February 2006
Volume 2, Number 2
Table of Contents

What Estate Lawyers Need To Know About HIPAA And "Protected Health Information

By Daniel B. Evans

If you've been to a doctor or hospital in the last few months, you've been asked to sign a piece of paper titled something like "HIPAA Notice of Privacy Practices," which probably told you all sorts of stuff about your medical records that you either didn't understand or didn't really care about. Well, the same federal law that has doctors asking patients to sign all of those pieces of paper also imposes penalties on doctors (and hospitals and other health care providers) who make unauthorized disclosures of "protected health information" about their patients. The new rules mean that health care providers are not going to be talking about (or otherwise disclosing information about) the medical condition of a patient to the families of the patient or the lawyer for the patient. These restrictions on disclosing information can lead to problems when families and lawyers are trying to figure out whether the patient is disabled for purposes of durable powers of attorney, advance medical directives, trusts, employment contracts, and other kinds of contracts and documents.

This article discusses how HIPAA regulations may affect various estate planning documents and practices. Although the new rules may cause problems for family members trying to learn about the medical condition of a patient from a doctor, the problems that most estate planning lawyers will confront relate to how HIPAA regulations relating to "personal representatives" and "valid authorizations" apply to powers of attorney and other estate planning documents and procedures.

Powers of Attorney

Many practitioners have expressed concerns that durable powers of attorney that include the power to make medical decisions (or durable health care powers of attorney) may need to be rewritten to comply with HIPAA. Several legal groups and individual lawyers have published new language (sometimes very lengthy and complex language) that they recommend be added to forms of powers of attorney. The language of the HIPAA regulations, however, shows that no changes should be needed for powers of attorney that, in conformity with the statutes or court decisions of the relevant state, validly authorize the attorney in fact to make medical decisions for the principal.

The regulations under HIPAA require health care providers to treat the personal representative in the same way as the patient, and a "personal representative" is the person who, under applicable law, has the power to make medical decisions for the patient. A properly authorized attorney-in-fact who has the power to make medical decisions for the principal under state law should qualify as a "personal representative" under the regulations and should be entitled to the same medical information as the principal.

Practitioners redrafting powers of attorney to include specific powers relating to health information should also consider that the HIPAA regulations do not contain any provisions that would give any legal effect to a power of attorney created for the purpose of receiving health information or authorizing disclosures of health information. To be a "personal representative," a person needs to have the authority to make medical decisions for the patient. Once a person has that power, all other powers granted by the document relating to medical information are redundant. Drafting a document to specifically authorize an attorney-in-fact to receive or disclose health information appears to be a waste of paper and ink, because there is no such thing as a "personal representative" of the patient who has the power to authorize disclosures but does not have the power to make medical decisions.

To make sure that an attorney-in-fact under a durable power of attorney has access to health information, it might be possible to write a broad "valid authorization" in favor of the attorney, but that may be contrary to the spirit and structure of the regulations. The regulations are consistent with the principle that a person who has the power to make medical decisions for a patient should be entitled to the same medical information as the patient, but the regulations seem to be hostile (or at least suspicious) of disclosures by written authorizations. As explained above, written authorizations are supposed to be "specific" in what is to be disclosed, for what purpose, from whom, to whom, and for how long. A broad general authorization to disclose all medical information from all sources, with no time limit, might not be valid under the regulations (or at least may raise enough of a question about the application of the regulations that health care providers may hesitate before honoring such a document).

Most of the problems that are being encountered with health care professionals, HIPAA, protected health information, and powers of attorney are undoubtedly due to the newness of the regulations and unfamiliarity with their scope and application. Many of these problems should disappear with time so that, in the long run, the best way to make sure that an attorney-in-fact under a power of attorney has access to all medical information is to make sure that the attorney-in-fact has the power to make all medical decisions, and not through additional wording in waivers or authorizations.

"Springing" Powers

A "springing" power of attorney (a power that takes effect only on the disability of the principal) may create new problems under HIPAA, because an incapacitated principal cannot authorize access to the medical information needed to prove that the principal is incapacitated.

To avoid court proceedings and litigation--the purpose of most, if not all, powers of attorney--many springing powers state that the principal shall be deemed to be disabled on the written opinions of some specific number of physicians. But under the HIPAA regulations, the principal's physicians are prohibited from disclosing information about the principal's medical condition without the permission of the principal or the personal representative of the principal. The principal cannot give permission because the principal is already incapacitated. The attorney-in-fact under the power of attorney is not the "personal representative" and cannot give permission, because the attorney will have the power to make medical decisions for the principal only after the power of attorney becomes effective and the power of attorney will not be effective until after the physicians have given their opinions.

The best solutions to this Catch-22 are to either (1) stop using springing powers or (2) arrange for the principal to sign a separate "valid authorization" along with any springing power, so that the principal's physicians are authorized to disclose the protected health information relevant to whether or not the principal is suffering from a disability.

Health Care Declarations ("Living Wills")

Many advance health care declarations (or "living wills") appoint an attorney-in-fact or "surrogate" to make health care decisions in the event that the declaration becomes effective (which is usually when the signer has become incompetent and is either in a terminal condition or in a state of "permanent unconsciousness").

Consistent with the HIPAA regulations, an attorney-in-fact or "surrogate" appointed under an advance health care declaration will not be treated like the declarant for all disclosure purposes, but will be treated as a "personal representative" only after the advance health care declaration becomes effective. Usually the declaration becomes effective only after the declarant is incompetent or unable to communicate his or her wishes and is in a terminal condition or in a state of permanent unconsciousness. (The laws on this may vary from state to state.) Until the declaration is actually effective, however, health care providers could refuse to provide medical information to the surrogate named in the declaration. So, for example, if the patient is incompetent but not yet in a terminal condition, the surrogate might not be entitled to medical information. Furthermore, because the authority of the surrogate could be seen as limited in scope (that is, the surrogate is only authorized to decide whether a medical treatment will unnecessarily prolong life or is necessary to relieve pain), a health care provider could limit the disclosures of protected health information to the surrogate to the information relevant to those decisions.

Whether limitations on the information and authority of a surrogate under an advance health care declaration are a problem depends on how practitioners and their clients see the role of the surrogate. If it is believed to be necessary or advisable for a family member to have full access to all medical information even before a patient might be incompetent or in a terminal condition, the best solution is to make sure that a durable power of attorney with the authority to make medical decisions, or a durable health care power of attorney, is in force rather than to attempt to revise or re-word an advance health care declaration.

Guardianship Proceedings

Like "springing" powers of attorney, guardianship proceedings themselves may be subject to an additional procedural hurdle to authorize the physicians of the alleged incapacitated person to testify in court and to disclose protected health information.

The HIPAA regulations specifically recognize judicial proceedings as an authorized disclosure. 45 C.F.R. § 164.512(e). But the regulations draw a distinction between an order of the court and a subpoena, and health care providers are not necessarily required to comply with subpoenas unless certain conditions are met. See 45 C.F.R. § 164.512(e)(1)(ii). To obtain a court order and not just a subpoena, the lawyer may need to file a petition and get a preliminary order for the disclosure of medical records and the testimony of physicians before an actual hearing on the issue of incapacity can be held. The necessity of this step will ultimately depend on whether health care providers are willing to honor a subpoena in guardianship proceedings or whether they will require a court order. Only time will tell what policies or attitudes the health care industry will adopt.

Trust Agreements

Like "springing" powers of attorney, many revocable trusts provide for the removal of the grantor as trustee, for changes in distributions, or for other consequences on the disability of the grantor. And, once again, many documents define the "disability" of the grantor in terms of an opinion by physicians that the physicians may not be willing to provide without compliance with HIPAA. It would seem that there could be four possible solutions to this problem.

One possible solution is to change the language of the revocable trust so that a failure of the trustee to authorize the release of the medical information necessary for the opinion of the physicians would itself become an event causing the grantor to be removed as trustee or otherwise considered to be disabled for the purpose of the trust. So, if the grantor were unable or unwilling to authorize the release of the medical information, the disability provisions would automatically take effect.

Another possible solution is to arrange for a separate authorization for the disclosure of the protected health information needed for the opinion of the physicians. Although a broad and unlimited authorization might not be a "valid authorization" under the regulations, an authorization for the specific purpose of determining disability within the meaning of the trust document should be specific enough to pass muster under anything but the most stringent reading of the regulations.

A third possible solution is to include an authorization for the disclosure of the necessary health information within the trust agreement itself. As discussed above, this is not recommended because the health care provider that discloses the health information will then be required to keep a copy of the trust document (45 C.F.R. § 164.508(b)(6)), which seems like a needless disclosure of the client's estate planning documents.

Finally, the revocable trust could provide that one or more designated family members (or family friends or other disinterested parties) will make the determination of disability. If the decision maker is someone not covered by HIPAA, and if the determination can be made without access to health information protected by HIPAA, then the HIPAA requirements will not block a determination that the grantor should step down as trustee. Of course, this solution potentially offers less protection to the grantor of the trust, because the determination of disability will depend not on a professional opinion but on the conclusion of someone close to the grantor that the grantor can no longer function as a trustee. Often, however, family members or others close to the grantor will be aware that the grantor should no longer manage the trust, even without technical medical information. If the grantor has family members or friends who can be trusted to make this determination, this strategy offers a simplified process.

Employment and Other Contracts

Other documents related to estate planning may include definitions of disability or a need for medical determinations, including employment agreements with disability benefits, shareholder or partnership agreements that allow or require transfers of business interests on disability, and possibly even antenuptial agreements or separation agreements. In each case, practitioners will need to reconsider how to get the necessary authorizations for the disclosure of health information.

When providing evidence of disability will benefit the individual, then it would seem that very little needs to be done except to make sure that the individual has executed a durable power of attorney that includes the power to make medical decisions.

The more difficult cases will be those in which it is to the benefit of other parties to demonstrate the disability of the individual and to the benefit of the individual to contest the existence of a disability. In those cases the best drafting solutions will probably follow the suggestions made above for revocable trusts. That is, the documents could be drafted so as to put the burden of proof on the individual and for the other parties to the contracts to be able to claim the existence of a disability if the individual is unable (or unwilling) to execute a valid authorization to disclose the necessary health information. Alternatively, the individual could sign a valid authorization for the disclosure of health information when the contract is signed, so that the other parties to the contract may be able to obtain the necessary health information when needed, or third parties who are not covered by HIPAA could be entrusted with the determination of disability.


Like many new laws, the HIPAA privacy regulations are causing confusion and uncertainty. But contrary to the fears of many practitioners, durable powers of attorney that give the attorney-in-fact the power to make medical decisions should be honored under HIPAA and should allow the attorney-in-fact both access to protected health information and the power to authorize disclosures of protected health information. Other problems that practitioners may encounter should be solvable either with separate written authorizations for the disclosure of protected health information, with revised provisions in trusts and contractual agreements that recognize the problems of obtaining health information by reallocating burdens of proof and presumptions relating to health and competency, or by entrusting determinations of incapacity to third parties who are not health care providers restricted by the HIPAA privacy regulations.

Daniel B. Evans is in private practice in Philadelphia, Pennsylvania.

Copr. (C) 2006 West, a Thomson business. No claim to orig. U.S. govt. works. This article is reprinted with permission from West, a primary sponsor of the General Practice, Solo and Small Firm Division.


Back to Top