Whether you're a parent managing your child's medical records, an executor of an estate, or holding a healthcare power of attorney, being HIPAA compliant is required to protect the health information of those you represent.
A personal representative is an individual authorized by law to make decisions on behalf of another individual. This could be a parent or legal guardian of a minor, someone holding a healthcare power of attorney, or an executor of an estate managing the healthcare affairs of a deceased person. Personal representatives have the same rights as patients to access and manage the individual’s protected health information (PHI).
See also: HIPAA Compliant Email: The Definitive Guide
Enacted in 1996, HIPAA aims to protect the privacy and security of health information. It sets national standards for the protection of PHI, which includes any information that can be used to identify a patient and relates to their health condition, healthcare provision, or payment for healthcare services. HIPAA applies to covered entities like healthcare providers, health plans, healthcare clearinghouses, and their business associates.
Related: What is HIPAA?
According to the HHS, “subject to certain exceptions, the Privacy Rule at 45 CFR 164.502(g) requires covered entities to treat an individual’s personal representative as the individual with respect to uses and disclosures of the individual’s protected health information, as well as the individual’s rights under the Rule.” Therefore, since personal representatives are treated as individuals seeking medical attention, they must adhere to the same privacy and security standards that healthcare providers and other covered entities follow under HIPAA. Following HIPAA guidance ensures that the individual’s health information is protected against unauthorized access, use, or disclosure.
To ensure HIPAA compliance, personal representatives should be aware of the following responsibilities:
A personal representative has the same rights to access and control an individual’s PHI as the individual themselves. The representative can request medical records, make healthcare decisions, and receive communications regarding the individual’s care, all within the scope of their legal authority.
See also: What are patient rights under HIPAA?
A healthcare provider may refuse to share PHI with a personal representative if:
While formal HIPAA training is not typically required for personal representatives, many resources are available online, including guidelines from the U.S. Department of Health and Human Services (HHS). Legal advisors and healthcare providers can also offer insights and guidance on HIPAA compliance for personal representatives.