HIPAA and it’s Estate Planning Implications

The Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) Privacy Rule contains many estate-planning considerations that may result in amendments to existing estate plans. The most notable concern is the impact on incapacity planning and the right to obtain information without going to court for it.

In a typical estate plan, the person will file a health care power of attorney form, if executed it gives their spouse or family member the power to make health care decisions for them. The person may also create a revocable living trust that provides that upon incapacity, the person’s spouse or other third party is appointed successor trustee for purposes of administering the trust assets during incapacity. A person may also execute a power of attorney for financial needs that becomes effective upon incapacity—the so-called “springing power of attorney.”

A well-prepared estate plan will avoid the involvement of the probate courts as much as possible. Under the HIPAA Privacy Rule, a “covered entity” may not be required to disclose protected health care information to the individual’s Health Care Proxy, successor Trustee or Attorney in Fact. A “covered entity” may also not disclose this information to the individual’s spouse or other family members. This term “covered entity,” means a health plan, a health care clearinghouse and a health care provider who transmits any health care information in connection with a transaction covered by the privacy rule. “Covered entity” also includes “business associates” of covered entities. A “business associate” is a person or organization, other than someone from the covered entity’s workforce, that performs certain functions or activities on behalf of, or provides certain services to, a covered entity (like data analysis, claims processing, and billing).

The HIPAA Privacy Rule contains a exception that permits a covered entity to disclose protected health care information to a person authorized to act on behalf of the individual in making health care related decisions. The HIPAA Privacy Rule calls this person the individual’s “personal representative.” It is important not to confuse the term “personal representative” under the HIPAA Privacy Rule and the term “personal representative” of a decedent’s estate. A “personal representative” of a decedent’s estate is the person who is appointed by the probate court to administer the decedent’s estate, while “personal representative” under the HIPAA Privacy Rule is the person who has authority to act on behalf of an individual in making decisions related to health care.

Essentially, there needs to be a separate authorization giving the person named as health care proxy, successor trustee, or attorney in fact the authority to obtain protected health information (e.g., doctor’s notes, etc.) and to re-disclose that information to the extent necessary and appropriate under the circumstances. Unfortunately, simply including this authorization in a health care proxy may not be sufficient. In some states, a health care proxy’s powers only become effective when the patient is unable to participate in medical treatment decisions. As a result, the health care proxy may not have the authority to exercise the HIPAA authorization to obtain the medical information.

If an individual does not specifically authorize a person to obtain and re-disclose this information, the individual successor trustee or attorney in fact may be forced to go to court to obtain this information, which essentially defeats the entire purpose behind planning for the individual’s incapacity.

Most revocable living trust agreements include a provision that the settlor’s physician or physicians need to review and make a recommendation concerning the settlor’s mental and physical condition. The term “settler” is one of the many terms (e.g., creator, grantor, trustor, etc.) used for the person who creates a trust. If the physician or physicians conclude that the settlor is incapacitated, then the trust becomes irrevocable and the successor trustee nominated under the trust agreement is appointed successor trustee during the period of incapacity. This type of provision may be unworkable under HIPAA because the successor trustee does not have the power to obtain medical information concerning incapacity. Under HIPAA, the settlor’s mental and physical condition cannot be disclosed unless there is a separate authorization appointing a “personal representative” to obtain the information. If the settlor has not executed an authorization, then the only recourse for the successor trustee is to commence a conservatorship proceeding in probate court to obtain the information.

If the so-called “springing power of attorney” is part of the estate plan, then the attorney in fact should also be appointed “personal representative” for purposes of the HIPAA Privacy Rule so that the attorney in fact can obtain this information.

It is also recommended that other legal documents be reviewed. For example, a partnership agreement may include a provision providing that upon incapacity of the general partner, a successor general partner is appointed. A buy-sell agreement may provide that upon incapacity, the individual shareholder’s shares are repurchased.

The bottom line is that all estate planning documents and other legal documents should be reviewed and, if appropriate, revised to include the appointment of a “personal representative” for purposes of obtaining information under the HIPAA Privacy Rule. The review may result in amendments to existing documents and/or the creation of a separate authorization appointing the successor trustee, health care proxy and/or attorney in fact as “personal representative” under the HIPAA Privacy Rule.