 |
 |
 |
HIPAA Privacy
Rule Adds Hurdles to
Administration of
Estates
By Renée C. Vidal,
Esquire
If you have obtained
birth or death
records from the
Pennsylvania
Department of
Health's Bureau of
Vital Statistics
within the last few
months, you have
undoubtedly learned
that it has become
more difficult. The
increase in
"security" of birth
and death records is
a result of the
Health Insurance
Portability and
Accountability Act (HIPAA)
of 1996 which
mandated the
adoption of national
standards for
electronic health
transactions, as
well as Federal
privacy protections
for individually
identifiable health
information,
referred to as
protected health
information.
In response to the
HIPAA mandate, the
U.S. Department of
Health and Human
Services enacted
regulations in the
form of the Privacy
Rule which became
effective on April
14, 2001 and
required compliance
by April 14, 2003
for most entities
covered by the rule.
The Privacy Rule
applies to health
plans, heath care
clearinghouses, and
health care
providers who
conduct certain
health care
transactions
electronically.
These covered
entities are
required to
implement standards
to protect and guard
against the misuse
of protected health
information.
Protected health
information is
information that is
generally
individually
identifiable health
information that is
transmitted by, or
maintained in,
electronic media or
any other form or
medium that relates
to 1) past, present
or future physical
or mental health or
condition of an
individual; 2)
provision of health
care to an
individual; 3)
payment for the
provision of health
care to an
individual; or 4)
the information
identifies or
provides a
reasonable basis to
believe it can be
used to identify an
individual.¹
The requirements of
the HIPAA Privacy
Rule apply to a
state health agency,
such as the
Pennsylvania
Department of
Health, if the
agency provides
health benefits,
operates clinics,
transmits health
information
electronically in
connection with a
transaction covered
by HIPAA, etc. that
causes it to be a
covered entity.²
Because the HIPAA
regulations require
covered entities to
evaluate practices
and implement
safeguards to limit
unnecessary or
inappropriate access
to and disclosure of
protected health
information,
obtaining death or
birth certificates
has become
increasingly
difficult for
practitioners to
assist clients in
administering
estates. A visit to
the Department of
Health's website³
reveals several
hurdles to obtaining
birth or death
records for clients.
To obtain birth
records, the person
making the request
must be the person
named on the record,
a legal
representative of
that person or an
immediate family
member. Persons
eligible to obtain
death records
include the legal
representative of
the decedent's
estate, an immediate
family member or an
extended family
member who is able
to show a direct
relationship to the
decedent. It does
not include the
attorney for the
estate.
These restrictions
are intended to
comply with the
HIPAA regulations.
Although there are
certain
circumstances under
which protected
health information
may be disclosed,*
such information is
generally protected
and only disclosed
when authorized by
the individual who
is the subject of
the information or
that person's
personal
representative.**
The HIPAA
regulations require
that a personal
representative with
legal authority to
act be treated the
same as the
individual for
purposes of the
Privacy Rule.*** A
personal
representative is a
person legally
authorized to make
health care
decisions on another
person's behalf or
legally authorized
to act on behalf of
a deceased
individual or the
individual's
estate.¹^ Thus,
personal
representatives
include executors,
administrators,
persons with health
care powers of
attorney and
parents, guardians
and persons acting
in loco parentis for
unemancipated
minors.²^
To ease procedures
in administering
estates, preparation
of an authorization
form to be executed
by executors or
administrators of
estates will save
time and hassle if
death or birth
records are needed.
The authorization
for disclosure
should be written in
plain language and
specifically state
the following:
That it authorizes
disclosure of
necessary birth and
death records of the
decedent or direct
relatives of the
decedent;
State the names of
the persons or
organizations who
will receive the
information;
State that the
purpose of the
request is for the
administration of
the decedent's
estate;
Notify the
executor/administrator
of his/her right to
refuse to sign the
authorization;
Be signed and dated
by the
executor/administrator;
Include an
expiration date or
event (such as upon
approval of the
accounting or
execution of a
family settlement
agreement);
Notify the
executor/administrator
of the right to
revoke the
authorization at any
time in writing and
how to exercise that
right and any
applicable
exceptions to that
right under the
Privacy Rule; and
Explain the
potential for the
information to be
re-disclosure by the
recipient and no
longer protected by
the Privacy Rule.³^
The impact of HIPPA
on the
administration of
estates will be an
increase in the
steps necessary for
counsel to assist
their clients in the
timely
administration of
estates. With
planning, the effect
can be minimized.
--------------------------------------------------------------------------------
¹ 45 CFR 164.501
² 45 CFR 160.103
³
www.health.state.pa.us
* For example,
disclosures of
protected health
information may be
made without
authorization from
the individual or
personal
representative to a
coroner or medical
examiner for the
purpose of
identifying a
deceased person,
determining the
cause of death or
other duties
authorized by law
and to a funeral
director as
necessary to carry
out their duties
with respect to a
decedent as is
consistent with
applicable law. 45
CFR
164.512(g)(1)-(2)
** 45 CFR
164.502(b);
164.514(d)
*** 45 CFR
164.502(g); see 45
CFR 164.510(b) for
situations where a
person is involved
in an individual's
health care, but is
not expressly
authorized to act on
the individual's
behalf.
¹^ 45 CFR
164.502(g)(2)-(4).
²^ 45 CFR
164.502(g).
³^ 45 CFR
164.508(c).
|
|
|
|
|
|
|
|
