Another potential medical nightmare: obtaining medical records
The Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) was enacted by the United States Congress and signed by President Bill Clinton in 1996. The HIPAA Privacy Rule establishes national standards to protect individuals’ medical records and other personal health information and applies to health plans, health care clearinghouses, and those health care providers that conduct certain health care transactions electronically. In Nevada, the disclosure of medical records is addressed in NRS 629.066.
Under both the federal and state statute, a health care provider may disclose medical records to a family member if the patient provides a written consent. However, a more difficult situation arises if the patient is unable to provide this consent if he/she lacks capacity. Under HIPAA, 45 CFR 164.510 if the individual is unable to agree to the use or disclosure because of the individual’s incapacity, the health care provider may, in the exercise of professional judgment, determine whether the disclosure is in the best interests of the individual and, if so, disclose only the protected health information that is directly relevant to the person’s involvement with the individual’s health care. A covered entity may use professional judgment and its experience with common practice to make reasonable inferences of the individual’s best interest in allowing a person to act on behalf of the individual to pick up filled prescriptions, medical supplies, X‑rays, or other similar forms of protected health information. However, Nevada law is more stringent.
NRS 629.061 provides that each provider of health care shall make the health care records of a patient available for physical inspection by: (a) the patient or a representative with written authorization from the patient; (b) the personal representative of the estate of a deceased patient; (c) any trustee of a living trust created by a deceased patient; or (d) the parent or guardian of a deceased patient who died before reaching the age of majority.
When state law is more stringent than HIPAA, as in the present instance, it will preempt HIPAA. While the goal of protecting private health information is important, it can be extremely frustrating for a spouse where proper planning is absent. For example, assume that your spouse becomes ill and is hospitalized. In addition to speaking to the treating physician, you may want to review the medical records regarding his/her treatment and care. In the absence of a written authorization from your spouse, the hospital could not permit you to obtain a copy of the medical records. As a result, the only method to obtain the records would be to obtain guardianship over the spouse. A guardian of the person is considered the ward’s personal representative for purposes of HIPAA and would be entitled to the records. NRS 159.079(3).
The guardianship process is time consuming and expensive and this scenario demonstrates the importance of proper planning. Had the spouse executed a Durable Power of Attorney for Healthcare Decisions prior to his incapacity, his wife would not have encountered any difficulties in obtaining the medical records. A properly drafted health care power of attorney should contain language which indicates “I agree to, authorize and allow full release of information by any government agency, medical provider, business, creditor or third party who may have information pertaining to my health care, to my agent named herein, pursuant to the Health Insurance Portability and Accountability Act of 1996, Public Law 104‑191, as amended, and applicable regulations.” This consent would constitute the authorization required by NRS 629.061.