Compiled by Kenneth A. Vercammen
A federal regulation known as the Health Insurance Portability and Accountability Act (HIPAA) was recently adopted regarding disclosure of individually identifiable health information. This necessitated the addition of a special release and consent authority to all healthcare providers before medical information will be released to agents and interested persons of the patients. The effects of HIPAA are far reaching, and can render previously executed estate planning documents useless, without properly executed amendments, specifically addressing these issues. As HIPAA affects not only new documents, any previously executed documents are affected as well. Any previously executed Powers of Attorney, Living Wills, Revocable Living Trusts, and certainly all Medical Directives now require HIPAA amendments.
The following information was provided by the American Medical Association (AMA).
Today, state and federal laws also attempt to ensure the confidentiality of this sensitive information. The federal government recently published regulations designed to protect the privacy of your health information. This ³privacy rule² protects health information that is maintained by physicians, hospitals, other health care providers and health plans. As of April 14, 2003, your physician will need to comply with the privacy rule¹s standards for protecting the confidentiality of your health information.
This new regulation protects virtually all patients regardless of where they live or where they receive their health care. Every time you see a physician, are admitted to the hospital, fill a prescription, or send a claim to a health plan, your physician, the hospital and health plan will need to consider the privacy rule. All health information including paper records, oral communications, and electronic formats (such as e-mail) are protected by the privacy rule.
Patient: When my family member comes to pick me up from the hospital, the doctor will still be able to explain my condition and tell him what to expect when I return home. Right? True! The Rule permits doctors to discuss a patient¹s condition with family or friends involved in the person¹s care, unless the patient objects.
Patient: The privacy rule prevents a friend or family member from picking up prescriptions for me. Now I¹ll have to get out of my sick bed to get my medicine. False! The Rule allows a pharmacist to use professional judgment and experience with common practice to make reason-able inferences of the patient¹s best interest in allowing a person, other than the patient, to pick up a prescription.
Family The Privacy Rule would have prevented me from finding out information about my son Member: in a hospital in New York on September 11. False! The Rule permits hospitals and disaster relief agencies to notify family members that a loved one has been admitted to a hospital or has been involved in a disaster.
New national health information privacy standards have been issued by the U.S. Department of Health and Human Services (DHHS), pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The new regulations provide protection for the privacy of certain individually identifiable health data, referred to as Protected Health Information (PHI).
The shift of medical records from paper to electronic formats has increased the potential for individuals to access, use, and disclose sensitive personal health data. Although protecting individual privacy is a long-standing tradition among health-care providers and public health practitioners in the United States, previous legal protections at the federal, tribal, state, and local levels were inconsistent and inadequate. A patchwork of laws provided narrow privacy protections for selected health data and certain keepers of that data
Among other provisions, the Privacy Rule
* gives patients more control over their health information; * sets boundaries on the use and release of health records; * establishes appropriate safeguards that the majority of health-care providers and others must achieve to protect the privacy of health information; * holds violators accountable with civil and criminal penalties that can be imposed if they violate patients' privacy rights; * strikes a balance when public health responsibilities support disclosure of certain forms of data;
* enables patients to make informed choices based on how individual health information may be used; * enables patients to find out how their information may be used and what disclosures of their information have been made; * generally limits release of information to the minimum reasonably needed for the purpose of the disclosure; * generally gives patients the right to obtain a copy of their own health records and request corrections; and * empowers individuals to control certain uses and disclosures of their health information.
Who Is Covered
Covered entities are as follows:
* Health plans. An individual or group plan that provides, or pays the cost of, medical care that includes the diagnosis, cure, mitigation, treatment, or prevention of disease. Health plans include private entities (e.g., health insurers and managed care organizations) and government organizations (e.g., Medicaid, Medicare, and the Veterans Health Administration). * Health-care clearinghouses. A public or private entity, including a billing service, company, or community health information system, that processes nonstandard data or transactions received from another entity into standard transactions or data elements, or vice versa. * Health-care providers. A provider of health-care services and any other person or organization that furnishes, bills, or is paid for health care in the normal course of business. Health-care providers (e.g., physicians, hospitals, and clinics) are covered entities if they transmit health information in electronic form in connection with a transaction for which a HIPAA standard has been adopted by DHHS.
The Privacy Rule also establishes requirements for covered entities with regard to their nonemployee business associates (e.g., lawyers, accountants, billing companies, and other contractors) whose relationship with covered entities requires sharing of Protected Health Information (PHI). The Privacy Rule allows a covered provider or health plan to disclose Protected Health Information (PHI) to an attorney or business associate if satisfactory written assurance is obtained that the attorney or business associate will use the information only for the purposes for which it was
engaged, will safeguard the information from misuse, and will help the covered entity comply with certain of its duties under the Privacy Rule.
The Privacy Rule does not apply to all persons or entities that regularly use, disclose, or store individually identifiable health information. For example, the Privacy Rule does not cover employers, certain insurers (e.g., auto, life, and worker compensation), or those public agencies that deliver social security or welfare benefits, when functioning solely in these capacities.
Protected Health Information
The Privacy Rule protects certain information that covered entities use and disclose. This information is called protected privacy, which is generally individually identifiable health information that is transmitted by, or maintained in, electronic media or any other form or medium. This information must relate to 1) the past, present, or future physical or mental health, or condition of an individual; 2) provision of health care to an individual; or 3) payment for the provision of health care to an individual. If the information identifies or provides a reasonable basis to believe it can be used to identify an individual, it is considered individually identifiable health information.
Required Protected Health Information (PHI) Disclosures
A covered entity is required by the Privacy Rule to disclose protected privacy in only two instances: 1) when an individual has a right to access an accounting of his or her protected privacy (see previous paragraph); and 2) when DHHS needs protected privacy to determine compliance with the Privacy Rule [45 CFR § 164.502(a)(2)]. Certain other uses and disclosures of protected privacy may be permitted without authorization, but are not required by the Privacy Rule. However, other federal, tribal, state, or local laws may compel disclosure.
Permitted Protected Health Information (PHI) Disclosures Without Authorization
The Privacy Rule permits a covered entity to use and disclose Protected Health Information (PHI), with certain limits and protections, for TPO activities [45 CFR § 164.506]. Certain other permitted uses and disclosures for which authorization is not required follow. Additional
requirements and conditions apply to these disclosures. The Privacy Rule text and OCR guidance should be consulted for a full understanding of the following:
* Required by law. Disclosures of protected privacy are permitted when required by other laws, whether federal, tribal, state, or local. * Public health. Protected privacy can be disclosed to public health authorities and their authorized agents for public health purposes including but not limited to public health surveillance, investigations, and interventions. * Health research. A covered entity can use or disclose protected privacy for research without authorization under certain conditions, including 1) if it obtains documentation of a waiver from an institutional review board (IRB) or a privacy board, according to a series of considerations; 2) for activities preparatory to research; and 3) for research on a decedent's information. * Abuse, neglect, or domestic violence. Protected privacy may be disclosed to report abuse, neglect, or domestic violence under specified circumstances. * Law enforcement. Covered entities may, under specified conditions, disclose protected privacy to law enforcement officials pursuant to a court order, subpoena, or other legal order, to help identify and locate a suspect, fugitive, or missing person; to provide information related to a victim of a crime or a death that may have resulted from a crime, or to report a crime. * Judicial and administrative proceedings. A covered entity may disclose protected privacy in the course of a judicial or administrative proceeding under specified circumstances. * Cadaveric organ, eye, or tissue donation purposes. Organ- procurement agencies may use protected privacy for the purposes of facilitating transplant. * Oversight. Covered entities may usually disclose protected privacy to a health oversight agency for oversight activities authorized by law. * Worker's compensation. The Privacy Rule permits disclosure of work- related health information as authorized by, and to the extent necessary to comply with, workers' compensation programs.
Other Authorized Disclosures
A valid authorization is required for any use or disclosure of Protected Health Information (PHI) that is not required or otherwise permitted without authorization by the Privacy Rule. In general, these authorizations must
* specifically identify the protected privacyto be used or disclosed; * provide the names of persons or organizations, or classes of persons or organizations, who will receive, use, or disclose the protected privacy; * state the purpose for each request; * notify individuals of their right to refuse to sign the authorization without negative consequences to treatment, payment, or health plan enrollment or benefit eligibility, except under specific circumstances; * be signed and dated by the individual or the individual's personal representative; * be written in plain language; * include an expiration date or event; * notify the individual of the right to revoke authorization at any time in writing, and how to exercise that right, and any applicable exceptions to that right under the Privacy Rule; and * explain the potential for the information to be subject to redisclosure by recipient and no longer protected by the Privacy Rule.
The Privacy Rule and Public Health
The Privacy Rule recognizes 1) the legitimate need for public health authorities and others responsible for ensuring the public's health and safety to have access to protected privacy to conduct their missions; and 2) the importance of public health reporting by covered entities to identify threats to the public and individuals. Accordingly, the rule 1) permits protected privacy disclosures without a written patient authorization for specified public health purposes to public health authorities legally authorized to collect and receive the information for such purposes, and 2) permits disclosures that are required by state and local public health or other laws.
However, because the Privacy Rule affects the traditional ways protected privacy is used and exchanged among covered entities (e.g., doctors, hospitals, and health insurers), it can affect public health practice and research in multiple ways. To prevent misconceptions, understanding the Privacy Rule is important for public health practice.
Part of Kenneth Vercammen¹s Power of Attorney, modified in 2004
Grant of Authority. I appoint You to act as my Agent (called an attorney in fact) to do each and every act which I could personally do for the following uses and purposes:
1. REAL ESTATE: To execute all contracts, deeds, bonds, mortgages, notes, checks, drafts, money orders, and to lease, collect rents, grant, bargain, sell, or borrow and mortgage, and to manage, compromise, settle, and adjust all matters pertaining to any real estate or lands in which I have an interest. This includes the power to sell all land I own.
2. ENDORSEMENT AND PAYMENT OF NOTES, ETC.: To make, execute, endorse, accept, and deliver any and all bills of exchange, checks, drafts, notes and trade acceptances. To pay all sums of money, at any time, or times, that may hereafter be owing by me upon any bill of exchange, check, draft, note, or trade acceptance, made, executed, endorsed, accepted, and delivered by me, or for me, and in my name, by my Agent.
3. MEDICAL RECORDS ACCESS: To be able to access my medical and hospital records under Federal Law HIPAA. Healthcare providers shall release medical information to my agent.
4. STOCKS, BONDS, AND SECURITIES: To sell any and all shares of stocks, bonds, or other securities now or hereafter, belonging to me, that may be issued by an association, trust, or corporation whether private or public, and to make, execute, and deliver any assignment, or assignments, of any such shares of stock, bonds, or other securities.
5. CONTRACTS, AGREEMENTS, ETC.: To enter into safe deposit boxes, and to make, sign, execute, and deliver, acknowledge, and perform any contract, agreement, writing, or thing that may, in the opinion of my Agent, be necessary or proper to be entered into, made or signed, sealed, executed, delivered, acknowledged or performed.
6. BANK ACCOUNTS, CERTIFICATES OF DEPOSIT, MONEY MARKET ACCOUNTS, ETC.: To add to or withdraw any amounts from any of my bank accounts, Certificates of Deposit, Money Market Accounts, etc. on my behalf or for my benefit. To make, execute, endorse, accept and deliver any and all checks and drafts, deposit and withdraw funds, acquire and redeem certificates of deposit, in banks, savings and loan associations and other institutions, execute or release such deeds of trust or other security agreements as may be necessary or proper in the exercise of the rights and powers herein granted; Without in any way being limited by or limiting the foregoing, to conduct banking transactions as set forth in section 2 of P.L. 1991, c. 95 (c. 46:2B-11).
7. TAX RETURNS, INSURANCE AND OTHER DOCUMENTS: To sign all Federal, State, and municipal tax returns, insurance forms and any other documents and to represent me in all matters concerning the foregoing.
8. GIFT GIVING POWERS: To make gifts in amounts which my agent in his sole, absolute and unfettered discretion shall deem appropriate in any given year on my behalf.
Powers. I give you all the power and authority which I may legally give to You. You may revoke this Power of Attorney. I approve and confirm all that You or your substitute may lawfully do on my behalf.
The following is a portion of a form Kenneth Vercammen uses in personal injury cases.
HIPAA Authorization to Disclose Patient Information
Purpose: This form is to be used for including, but not limited to: patient¹s telephone, fax or mail requests for films, reports or disclosures and for non-TPO requests such as lawyers, clergy, employers, schools or for marketing or research purposes.
I ________________ hereby authorize ______________ to disclose my health information described below to:
Recipient¹s Name: Kenneth Vercammen & Associates, PC Recipient¹s Address: 2053 Woodbridge Avenue, Edison, NJ 08817 Recipient¹s Telephone Number: (732) 572-0050
Films/Documents/Information to Be Released:
___________________________________________
Purpose of Disclosure (explain or indicate at the request of the individual): PERSONAL INJURY LAWSUIT
There is no expiration date on this authorization. I understand that the terms of this authorization are governed by the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (HIPAA). I understand that I have the right to revoke this authorization, at any time prior to your compliance with the request set forth herein, provided that the revocation is in writing. I further understand that additional information relating to the exceptions to the right to revoke and a description of how I may revoke this authorization is set forth in your Notice of Privacy Practices. I understand that any revocation must include my name, address, telephone number, date of this authorization and my signature and that I should send it to you.
I understand that the information used or disclosed pursuant to this authorization may be subject to re-disclosure by the Recipient listed above and, in that case, will no longer be protected by HIPAA.
This authorization expires upon your release of the information described above or thirty days after the Date of Authorization, as set forth below, whichever comes first.
