Source: Consumer Reports
The HIPAA Privacy Rule Can Get in Your Way
Early one October morning, Sheri E. Warsh, a mother of three from Highland Park, Ill., stepped out of the shower to a ringing phone. On the other end, her 18-year-old son’s college roommate delivered terrifying news: Her son—270 miles away at the University of Michigan—was being rushed by ambulance to a nearby emergency room with severe, unrelenting chest pain. “I was scared out of my mind, imagining the worst,” Warsh said.
In a panic, she called the ER for details about the medical emergency. What she got instead was a rebuff from the nurse. “She asked me how old my son was, and when I said 18, she told me I had no right to talk to the doctor,” Warsh said.
Was the nurse acting within her scope? In fact, she was. The ER chose not to disclose the son’s medical condition due to the Privacy Rule of the Health Insurance Portability and Accountability Act, or HIPAA.
“Once a child turns 18, the child is legally a stranger to you,” said Jane F. Wolk, a trusts and estates attorney practicing in New York and New Jersey, referring to the legal age in almost all states; in a few, the legal age is older. “You, as a parent, have no more right to obtain medical information on your legal-age son or daughter than you would to obtain information about a stranger on the street.” And that is true even if the young-adult child is covered under the parents’ health insurance, and even if the parents are paying the bill.
A medical provider can chose to disclose protected health information to a family member, even without the patient’s authorization, if, in her professional judgment, it serves the best interest of the patient. But providers often come down on the side of patient privacy, particularly if they have never met the family member.
How to Ensure You’ll Have Access to Your Child
In this case, Warsh’s son didn’t intend to keep his parents in the dark during his medical emergency. In the midst of cardiac-care chaos, he was in too much pain to give authorization. But a simple, signed legal document (or two, in some states) would have smoothed the way.
“Nobody is talking about this, even after I went to so many college meetings and orientations,” Warsh said. The irony of her story is that Warsh is an attorney specializing in the practice of trusts and estates as a partner at a Chicago law firm. “Now in my practice I have made it my goal to educate parents on what they need to do,” she said.
Moms and dads who still think of themselves as protectors and advisers, even after their children become legal adults, often don’t consider the real-world implications of that milestone birthday. They and their young-adult children need to think about the unthinkable in advance. Three forms—HIPAA authorization, medical power of attorney, and durable power of attorney—will help facilitate the involvement of a parent or other trusted adult in a medical emergency.
If a student attends college out of state, fill out the forms relevant to the home state and school state to avoid any challenges. If the school has its own form, sign that one too, Warsh said. “When the doctor or medical institution sees it, you want them to be familiar with it and recognize it,” she said.
You don’t need a lawyer to do this. Many websites have downloadable forms. But a lawyer’s involvement can benefit in making sure you are using the right form, explaining it, and advocating on your behalf in case something goes wrong.
HIPAA authorization: A signed HIPAA authorization is like a permission slip. It permits healthcare providers to disclose your health information to anyone you specify. A stand-alone HIPAA authorization (not incorporated into a broader legal document) does not have to be notarized or witnessed. This document alone, signed in advance by her son, would have sufficed for Warsh to get information from the hospital treating her 18-year-old son. Young people who want parents to be involved in a medical emergency, but fear disclosure of sensitive information, need not worry; HIPAA authorization does not have to be all-encompassing. The young adults can stipulate not to disclose information about sex, drugs, mental health, or other details they might want to keep private.
Medical power of attorney: In signing a medical POA, you appoint an “agent” to make medical decisions on your behalf in case you are incapacitated and cannot make such decisions for yourself. Each state has different laws governing medical POA and, therefore, different legal forms. In many states, the HIPAA authorization is rolled into the standard medical POA form. Whether the medical POA requires the signature of a witness or notary varies state by state.
For the sake of clarifying often-used terms: A medical POA sometimes goes by other names, such as healthcare power of attorney, designation of healthcare proxy, or durable power of attorney for health care. It is one type of advance directive. The other type is a living will, which specifies your wishes with regard to interventions in life-or-death scenarios in case you are unable to do so. In many states, the language for the living will is also incorporated into a hybrid document that includes the medical POA and HIPAA release.
Durable power of attorney: As an additional step, young-adult children might consider appointing a durable power of attorney, enabling a parent or other designated agent to take care of business on the student’s behalf. If the student were to become incapacitated or if the student were studying abroad, the durable power of attorney would be able to, for example, sign tax returns, access bank accounts, and pay bills. Durable POA forms vary by state. In some states the medical POA can be included in the durable POA form. “The durable power of attorney is sweeping,” Wolk said. “You do not want to give it to someone who you do not trust.”