The Privacy Rule requires that we treat a patient’s Personal Representative the same as the patient when it comes to the use and disclosures of the patient’s protected health information and the patient’s rights. A Personal Representative “stands in the shoes” of the patient and must be treated as the patient to recognize the patient’s rights under HIPAA.
- PHI Rights
- Legal right to make a health care decision on behalf of the patient also have the right to decide about their PHI
- State Laws
- All states’ laws allow a “Personal Representative” to make heath care decisions for someone when the person is not capable of doing so
- State law generally preempts federal law on parents’ vs. minors’ access
- When state or other law unclear, covered entity has discretion to provide or deny a parent with access to the minor’s health information if decision is made by licensed health care provider exercising professional judgment
- Parent/Guardian’s Authorityon PHI
- Parents are considered children’s Personal Representatives for decisions about PHI
- Guardian or other individual acting instead of a parent also qualifies
- Executor or Administrators for Deceased Person
- Personal Representative is considered decision-maker for deceased person’s PHI under HIPAA
- Limitations to Authority
- Areas where authority to act for an individual is limited or specified to particular health care decisions (e.g., a decision to discontinue life-support)
- Exceptions to Parent/Guardian’s Authority on PHI
- State law does not require consent of a parent for specific treatment (e.g., HIV testing, mental health services)
- Minor controls PHI associated with that treatment
- Court or other law determines someone besides the parent to make treatment decisions
- Other person or entity controls the PHI associated with the controlled treatment
- Sometimes it can be the minor themselves
- Parent agrees to a confidential relationship between a health care provider and a minor
- PHI is only granted if the minor authorizes parent
- Provider has “reasonable belief” child is being abused or has been abused or neglected
- Provider may opt not to disclose PHI to parent for safety of minor
- Documented Status
- Status must be stated explicitly
- Executed document(e.g., durable power of attorney)
- Legally-recognized relationship (e.g.,spouse, domestic partner)
- Verification of Authority
- Person’s authority understate law to act as patient’s Personal Representative must be verified