We like to bust myths about HIPAA!
Lately we have noticed confusion about who may receive an individual’s information in a health care setting, and who may make decisions about someone else’s health care.
Myth: Only a legally documented personal representative may be involved in a patient’s health care and receive information.
Reality: Health care professionals may speak to family and friends without formal legal documentation as long as the patient agrees or doesn’t object.
Reality: A Personal Representative stands in the shoes of the patient and makes health care decisions, a much bigger role than simply being involved in the patient’s care.
Family, Friends and a Personal Representative
When patients receive health care, they often have family and friends present who need to be informed so they can support the patient. Although the HIPAA Privacy Rule protects patient privacy it also permits health care providers to disclose information to anyone that the patient has agreed my receive information. Patients will often want close family, friends, and even neighbors to receive information.
A patient may also have a “Personal Representative”, who can make decisions about the patient’s care – this role is very different from someone who may be involved in care and simply receives information.
How Does a Health Care Provider Know Whether to Talk With Family and Friends?
It’s simple – the patient agrees – and it does not need to be in writing.
Often a health care provider will obtain the patient’s consent or agreement to speak to family or friends in advance on an intake form, but it is not necessary to do this in advance. In emergency situations for example, there may not be time to obtain written consent in advance. HIPAA requires that individuals be given the right to agree or object, if possible.
In emergency situations there are two options.
- A health care professional may orally ask the patient “may I speak to your spouse (son, daughter, neighbor) about your situation?”
- If the patient is unconscious or unable to answer, a health care professional may use his or her professional judgment to infer that the patient would not object.
In both cases the health care professional should discuss only the minimum necessary information required for that person’s role in the care. Qs and As about common situations can be found here.
Note that the discussion above only relates to providing information to family and friends, and does not mean that family and friends who may hear information may also make decisions on behalf of the patient. Only someone named a Personal Representative may make decisions.
A Personal Representative May Make Decisions
“Personal Representative” under HIPAA means a person who has legal authority to make decisions related to health care for an individual. Examples are a spouse or other family member named in a health care power of attorney, a parent or legal guardian of a minor, a person appointed by a court to serve as custodian, guardian or conservator and an executor, administrator, or other person with authority to act on behalf of a deceased individual.
The role of Personal Representative is much more significant than that of a family member who only receives information. A Personal Representative essentially stands in the shoes of the individual they represent and acts for them, decides for them. Under HIPAA they are treated the same as the individual and may receive, use and disclose the individual’s protected health information.
The extent of a Personal Representative’s authority to act may be comprehensive or limited, depending on applicable law. For example, a Personal Representative who is named in a health care Power of Attorney to make a decision limited to discontinuing life support may not make any other decisions related to the individual’s health care because scope of their authority to act is limited to a single issue.
HIPAA Violation Tip: It is essential for a health care provider to verify and document a Personal Representative’s identity and the scope of their authority.
The Advance Directive (Living Will) and a Health Care Power of Attorney
A full discussion of advance directives (or Living Wills) and health care powers of attorney is beyond the scope of this blog, but two items of note:
- An advance directive may put decision-making authority into the hands of physicians caring for the patient at the end of life, without requiring family to make decisions, OR it may be written to include family members in decision-making.
- A health care power of attorney may be comprehensive, allowing the person appointed to make all health care decisions (usually after a medical certification of incapacity) or it may be limited to decisions about discontinuing life support.
It is not necessary for someone to be named a Personal Representative for them to be involved in an adult patient’s care. In fact, the Personal Representative role is so significant, essentially causing them to be treated the same as the individual under HIPAA, it should be reserved only for situations where the adult individual is incapacitated or incompetent and unable to act for themselves. Otherwise the risk of compromised patient autonomy and privacy is too high.
The HIPAA E-Tool® explains everything you need to know about talking with family and friends, and when necessary, how to communicate with a patient’s Personal Representative.
The key with family and friends is to follow the patient’s wishes – you can and should engage with them when they’re involved in the patient’s care. If a Personal Representative is present, verify their identity and the scope of their authority, and engage as fully as their authority requires.
