HIPAA: Surrogate Decision Making and Advance Health Care Directives Carolyn Heyman-Layne, Esq. Dorsey & Whitney LLP December 20, 2007

Third-Party Access to Records  Personal Representatives (HIPAA Concept) –Patient advocate, patient proxy, attorney-in-fact  Advance Health Care Directive –Health Care Power of Attorney –Living Will & Other Directives  Alaska Native representatives  Deceased Individuals  Implementing Personal Representative Policies

HIPAA: Personal Representatives  “If under applicable law a person has authority to act on behalf of an individual who is an adult or an emancipated minor in making decisions related to health care, a covered entity must treat such person as a personal representative under this subchapter, with respect to protected health information relevant to such personal representation.” 45 CFR (g)(2)  General Rule: A covered entity should treat a personal representative as though they are the individual. State law ultimately determines who.

Rights of Personal Representative  Same as the individual’s HIPAA rights: –Uses and disclosures –Accounting of disclosures –Access to protected health information –Authorization of disclosures  Exceptions: –Abuse, neglect or endangerment –Limitations in Advance Health Care Directive

Best Interest Standard  Covered Entity can still restrict access for personal representatives if: –Danger to patient –Domestic abuse –Violence  Need to look out for the best interest of the patient

Advance Health Care Directive  Power of Personal Representative limited to powers in Advance Health Care Directive  Advance Health Care Directive covers: –Health Care Power of Attorney –End-of-Life Decisions –Organ Donation –Mental Health Treatment –Physician Designation

Personal Representative v. Health Care Power of Attorney  Personal Representative: –Includes, but not limited to, health care power of attorney, parents, legal guardians, etc. –Authority derived from authority to make health care decisions under applicable law  Health Care Power of Attorney: –Personally chosen by individual and may include anyone with legal capacity –Authority derived from Advance Health Care Directive (or, if prior to January 1, 2005 – Health Care Power of Attorney)

Regular Power of Attorney  A standard power of attorney does not substitute for an advance directive.  Representative must have the power to act for healthcare reasons.  Does not apply to decedents: persons just required to have authority under law to act for decedent or estate.

Who are the Personal Representatives?  Adults/Emancipated Minors: If necessary, persons with legal authority to make health care decisions on behalf of the individual. May not be as clear, or specifically designated in documents/law.  Incompetent Adults: Persons with legal authority to make health care decisions on behalf of the individual. Can pursue legal decision, if necessary.  Deceased persons: Persons with legal authority to make decisions for the decedent or estate.

Legally Incompetent Persons  Even if an individual is deemed incompetent under State or other law to act on his or her own behalf, covered entities may decline a request by a personal representative for protected health information if the individual objects to the disclosure, and the disclosure is merely permitted, but not required, under the Rule.  Required disclosures still required (acctng., etc.)  Best interest standard applies.

Deceased Individuals:  Protected Health Information is still protected.  Personal representatives have rights, in addition to: –Legally authorized executor or administrator. –Persons otherwise legally authorized to act on behalf of deceased or his estate, if relevant. –Family members requiring PHI for treatment purposes. –Government representatives needing information for purposes specified in HIPAA (disease reporting, crime, etc.)

Alaska Native Representatives  Personal representatives include persons with “authority to act on behalf of an individual”  Authority may be provided under State or other applicable law – e.g., tribal law  System of health care in rural areas may result in persons acting “in loco parentis”, who may still have access consistent with law, if decision made by licensed health care professional

Personal Representative Compliance  HIPAA requires covered entities to verify a personal representative’s authority (45 CFR (h) –Make sure HIPAA policies address personal representatives –Review document authorizing personal representative and/or health care power of attorney for scope of authority –State and other applicable laws not changed by HIPAA unless HIPAA provides more protection – state law is used to determine the appropriate representative

Additional Information:  45 CFR (g)  U.S. Department of Health and Human Services Frequently Asked Questions on HIPAA  OCR HIPAA Privacy Factsheets: Personal Representatives  Carolyn Heyman-Layne: (907)