Elder Law Newsletter
Estate Planning Under the HIPAA Privacy Rule
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) became effective on April 14, 2003. HIPAA establishes national standards for the protection of certain health information. The purpose of HIPAA is to ensure that a patient’s confidential health information or “protected health information” (PHI) is protected from unauthorized dissemination. The Privacy Rule applies to any health care provider that transmits or disseminates health information, assessing penalties for failing to comply, and could potentially result in rendering certain estate planning documents ineffective.
Authorized Use and Disclosure of Protected Health Information
The Privacy Rule authorizes dissemination of PHI without an individual’s written authorization in the following instances:
- To the individual who is the subject of the information
- To payment, treatment and health care operations
- For uses and disclosures with an opportunity for the patient to agree or object, such as permission from the patient to release information to friends or relatives
- For incidental use and disclosure, provided the information disseminated was limited to the “minimum necessary” under the Privacy Rule
- For public interest and benefit activities, including but not limited to, disclosure to public health authorities for the prevention or control of disease, to law enforcement, or for judicial or administrative proceedings
Any use or disclosure of PHI other than those noted above require the individual’s written authorization, specifically including the following:
- Describing the information to be disclosed
- The person(s) disclosing and receiving the information
- Duration of the validity of the authorization
- A statement that the individual may revoke the authorization by a subsequent writing
Penalties for Failure to Comply with Privacy Rules
Health care providers face fines of $100 per violation, up to a maximum of $25,000 per year, for multiple violations of the same Privacy Rule requirement. Any person who knowingly obtains and disseminates PHI faces a fine of $50,000 and up to one year in prison. If the PHI was obtained under false pretenses, the penalty increases to a fine of $100,000 and up to five years of imprisonment. If the PHI was procured or disseminated for commercial advantage, personal gain, or with the intent to cause malicious harm, the fine increases to $250,000 and up to ten years of imprisonment.
Effect of Privacy Rule On Estate Planning Documents
Health care providers are understandably concerned about the transmission of PHI and the penalties for violating the Privacy Rule. Many health care providers are reluctant to disseminate PHI without the express written authorization of the patient. This poses a potential problem for individuals who have executed health care powers of attorney or advance health care directives (documents which allow an individual to appoint an agent to make medical decisions on their behalf in the event the individual is incapacitated or otherwise unable to communicate his or her wishes).
A well-prepared health care power or directive should contain a statement authorizing the release of the individual’s medical information to the designated health care agent. The health care provider may, however, be reluctant to release such information without an express statement in the document that PHI may be transmitted under the HIPAA Privacy Rule. Since the need to exercise the authority to make medical decisions under the health care power or directive usually arises during an emergency or medical crisis, it is important that the health care provider accept the authorization provided in the document without question.
Some estate planning practitioners are modifying health care powers of attorney or advance health care directives to expressly state that the health care agent named in the document is authorized to receive PHI in accordance with the HIPAA Privacy Rule. Consult an estate planning attorney regarding whether an existing health care power of attorney or advance health care directive should be modified to comply with the HIPAA Privacy Rule.
© 2024 NextClient.com, Inc. All rights reserved.
