WHAT GUARDIANSHIP ATTORNEYS SHOULD KNOW BY RACHEL ANNE BROOKS MARCH 15, 2016 Health Care Privacy

Sources of Law THE BIG ONES HIPAA (43 CFR 164) RCW Chapter 70.02

More Sources of Law GR 22 CPG SOP RPC 1.6 RCW

HIPAA Health Insurance Portability and Accountability Act

HIPAA Applies to “Covered Entities”: Health Care Providers Health Plans Health Care Clearinghouses

HIPAA Applies to “Protected Health Information” (“PHI”)

HIPAA HIPAA does not directly apply to lawyers However,

HIPAA If you represent a Covered Entity, and You receive PHI, then Congratulations, HIPAA applies to you!

HIPAA A lawyer for a Covered Entity who receives PHI is considered a “Business Associate.” This is a fairly new (2013) expansion of the definition of “Business Associate.”

HIPAA Duties of a lawyer as “Business Associate”: Enter into a Business Associate Agreement. This is really your client’s duty as the “covered entity,” but you’re the lawyer, so make sure it happens. Sample Business Associate Agreements can be found at HHS.gov

HIPAA Other duties of a lawyer as “Business Associate” include but are not limited to: Do not disclose PHI except as permitted Limit disclosure of PHI to “minimum necessary” Report breaches of confidentiality to client (and report significant breaches to HHS) Ensure employees and subcontractors are compliant

HIPAA Duties of lawyer as “Business Associate” – Further Reading: /july_august/new_hipaa_liability_lawyers.htm l /july_august/new_hipaa_liability_lawyers.htm l rs-as-business-consultants-under-hipaa-how-to- stay-compliant/ rs-as-business-consultants-under-hipaa-how-to- stay-compliant/

HIPAA When can a “Covered Entity” disclose PHI to a lawyer? [When] the covered entity, in good faith, believes the use or disclosure * * * “is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person” and “is to a person * * * reasonably able to prevent or lessen the threat.” 45 CFR (j).

HIPAA When can a lawyer disclose PHI to another party? Pursuant to the Business Associate Agreement To the extent minimally necessary Here’s my standard business associate agreement: Feel free to copy and improve it.

RCW MEDICAL RECORDS— HEALTH CARE INFORMATION ACCESS AND DISCLOSURE

RCW HEALTH CARE SUBPOENA PROCEDURE Applies to discovery request and subpoenas served on a health care provider Requires at least 14 days advanced notice to the provider and the patient