631.405.4857 
June 2017
Jennifer B. Cona, Esq.
Discussing health care wishes, the appointment of agents, and the intricacies of health and family dynamics are a part of any Elder Law practice. Most lawyers, regardless of field, are aware of the Health Insurance Portability and Accountability Act (HIPAA) and some may be familiar with the Family Health Care Decisions Act (FHCDA), but how do the two relate and what does it mean for a family who wishes to access medical records on behalf of their loved one?
ACCESS TO MEDICAL INFORMATION UNDER HIPAA
The Health Insurance Portability and Accountability Act (HIPAA) is designed to, inter alia, enable an individual to access his or her own medical records (with certain exceptions), as well as protect the confidentiality of health information (the "Privacy Rule" of HIPAA).
The Privacy Rule does not require a health care provider to share information with family members or friends (unless that person is a “personal representative”, such as a guardian or health care agent appointed under a valid Health Care Proxy), but HIPAA generally permits medical care providers to disclose information to family members and others involved in the patient's health care in limited circumstances.
Disclosures to Family Members: A Matter of Professional Judgment
In cases where the patient is present and able to make decisions, the provider must (i) obtain the patient’s permission or (ii) reasonably infer from the circumstances that the patient does not object to the disclosure of medical information to the third party/family member/loved one.[i] The Privacy Rule expressly permits a medical care provider or plan to use professional judgment and experience with common practice to make reasonable inferences about the patient's best interests in allowing another person to act on behalf of the patient as it relates to his or her receipt of protected health information.
If the patient is not present or is unable to consent, the provider may disclose the information so long as: (i) the provider believes it is in the patient’s best interest to make the disclosure; (ii) the patient has not otherwise objected to such disclosures; and (iii) the provider limits the information disclosed to that which is relevant to the family member or other person’s involvement in the patient’s health care.[ii] For example, if the patient does not object, a physician may talk with the friend who accompanies the patient to the hospital or with a family member who pays the patient’s medical bill. Thus, the medical provider's professional judgment as to what he or she infers to be the patient's desired level of access to information to the friend or family member becomes a key part in determining which information may or may not be disclosed.
Consider the following examples: Son drives his mother to her doctor appointment. The mother asks the son to come into the treatment room with her. The doctor may discuss the mother’s medical information and treatment with the son in this case, as it may be inferred that the mother consents to this disclosure by virtue of having invited the son into the treatment room. Similarly, a medical professional may give information about a patient's mobility limitations to a friend who is driving the patient home from the hospital, as the medical professional may infer that the patient would not object since the patient has enlisted the friend’s services in getting home from the hospital.
Note that whereas a medical provider cannot refuse to provide the patient with his or her own requested medical records or information, HIPAA does not create any obligation to disclose information to other individuals. Rather, HIPAA merely provides that the medical professional may disclose information in his or her professional judgment. As such, it is important for our clients, often the adult children of elderly patients, to understand that they are not automatically entitled to medical information or access to records. It is squarely within the medical professional’s judgment and discretion.
Disclosures to the Personal Representative
HIPAA allows health care providers to disclose protected health information to the patient’s personal representative; a personal representative generally has the right to access a patient’s personal health information to the same extent as the patient.[iii] For purposes of HIPAA, a “personal representative” is the person with authority under applicable state law to make health care decisions for the patient.[iv]
HIPAA allows health care providers to use or disclose protected health information without the patient’s authorization for purposes of treating a patient.[v] Consider this example: An adult daughter from out of state visits her father in the hospital. The daughter is not involved in the father’s life and does not know his medical conditions or medications. Medical professionals may disclose that the father is insulin dependent because the daughter will be taking the father home and will either need to administer the insulin shots or hire a visiting nurse to do so. Such disclosure is permissible, as the information is necessary for proper care of the father upon his discharge from the hospital.
There are limitations, however. First, a provider may not make such disclosures if he has agreed otherwise with the patient, such as where the patient has expressed that no information should be disclosed to a specific person, or where the provider told the patient that he would only disclose information to those persons identified by the patient.[vi] Second, providers generally may not disclose psychotherapy notes without the patient’s written authorization.[vii] Third, providers may not disclose information if a more restrictive law prohibits disclosure, such as state or federal laws relating to substance abuse programs.
ACCESS TO MEDICAL RECORDS UNDER FHCDA
The Family Health Care Decisions Act (FHCDA) applies to a person over the age of 18 who is in a hospital or nursing home, and who is determined by an attending physician to be unable by reason of his or her illness to participate in making health care decisions about his or her own care.
If the patient is determined to be incapacitated and there is no governing Health Care Proxy, then a decision-making health care Surrogate is designated pursuant to the terms of the FHCDA. The potential individuals to be designated Surrogate are listed in order of priority:
(1) Court-appointed Guardian for an already determined Incapacitated Person
(2) Spouse or domestic partner
(3) Child over the age of 18 years
(4) Parent
(5) Sibling over the age of 18 years
(6) Close friend or relative who has maintained such regular contact with the patient as to be familiar with the patient's activities, health, and religious or moral beliefs
Only one individual may be designated as the Surrogate. This can render the patient and the concerned child(ren) vulnerable to complicated family dynamics in the case where multiple interested family members have the same level of priority. If there is disagreement among individuals as to who should be the Surrogate and each competing individual has the same priority designation as set forth above, the hospital will review the matter before an ethics committee to make a determination as to who should be designated Surrogate. If there is further disagreement, or if there is disagreement as to the determination of the patient's incapacity, they may go before the Court in a special proceeding to review same.
As the Surrogate will have the authority to make all health care treatment decisions, he or she must be provided access to the patient's medical records and information regarding medical conditions and prognoses. Additionally, the Surrogate becomes the patient's "Personal Representative" under HIPAA, which entitles the Surrogate to the same rights as the patient as it relates to disclosure of medical records and information.
This order of priority under the FHCDA can be problematic in blended families with second marriages. The current spouse supersedes the patient's children in the order of priority and as such, the patient's adult children may be prevented from receiving access to the patient's medical records. This can go as far as the children being blocked from information as to which hospital or rehabilitation facility the parent is in, how long he or she has been there, what the parent’s condition and diagnoses are, and even whether the parent’s condition is deteriorating.
In the case of an adult child who is genuinely concerned for the welfare of the parent and where access to health information is otherwise blocked, a guardianship proceeding may, at a minimum, enable the intervention of trained third parties (i.e. court evaluator, judge) who may independently investigate the matter. In the event the adult child is designated Personal Needs Guardian, the child would become the Surrogate under FHCDA as well, superseding the spouse's authority, and would gain access to the health care records for the purpose of addressing the parent's current and future health needs.
Of course, the best way to avoid an inability to access medical information and/or decision-making disputes is through the execution of advance directives, such as a Health Care Proxy and a Power of Attorney naming appropriate agents and authorizing the release of medical records to such designated persons. With some advance planning, parents can be sure that the individuals with whom they are comfortable will be making health care decisions and adult children will know that important decisions will not be left to chance.
Jennifer B. Cona is the managing partner of Cona Elder Law PLLC. Ms. Cona practices exclusively in the field of Elder Law and Trusts and Estates, including representing older adults and their families in connection with Medicaid planning, preservation of assets, estate planning, estate litigation, probate and administration of estates, special needs planning, Veterans benefits and guardianships. Ms. Cona wishes to thank Dana Walsh Sivak, Esq. for her assistance in writing this article.
[i] 45 CFR 164.510(b)(2).
[ii] 45 CFR 164.510(b)(3).
[iii] 45 CFR 164.502(a)(2)(i) and (g).
[iv] 45 CFR 164.502(g).
[v] 45 CFR 164.506.
[vi] 45 CFR 164.522(a).
[vii] 45 CFR 164.508(a)(2).
