The HIPAA Privacy Rule

The Health Insurance Portability and Accountability Act, commonly known as HIPAA, was enacted in 1996, to address concerns over unfretted access to individual medical information.  The law provided for sweeping new requirements regarding medical privacy, most of which were well intentioned and necessary. Unfortunately, as with most cumbersome federal enactments, HIPAA has had certain unintended consequences. One such consequence is the lack of predictability by which medical information will be shared with one’s family.

Sorry ma’am, we can’t give you that information—it’s private.

Most people, if asked, would say that if they were ever lying in a hospital bed, incapacitated, they would want a doctor to talk to their family about what was going on. That seems reasonable. However, under HIPAA, this result is less than certain. Under the privacy rule, if a patient is not present or is incapacitated, a health care provider is not required to share a patient’s information with the family. Rather, the provider may share the patient’s information with family only if they first determine that it is in the best interest of the patient. A provider may choose to wait until the patient has an opportunity to agree to disclosure, and thereby refuse to discuss anything with the family. The rules are even stricter for sharing information with individuals that are unrelated to the patient. Finally, the provider may discuss only the information that the provider determines the family needs to know.

In most cases this probably isn’t a problem. We can hope that doctors, nurses, hospital staff, and health plan providers will exercise their judgment in a way that is objectively reasonable.  However, in today’s world of anonymity and legal liability, reasonableness is fleeting. Today, it is not far-fetched to imagine a conversation with hospital staff that consists primarily of, “sorry ma’am, we can’t give you that information.” In fact, many of us have had this very conversation.

There is a way to take back control. In a legal document called a Durable Power of Attorney for Health Care, a client can re-insert reasonableness, and bring HIPAA- frenzied health care providers back down to earth. This document, when properly drafted and executed, clearly directs providers to freely communicate with certain members of your family, usually your spouse. The document re-inserts predictability and allows peace of mind for clients who might one day find themselves in this situation. I encourage most of my married clients to consider a durable Power of Attorney for Health Care.

-Evan Jones, Attorney