HIPPA – Who gets to access to your medical records?
One overlooked planning area for digital assets is privacy rights generally but specifically, the patient’s medical records. Prior to 2013, the patient’s privacy rights lasted through death and in perpetuity. Now, privacy protection remain in place at a federal level for 50 years form the date of death but individual state laws can provide additional privacy protection and the various health care providers might require longer protection.
After death, the legally authorized executor or administrator, or whomever is designated on the decedent’s living will or Health Care Proxy can exercise the privacy rights on their behalf. Often, however, there can be a conflict between the parties named as executor and those holding the health care proxy. There are some disclosures that do not require consent or authorization – the government can get the information as needed, the funeral directors etc., can get information necessary to do their job and if information is relevant to the care of the surviving spouse, the spouse can force disclosure of the information to their health care provider.
Things can get complicated when there are blended families, same-sex marriages that may not be recognized in the state where the death occurred or the records are placed, and when the authorizations between the decedent’s will (or revocable trust) differ from the health care proxy. Often there is little though as to the disposition of medical records because the decedent is thinking about other issues, such as who is best equipped to address financial concerns, or who do I want pulling my plug if I am comatose. However, it is worthwhile to put consider adding language to the HIPPA documentation to address post-mortem access to information.
For example, if you have children from a prior marriage, your spouse might have control over the medical records after your death and, indeed, the HIPPA law now provides that a spouse can gain direct information of information where it is relevant to their ongoing care but there is no similar provision permitting children of a decedent to obtain the same information. Further, while the HIPPA Privacy Rule does provide some clarity as to who may access your records, the health care provider has discretion to refuse access in their judgment (HIPPA Privacy Rule 164-502(g)(4) & (5).) .
With the rise of online medical records and medical information, from your doctor’s offices to health insurance providers and even to the various apps on your phone, the information stored might be of vital interest to a family member at a later date. A few sentences in a HIPPA standard form could make release of information easier for all involved.
Under Useful Links for HIPPA
World Privacy Forum Summary on HIPPA Rules
Dept of HHS HIPPA Privacy Rules