May 9, 2006

HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996: PRIVACY AND PLANNING

OVERVIEW

The Health Insurance Portability and Accountability Act of 1996 ("HIPAA") required the U.S. Department of Health and Human Services to promulgate regulations to protect an individual's personal health information. Such protected health information ("PHI") includes information pertaining to:

· The individual's past, present or future physical or mental health or condition;

· The provision of health care to the individual; and

· The past, present or future payment for the provision of health care to the individual.

In general, under the HIPAA regulations covered entities (i.e., insurance companies, health plans, physicians, dentists, pharmacies, psychologists and other entities involved in the provision of and payment for health care services) may not disclose an individual's PHI without that individual's prior authorization unless such disclosure is made: (1) to the individual; or (2) to the individual's personal representative; or (3) for the purpose of carrying out treatment or payment for services or health care operations. 45 C.F.R. ¤ 164.502. A personal representative is one who is legally authorized to make health care decisions on an individual's behalf or to act for a deceased individual or an estate. Significantly, any disclosure (except to the individual) must be limited to the minimum information necessary to accomplish the stated purpose of the disclosure or authorization. 45 C.F.R. ¤ 164.502(b). The regulations also provide for penalties for unauthorized disclosures Ð leading many health care providers to be extremely cautious when disclosing any PHI. 42 U.S.C. ¤¤ 1320d-5 Ð1320d-6.

It is important to recognize that the HIPAA regulations not only require advance authorization for the disclosure of PHI, but they also require that such authorizations meet certain core requirements. In particular, all authorizations must be written in plain language and must specify a statement of purpose, the information to be used or disclosed, the person(s) disclosing and receiving the information, an expiration, and the individual's right to revoke the authorization in writing. 45 C.F.R. ¤ 164.508(c).

EFFECT ON ESTATE PLANNING

Because the HIPAA regulations strictly limit the circumstances under which a health care provider may disclose PHI, it is prudent to review existing estate planning documents and practices to ensure that they are HIPAA-compliant. Three types of legal documents that are most widely affected are powers-of-attorney, advance health care declarations ("living wills") and revocable trusts. These documents frequently contain provisions under which a declarant appoints a surrogate or representative for specific purposes. Where access to medical information is involved, it is essential that an appropriate authorization be in place to ensure that such purposes are not frustrated.

1. Powers of Attorney

Many powers-of-attorney take effect only upon the disability of the principal. Such "springing" powers-of-attorney can be problematic under HIPAA because once a principal becomes incapacitated he or she is no longer competent to authorize access to the medical information needed to prove such incapacity. This issue can be avoided by either foregoing the use of a springing power-of-attorney or by having the principal execute a separate and limited authorization permitting a medical disclosure for the discrete purpose of determining capacity.

2. Living Wills

The language typically used in living wills presents problems similar to that used in springing powers-of-attorney and can be similarly amended. However, it is important to review the language in such documents carefully to ensure that the stated goals of the principal are met. For example, in some living wills, an appointment only becomes effective once a physician determines that the declarant is incompetent AND is in a terminal state. Additionally, some living wills limit the scope of the appointee's authority and any medical disclosure would of course have to track such limitations. Accordingly, if a declarant wants his or her appointee to have the authority to make health care decisions prior to a medical determination of incompetency and/or terminal state, then the authorizing language should be similarly broad. Alternatively, rather than revising the language of the living will itself, a declarant can simply execute a durable power-of-attorney specifying the circumstances under which medical disclosure is authorized, the extent of the disclosure, and, of course, the recipient(s).

3. Revocable Trusts

Many revocable trusts also have "springing" provisions. For example, it is common to provide for the removal of the grantor as trustee upon the grantor's disability, as determined by a physician. Obviously, this presents the same sort of catch-22 discussed above: the physician cannot disclose the medical information necessary absent the express authorization of the incompetent grantor. One option for coping with this issue is to amend the language of the trust so that a grantor's failure to provide the necessary authorization is itself the trigger to remove him or her as trustee. Another option is to execute a separate, advance authorization for the specific purpose of determining disability. However, such an authorization must be carefully crafted to meet the requirements of the HIPAA regulations discussed above.

ADDITIONAL INFORMATION

For additional information on HIPAA or assistance in estate planning, please contact either Larry Inouye or Colleen Sechrest either by telephone (310.712.0100) or email: linouye@shiotani-inouye.com or csechrest@shiotani-inouye.com.