HIPAA COMPLIANT

HIPAA COMPLIANT  Elder Law Attorney Lee Drizin answers more questions from Case Managers that may be helpful: 

  1. When a patient passes away and a family member is requesting medical and/or financial records from my hospice, will they need to go through an attorney for the request? 
  1. When a patient has Alzheimer’s disease and the POA is requesting records, what steps do I need to take to make sure I am compliant with HIPAA while making sure the Power of Attorney obtains the records?

The HIPAA Privacy Rule applies to the individually identifiable health information of a decedent for 50 years following the date of death of the individual. In other words, you must continue to protect the information even though the patient has passed unless it falls within an exception.  The Privacy Rule permits a covered entity to disclose protected health information about a decedent to a family member, or other person who was involved in the individual’s health care or payment for care prior to the individual’s death, unless doing so is inconsistent with any prior expressed preference of the deceased individual that is known to the covered entity. This may include disclosures to spouses, parents, children, domestic partners, other relatives, or friends of the decedent, provided the information disclosed is limited to that which is relevant to the person’s involvement in the decedent’s care or payment for care.  See 45 CFR 164.510(b)(5).  For uses or disclosures of a decedent’s health information not otherwise permitted by the Privacy Rule, a covered entity must obtain a written HIPAA authorization from a personal representative of the decedent who can authorize the disclosure.  A decedent’s personal representative is an executor, administrator, or other person who has authority under applicable State or other law to act on behalf of the decedent or the decedent’s estate.

HIPAA can be a problem especially when contemplating release of information to a Health Care Agent under a durable power of attorney for health care decisions.  Under HIPAA, the agent won’t be able to get the medical information necessary to determine incompetence until the agent has authority.  Therefore, you must first make sure that it is properly documented that the patient is incompetent.  If they remain competent, they can authorize the release themselves.  You should also be aware that the most recent revisions to the Nevada statutes provides’ for the inclusion of the following information in the power of attorney:

“I agree to, authorize and allow full release of information by any government agency, medical provider, business, creditor or third party who may have information pertaining to my health care, to my agent named herein, pursuant to the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, as amended, and applicable regulations.”  If this disclosure is present AND the incompetency of the patient is documented, you should be able to release the information to the health care agent.

We welcome your questions, and wish to remind you and the families you serve that we offer many legal services that cover a broad scope of legal matters: