When doing estate planning, common documents include a last will, living trust, living will, financial power of attorney (POA), and medical durable power of attorney. HIPAA authorization is another important form.
A medical durable power of attorney gives the agent the power to make decisions regarding medical treatment in the event that the principal is incapacitated and unable to make or communicate his/her own medical decisions.
A valid HIPAA authorization is a signed document that includes the core elements and statements required in paragraphs 45 CFR § 164.508 (a)(3)(ii), (c)(1), and (c)(2), as applicable.
HIPAA Privacy Rule
Medical records contain confidential, personal health information. The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule establishes national standards to protect medical records and other personal health information and applies to health plans, health care clearinghouses, and those health care providers that conduct certain health care transactions electronically.
The HIPAA Privacy Rule 45 CFR § 164.510 requires appropriate safeguards to protect the privacy of personal health information (PHI) and sets limits and conditions on the uses and disclosures that may be made of such information with or without patient authorization.
The Rule also gives patients rights over their health information, including rights to examine and obtain a copy of their health records and to request corrections.
HIPAA Security Rule
The HIPAA Security Rule 45 CFR § 164.302 requires safeguards to protect electronic personal health information (EPHI).
In order to make informed medical decisions on behalf of an incapacitated principal, the principal must authorize the agent to inspect or receive copies of the relevant medical records.
Doctors, hospitals, and other healthcare providers may refuse to provide an agent or other third party with access to private medical records unless a HIPAA authorization form has been signed by the principal. The medical facility may have an authorization form or contact a health care attorney for a HIPAA form or legal advice. Beware of using free online forms that may be obsolete, unsuitable or defective.
Medical Power of Attorney
Check your medical power of attorney form. It may already contain a HIPAA authorization section. If not, you may need to complete a separate authorization form to allow a designated agent or other party to inspect or receive copies of your medical records. Your agent must also take care to safeguard your medical records to keep them private.
Disclaimer: This information is not legal advice.
[Last-Modified Date 2020-02-17] added links to CFR HIPAA Privacy Rule and Security Rule