently, the HIPAA preemption analysis does not come into play when analyzing personal representative issues.
To apply the personal representative provisions, it is necessary to appreciate the distinctions among adults, emancipated minors and unemancipated minors.
I am pleased to participate in a discussion
group of attorneys who represent Federal Employees Health Benefits ("FEHB")
plans. The FEHB program (?FEHBP?)
is the largest employer sponsored health benefits program in the U.S. Our FEHBP Lawyers Discussion Group
developed for discussion purposes, and not as legal advice, the attached
State Law Survey relating to personal representative status issues. Participating in this project were
attorneys from Gordon & Barnett (Washington, DC), Miller & Chevalier
(Washington, DC), Crowell & Moring (Washington, DC), Epstein Becker
(Washington DC), O'Donnell Schwartz & Anderson (Washington, DC), Cohen Weiss
& Simon (New York, NY), the First Health Group Corp. General Counsel's
Office, the Government Employees Association General Counsel's Office, Carefirst
General Counsel's office, and the BCBSA FEP General Counsel's office. These
attorneys generally represent organizations sponsoring FEHB plans, which belong
to an FEHBP trade association called the Association of Federal Health
Organizations. AFHO is a WEDI member. The Group has authorized me to share this
valuable tool with WEDI for discussion purposes only, and not as legal
advice.
The State Law Survey includes all U.S.
jurisdictions (except the Commonwealth of the Northern Marianas.) Column 2 of the State Law Survey
provides information on the majority age and emancipation rules in all U.S.
jurisdictions. As you will see, the
age of majority is 18 in most U.S. jurisdictions (Exceptions: 19 in Alabama and
Nebraska and 21 in Pennsylvania.
Note that while the age of majority for all purposes is 21 in
Mississippi, persons over 18 can make their own health care decisions which
renders them individuals for Privacy Rule purposes.)
Personal Representatives of Adults and
Emancipated Minors ? According to 45 C.F.R.
? 164.502(g)(2), if a person has the authority
under applicable law to act on behalf of an individual who is an adult or
emancipated minor in making decisions related to health care, a covered entity
must treat this person as a personal representative with respect to PHI relevant
to such representation, subject to the abuse, neglect, and endangerment
situation limitation found in 45 C.F.R. ? 164.502(g)(5). The December 2002 guidance from the HHS
Office of Civil Rights (?OCR?), which is responsible for interpreting and
enforcing the Privacy Rule, informs us that the authority of a personal
representative for an adult or emancipated minor frequently is limited in scope
-- in contrast to a personal representative for an unemancipated minor, who
usually has general authority.
Covered entity actions must be consistent with the scope of the
personal representative?s status/authority. For example, if an individual is
unconscious, his or her spouse generally can make decisions for that individual,
but the covered entity only can disclose to the personal representative PHI
related to that emergency situation and not unrelated PHI.
The HHS preamble to the 12/28/00 final rule
further explains that the personal representative designation must comply with
applicable local law. Because a
personal representative designation must meet requirements of applicable
state and local law ? a covered entity cannot create its own form unless that
form complies with applicable state law.
The HHS preamble also points out that that the
key phrase "decisions relating to health care" is broader than consenting to
treatment on an individual's behalf; "for example, it would include decisions
relating payment for health care."
Personal Representatives of Unemancipated Minors ? According to 45 C.F.R. ? 164.502(g)(3), if a parent, guardian, or other person acting in loco parentis (e.g., a school official) has authority under applicable law to act on behalf of an unemancipated minor in making decisions related to health care (including related payments), the covered entity must treat this person as a personal representative with respect to PHI relevant to such representation, except in three circumstances:
This rule on personal representative
designation for unemancipated minors is subject to three special disclosure
rules and to the abuse, neglect, and endangerment situation limitation in
45 C.F.R. ? 164.502(g)(5). The special disclosure rules involve the
exceptional situations where the parent is not the unemancipated minor?s
personal representative.
State law may require or permits disclosure to parent or may
prohibit disclosure in these situations.
A covered entity must comply with these state laws. If state law is silent, not directive,
the covered entity based on a healthcare professional?s judgment can determine
whether or not to make disclosure.
The State Law Survey also reviews state laws
relating to the second and third exceptions to personal representative status
for unemancipated minors and the special disclosure rules. (Since circulating the survey to WEDI,
Catherine Dunlay, an attorney with Schottenstein, Zox & Dunn Co., of
Columbus OH kindly informed me of a correction to the Ohio section of the survey
which I have made.) The Survey does
not address the first exception because, in my opinion, it is incumbent upon the
parent to disclose the existence of a confidentiality agreement to the covered
entity. It?s worth noting that the
State Law Survey was drafted for the benefit of multi-state health plans, which
generally handle inquiries over the telephone and through correspondence.
Providers with direct patient contact should be in a better position to
determine personal representative status.
When in Doubt. The Privacy Rule frames the covered entity?s obligation to make disclosures to personal representatives in terms of the right to access PHI in designated record sets under
45 C.F.R. ? 164.524. Consequently when in doubt, a covered entity can require that parent/personal representative to meet requirements for access under that individual right, e.g., place the request in writing. (See also the Caveat below.)
Choice of Law. The Privacy Rule does not address either in ?
164.502(g) or in its preemption provision the important topic of choice (or
conflict) of laws. Assume that I
have a 17-year-old daughter. My
family and I live in a state A. My
daughter attends college in State B, and she seeks health care in State C. Which law applies ? State A, State B, or
State C?? I have considered this
issue and my general recommendation (which at least is a starting point for
discussion purposes) is to apply the law of the State C where the health care is
provided.
Personal Representatives of
Decedents. The HIPAA Privacy Rule, 45 C.F.R. ?
164.502(g)(4), extends personal representative status to the executor,
administrator, or other person who has legal authority to act on behalf of a
deceased individual or the individual's estate.
Caveat. The Privacy Rule, 45 C.F.R. ? 164.502(g)(5),
provides that regardless of State law or the other HIPAA Privacy Rule
requirements outlined above, a covered entity may elect not to treat
a person as a personal representative if (1) the covered entity has a reasonable
belief that: (a) the individual has been subjected to domestic violence, abuse,
or neglect by such person, (b) or treating such person as the personal
representative could endanger the individual or (2) the covered entity, in the
exercise of professional judgment, decides that it is not in the individual's
best interest to treat the person as the individual's personal
representative.
The relationship between these Personal
Representative standards and specifications and the HIPAA Privacy Rule's
standards and specifications on authorizations (45 C.F.R.
? 164.508) and disclosures to family members
and others (45 C.F.R. ? 164.510(b)).
A married individual
may wish his or her spouse to deal with the doctor or health plan on claims
issues. However, a personal
representative relationship does exist between married persons absent legal
incapacity of a spouse. To
facilitate such discussions, I recommend that covered entities encourage the
individual to designate his or her spouse as an "authorized representative"
(that's my own lingo) by applying the authorization rules of 45 C.F.R. ?
164.508. I have attached a sample
authorized representative form that includes the required elements and
statements from ? 164.508. Thanks
to Beth Kranda, the workgroup's co-chair, for setting me off on this
course.
I also find 45 C.F.R. ? 164.510(b) ? the
provision concerning disclosures to family members and others -- very useful in
dealing with more informal situations that do not rise to the level of a
personal representative or an "authorized representative.? To facilitate this discussion, I
distributed for discussion purposes and not as legal advice Sample
Disclosure Grids that I developed in cooperation with the FEHBP Lawyers
Discussion Group. I recognize that
the HHS preambles to the Privacy Rule explain that health plans may continue
their historic practice of sending all explanations of benefits and other
payment related correspondence to the contractholder-enrollee-subscriber of a
self-and-family enrollment, subject to the plan granting individual requests for
restrictions on disclosure and confidential communications. The Sample Disclosure Grids are more
restrictive because telephone communications are so rapid.
The work products that I shared with the group
were developed with large and medium sized health plans in mind. Those organizations rely heavily on
telephone and correspondence contact with their members. The January 15 discussion reminded me of
the fact that the Privacy Rule is scalable and that small health providers in
particular may rely more heavily on the informal exchanges permitted under 45
CFR ? 164.510(b). I look at that
rule as more of a transition vehicle for my clients but that's not the case for
everyone. Thanks to Noel Chang for initiating this exchange on the call.
It is sound practice for a covered entity to describe its personal representative designation and family member disclosure practices clearly in its Notice of Privacy Practices (?NPP?). The NPP should be viewed as the covered entity?s best friend as it allows the covered entity to disclose its approach to ambiguous situations presented by the Privacy Rule.
Accounting of Disclosures ? No tracking of disclosures to personal representatives is required for accounting of disclosures purposes under ? 164.528. If disclosing under an authorization, no tracking is require; however, the authorization itself is subject to the Privacy Rule?s six-year record retention provision. Finally ? 164.510(b) disclosures to family members and others do not need to be tracked or accounted for under ? 164.528.
Q&A
notes:
The only way that a covered entity can have a person sign a form designating a person as personal representative is if the form complies with applicable state law. I recommend instead that the covered entity have the individual sign an authorization form designating person as ?authorized representative? that meets HIPAA authorization requirements.
Foster home/parent likely is acting ?in loco parentis? and may be a personal representative. In contrast, stepparents generally do not legal rights to control healthcare decisions for their stepchildren.
If state law gives a person authority to make healthcare decisions for an individual, that person is the individual?s personal representative.
A question was raised about the phrasing of expiration dates in an authorization form. According to the 8/14/2002 HHS Preamble?s discussion of language of expiration date/event, an authorization lawfully can state that it remains in effect ?until otherwise revoked.?