Q. How does the new HIPAA (Health Insurance Portability and Accountability Act) affect physicians' interaction with family members who accompany elderly or juvenile patients?

A. The HIPAA Privacy Rule treats a family member (called the personal representative) as the patient regarding the health-care matters that relate to the representation. The scope of access depends on the authority granted to the personal representative by other law. A family member authorized to make health-care decisions generally may have access to a patient's protected health information. If the authority is limited, the family member may have access only to protected health information that may be relevant to making decisions within a limited authority. For example, a personal representative whose authority is limited to authorizing artificial life support is limited to information that may be relevant to decisions about artificial life support.

Q. Does someone with health-care power of attorney have access to an individual's record?

A. Yes, to the extent permitted by the HIPAA Privacy Rule. Except with respect to decedents, you must treat a personal representative as the individual only when that person has authority under other law to act on the individual's behalf on health-care matters. A power of attorney that does not include decisions related to health care in its scope does not authorize access to the individual's health records.
With respect to deceased patients, the Privacy Rule requires you to treat the personal representative as the individual if the person has authority under law to act for the decedent or the estate. The power of attorney would have to be valid after the individual's death to qualify the holder as the personal representative of the decedent.

Q. Does an adult with mental retardation control his protected health information?

A. Individuals may control their protected health information under the Privacy Rule to the extent state or other law permits them to act on their own behalf.
Even if an individual is deemed incompetent under law to act on his or her own behalf, a physician may decline a request by a personal representative for protected health information if the individual objects to the disclosure (or for any other reason), and the disclosure is merely permitted, but not required, under the Rule. You must provide the individual's personal representative access to the protected health information or an accounting of disclosures upon the request of that representative. The Rule allows a specified time period before you must act on the request; during this interim period, an individual and his representative will have an opportunity to resolve any dispute they have concerning the request.

Q. Does the Privacy Rule allow parents to see their children's medical records?

A. Yes, with three exceptions, a parent may have access to the medical records about his child as the minor child's personal representative when such access is not inconsistent with state or other law. It's important for your office to understand your state law in these matters.

The exceptions are: 1) when the minor is the one who consents to care and the consent of the parent is not required under state or other applicable law; 2) when the minor obtains care at the direction of a court or a person appointed by the court; and 3) when, and to the extent that, the parent agrees that the minor and the health-care provider may have a confidential relationship.

Q. Does the Privacy Rule provide children rights to be treated without parental consent?

A. No. The Rule does not address consent to treatment, nor does it preempt or change state or other laws that address consent to treatment (once again, know your state law). The Rule addresses access to, and disclosure of, health information, not the underlying treatment.

Q. May physician's offices leave messages such as appointments reminders for patients at their homes?

A. Yes. Health-care providers may communicate with patients regarding their health care at their homes, through the mail, by phone or in some other manner. Physicians are not prohibited from leaving messages for patients on answering machines. However, to safeguard  privacy, take care to limit the information disclosed on the machine. For example, you might consider leaving only the practice name and number and other information necessary to confirm an appointment, or ask the individual to call back.

You also may leave a message with a family member or another who answers the phone when the patient isn't home. The Rule permits physicians to disclose limited information to family members, friends or other persons regarding an individual's care, even when the individual is not present. However, use professional judgment to assure that such disclosures are in the best interest of the individual, and limit the information disclosed. When a patient has requested that the covered entity communicate with him in a confidential manner, such as by alternative means or at an alternative location, you must accommodate that request, if reasonable. For example, a request to receive mailings from a medical practice in a closed envelope rather than a postcard is considered a reasonable request that should be accommodated.

Ms. Kennedy is an associate consultant with the Corcoran Consulting Group. Contact her at pkennedy@corcoranccg.com or 1 (800) 399-6565.