Stricter HIPAA Enforcement: What Will It Mean For Your Firm’s Advance Directive Documents?

Last month, I wrote about how the U.S. Department of Health and Human Services has begun enforcing HIPAA by imposing large financial penalties against healthcare providers for HIPAA violations. (In the first case, a healthcare provider received a $4.3 million civil penalty for failing to provide timely personal health information to patients upon their request; in the other, a different provider agreed to a $1 million settlement for disclosing patients’ personal health information without their approval.)

What will be the fall-out for you and your clients from this new enforcement? If healthcare entities intensify their efforts to avoid HIPAA financial penalties, we may see a few things happen:

• Patients themselves may have an easier time gaining access to their own medical information. And some may even get it more quickly. At the same time;
• Patients’ family Members — and others whom the patient wants to have access — may have a harder time getting the patients’ information.

What does this mean for your clients’ legal needs?

1. Clients need a Health Care Power of Attorney (HCPOA) more than ever. This document may increasingly do double-duty. In addition to its primary function, the HCPOA also serves as a de facto HIPAA Release, even if you haven’t specified this in the document. The HIPAA law expressly authorizes the health care agent to receive the patient’s personal health information (called “PHI” under HIPAA).
2. Clients may increasingly need a separate HIPAA Release designating individual(s) — in addition to the health care agent — who can receive their medical information. Why? Clients often rely on someone other than their health care agent to help them navigate the healthcare system. This might be another family member, a friend, or a neighbor. Healthcare providers may be increasingly apt to request written authorization from the patient to deal with any of these folks on your client’s behalf. (If you are getting feedback to this effect from your clients, please let me know.)
   
   Alternatively, some firms are addressing this need within their HCPOA document itself, rather than drafting a separate HIPAA Release. They are creating a section in the HCPOA naming additional individuals to receive PHI under HIPAA, but who are not authorized as health care agents. (I’d like to report back on the trend in how attorneys are handling this. Please share your approach with me at rsiegel@docubank.com.)

The stricter HIPAA enforcement may also create heightened challenges particular to college students and other young adults. More on this in another post.

Randi J. Siegel, MBA, is the President of DocuBank, the largest advance directives registry in the U.S., which ensures that the healthcare directives of its 190,000 enrollees are immediately available 24/7/365. Working with estate planning professionals since 1997, Randi frequently speaks at national estate planning conferences and has appeared on radio and television as an authority on registries. She is active in health policy pertaining to advance directives and serves as a Senior Fellow at the Jefferson School of Population Health in Philadelphia. Randi is an ongoing contributor to the Academy blog.

Academy Guest Blogger
American Academy of Estate Planning Attorneys, Inc.
6050 Santo Rd Ste 240
San Diego, CA 92124
(800) 846-1555
www.aaepa.com