HIPAA / Medical Power of Attorney

HIIPA / Medical Power of Attorney by Fishbein Law Group

Understanding HIPAA’s Privacy Rules and Their Implementation

By Karen L Kahn 

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) established crucial privacy regulations that came into effect on April 14, 2003. These regulations, often called HIPAA’s Privacy Rules, set forth specific legal requirements, including the necessity of Powers of Attorney, the creation of Privacy Notices, and HIPAA-compliant authorizations. Navigating these regulations often requires legal expertise due to the interpretive nature of the rules and the various unresolved issues that arise. Below, we discuss some common challenges in implementing HIPAA’s Privacy Rules.

A. The Importance of a Medical Power of Attorney with HIPAA Consent

A Medical Power of Attorney (MPOA) that includes HIPAA consent language is essential for allowing your loved ones to communicate with healthcare providers on your behalf. Without this document, your family members may be unable to obtain vital information about your medical condition or make critical decisions for you during times when you are incapacitated. Therefore, ensuring you have a properly drafted MPOA with HIPAA consent is crucial to estate planning, particularly during medical emergencies.

B. Business Associate Agreements and Powers of Attorney

Drafting and reviewing Business Associate Agreements (BAAs) and Powers of Attorney (POAs) is complex. While the Department of Health and Human Services (DHHS) has provided a model BAA, most agreements are customized to meet the specific needs of individual clients. The covered entities and their legal representatives are responsible for ensuring these agreements meet all HIPAA requirements. Particular attention should be paid to provisions related to indemnification, compliance with access and amendment requirements for protected health information (PHI), and reciprocity provisions when the covered entity also acts as a business associate.

C. HIPAA-Compliant Medical Powers of Attorney and Authorizations

Creating HIPAA-compliant authorization forms is a challenge that healthcare providers, HR departments, and attorneys frequently face. Even when these forms meet HIPAA’s regulatory standards, some healthcare providers hesitate to release PHI without a BAA or POA that explicitly addresses HIPAA’s disclosure requirements. This cautious approach stems from a fear of violating HIPAA regulations, resulting in providers withholding medical records unless a properly drafted BAA or POA is in place.

 D. Accounting for Medical Disclosures

HIPAA mandates that healthcare providers and POA agents account for any disclosure of PHI unless it falls within one of the nine exceptions. However, there is considerable confusion about when these disclosures must be recorded. Some providers and business associates, unsure of the rules, have opted to record all disclosures, which is often impractical. Proper training and a clear understanding of the DHHS’s intentions are necessary to navigate these requirements effectively.

E. Strategic Considerations in Drafting Medical Powers of Attorney

Beyond simply having a Medical Power of Attorney, the strategy behind its language and provisions is crucial. One key consideration is whether the MPOA should become effective immediately upon signing or only upon the principal’s disability. Making the MPOA effective immediately can prevent delays, as the agent would not need to prove the principal’s disability before acting. Requiring a letter of incapacity or disability can add unnecessary hurdles during critical times, making immediate effectiveness a preferable option in many cases.

By carefully considering these aspects, you can ensure thorough HIPAA compliance and effective and efficient estate planning documents that protect your interests and those of your loved ones.