HIPAA Privacy Regulations: General Rules for Uses and Disclosures of Protected Health Information: Personal Representatives - § 164.502(g)
As Contained in the HHS HIPAA Privacy Rules
|
HHS Regulations as Amended August 2002 |
(g)(1) Standard: Personal representatives. As specified in this paragraph, a covered entity must, except as provided in paragraphs (g)(3) and (g)(5) of this section, treat a personal representative as the individual for purposes of this subchapter.
(2) Implementation specification: Adults and emancipated minors. If under applicable law a person has authority to act on behalf of an individual who is an adult or an emancipated minor in making decisions related to health care, a covered entity must treat such person as a personal representative under this subchapter, with respect to protected health information relevant to such personal representation.
(3)(i) Implementation specification: Unemancipated minors. If under applicable law a parent, guardian, or other person acting in loco parentis has authority to act on behalf of an individual who is an unemancipated minor in making decisions related to health care, a covered entity must treat such person as a personal representative under this subchapter, with respect to protected health information relevant to such personal representation, except that such person may not be a personal representative of an unemancipated minor, and the minor has the authority to act as an individual, with respect to protected health information pertaining to a health care service, if:
(A) The minor consents to such health care service; no other consent to such health care service is required by law, regardless of whether the consent of another person has also been obtained; and the minor has not requested that such person be treated as the personal representative;
(B) The minor may lawfully obtain such health care service without the consent of a parent, guardian, or other person acting in loco parentis, and the minor, a court, or another person authorized by law consents to such health care service; or
(C) A parent, guardian, or other person acting in loco parentis assents to an agreement of confidentiality between a covered health care provider and the minor with respect to such health care service.
(ii) Notwithstanding the provisions of paragraph (g)(3)(i) of this section:
(A) If, and to the extent, permitted or required by an applicable provision of State or other law, including applicable case law, a covered entity may disclose, or provide access in accordance with §164.524 to, protected health information about an unemancipated minor to a parent, guardian, or other person acting in loco parentis;
(B) If, and to the extent, prohibited by an applicable provision of State or other law, including applicable case law, a covered entity may not disclose, or provide access in accordance with §164.524 to, protected health information about an unemancipated minor to a parent, guardian, or other person acting in loco parentis; and
(C) Where the parent, guardian, or other person acting in loco parentis, is not the personal representative under paragraphs (g)(3)(i)(A), (B), or (C) of this section and where there is no applicable access provision under State or other law, including case law, a covered entity may provide or deny access under §164.524 to a parent, guardian, or other person acting in loco parentis, if such action is consistent with State or other applicable law, provided that such decision must be made by a licensed health care professional, in the exercise of professional judgment.
(4) Implementation specification: Deceased individuals. If under applicable law an executor, administrator, or other person has authority to act on behalf of a deceased individual or of the individual's estate, a covered entity must treat such person as a personal representative under this subchapter, with respect to protected health information relevant to such personal representation.
(5) Implementation specification: Abuse, neglect, endangerment situations. Notwithstanding a State law or any requirement of this paragraph to the contrary, a covered entity may elect not to treat a person as the personal representative of an individual if:
(i) The covered entity has a reasonable belief that:
(A) The individual has been or may be subjected to domestic violence, abuse, or neglect by such person; or
(B) Treating such person as the personal representative could endanger the individual; and
(ii) The covered entity, in the exercise of professional judgment, decides that it is not in the best interest of the individual to treat the person as the individual's personal representative.
| HHS Description of and Commentary from August 2002 Revisions General Rules for Uses and Disclosures of Protected Health Information: Personal Representatives |
December 2000 Privacy Rule. The Privacy Rule is intended to assure that parents have appropriate access to health information about their children. By creating new Federal protections and individual rights with respect to individually identifiable health information, parents will generally have new rights with respect to the health information about their minor children. In addition, the Department intended that the disclosure of health information about a minor child to a parent should be governed by State or other applicable law.
Under the Privacy Rule, parents are granted new rights as the personal representatives of their minor children. (See § 164.502(g).) Generally, parents will be able to access and control the health information about their minor children. (See § 164.502(g)(3).)
The Privacy Rule recognizes a limited number of exceptions to this general rule. These exceptions generally track the ability under State or other applicable laws of certain minors to obtain specified health care without parental consent. For example, every State has a law that permits adolescents to be tested for HIV without the consent of a parent. These laws are created to assure that adolescents will seek health care that is essential to their own health, as well as the public health. In these exceptional cases, where a minor can obtain a particular health care service without the consent of a parent under State or other applicable law, it is the minor, and not the parent, who may exercise the privacy rights afforded to individuals under the December 2000 Privacy Rule. (See § 164.502(g)(3)(i) and (ii), redesignated as § 164.502(g)(3)(i)(A) and (B)).
The December 2000 Privacy Rule also allows the minor to exercise control of protected health information when the parent has agreed to the minor obtaining confidential treatment (see § 164.502(g)(3)(iii), redesignated as § 164.502(g)(3)(i)(C) in this final Rule), and allows a covered health care provider to choose not to treat a parent as a personal representative of the minor when the provider is concerned about abuse or harm to the child. (See § 164.502(g)(5).)
Of course, a covered provider may disclose health information about a minor to a parent in the most critical situations, even if one of the limited exceptions discussed above apply. Disclosure of such information is always permitted as necessary to avert a serious and imminent threat to the health or safety of the minor. (See § 164.512(j).) The Privacy Rule adopted in December 2000 also states that disclosure of health information about a minor to a parent is permitted if State law authorizes disclosure to a parent, thereby allowing such disclosure where State law determines it is appropriate. (See ' 160.202, definition of "more stringent.") Finally, health information about the minor may be disclosed to the parent if the minor involves the parent in his or her health care and does not object to such disclosure. (See § 164.502(g)(3)(i), redesignated as § 164.502(g)(3)(i)(A), and § 164.510(b)). The parent will retain all rights concerning any other health information about his or her minor child that does not meet one of the few exceptions listed above.
March 2002 NPRM. After reassessing the parents and minors provisions in the Privacy Rule, the Department identified two areas in which there were unintended consequences of the Rule. First, the language regarding deference to State law, which authorizes or prohibits disclosure of health information about a minor to a parent, fails to assure that State or other law governs when the law grants a provider discretion in certain circumstances to disclose protected health information to a parent. Second, the Privacy Rule may have prohibited parental access in certain situations in which State or other law may have permitted such access.
The Department proposed changes to these standards where they did not operate as intended and did not adequately defer to State or other applicable law with respect to parents and minors. First, in order to assure that State and other applicable laws that address disclosure of health information about a minor to his or her parent govern in all cases, the Department proposed to move the relevant language about the disclosure of health information from the definition of "more stringent" (see ' 160.202) to the standards regarding parents and minors (see § 164.502(g)(3)). This change would make it clear that State and other applicable law governs not only when a State explicitly addresses disclosure of protected health information to a parent but also when such law provides discretion to a provider. The language itself is also changed in the proposal to adapt it to the new section.
Second, the Department proposed to add a new paragraph (iii) to § 164.502(g)(3) to establish a neutral policy regarding the right of access of a parent to health information about his or her minor child under § 164.524, in the rare circumstance in which the parent is technically not the personal representative of his or her minor child under the Privacy Rule. This policy would apply particularly where State or other law is silent or unclear.
Overview of Public Comments. The following discussion provides an overview of the public comment received on this proposal.
The Department received a number of comments on the proposed changes to the parents and minors provisions of the Privacy Rule. Many commenters, particularly health care providers involved in provision of health care to minors, requested that the Department return to the approach under the Privacy Rule published in December 2000, because they believed that the proposed approach would discourage minors from seeking necessary health care. At a minimum, these commenters suggested that the Department clarify that discretion to grant a parent access under the proposal is limited to the covered health care provider that is providing treatment to the minor.
Supporters of the proposal asserted that the Department was moving in the right direction, but many also advocated for more parental rights. They asserted that parents have protected rights to act for their children and that the Privacy Rule interferes with these rights.
There were also some commenters that were confused by the new proposal and others that requested a Federal standard that would preempt all State laws.
Final Modifications. The Department will continue to defer to State or other applicable law and to remain neutral to the extent possible. However, the Department is adopting changes to the standards in the December 2000 Privacy Rule, where they do not operate as intended and are inconsistent with the Department's underlying goals. Theses modifications are similar in approach to the NPRM and the rationale for these changes remains the same as was stated in the NPRM. However, the Department makes some changes from the language that was proposed, in order to simplify the provisions and clarify the Department's intent.
There are three goals with respect to the parents and minors provisions in the Privacy Rule. First, the Department wants to assure that parents have appropriate access to the health information about their minor children to make important health care decisions about them, while also making sure that the Privacy Rule does not interfere with a minor's ability to consent to and obtain health care under State or other applicable law. Second, the Department does not want to interfere with State or other applicable laws related to competency or parental rights, in general, or the role of parents in making health care decisions about their minor children, in particular. Third, the Department does not want to interfere with the professional requirements of State medical boards or other ethical codes of health care providers with respect to confidentiality of health information or with the health care practices of such providers with respect to adolescent health care.
In order to honor these differing goals, the Department has and continues to take the approach of deferring to State or other applicable law and professional practice with respect to parents and minors. Where State and other applicable law is silent or unclear, the Department has attempted to create standards, implementation specifications, and requirements that are consistent with such laws and that permit States the discretion to continue to define the rights of parents and minors with respect to health information without interference from the Federal Privacy Rule.
The Department adopts two changes to the provisions regarding parents and minors in order to address unintended consequences from the December 2000 Privacy Rule and to defer to State and other law. The first change is about disclosure of protected health information to a parent and the second is about access to the health information by the parent. Disclosure is about a covered entity providing individually identifiable information to persons outside the entity, either the individual or a third party. Access is a particular type of disclosure that is the right of an individual (directly or through a personal representative) to review or obtain a copy of his or her health information under § 164.524. This modification treats both activities similarly by deferring to State or other applicable law.
The first change, regarding disclosure of protected health information to a parent, is the same as the change proposed in the NPRM. In order to assure that State and other applicable laws that address disclosure of health information about a minor to his or her parent govern in all cases, the language in the definition of "more stringent" (see ' 160.202) that addresses the disclosure of protected health information about a minor to a parent has been moved to the standards regarding parents and minors (see § 164.502(g)(3)). The addition of paragraphs (g)(3)(ii)(A) and (B) of § 164.502, clarify that State and other applicable law governs when such law explicitly requires, permits, or prohibits disclosure of protected health information to a parent.
In connection with moving the language, the language is changed from the December 2000 Privacy Rule in order to adapt it to the new section. Section 164.502(g)(3)(ii)(A) states that a covered entity may disclose protected health information about a minor to a parent if an applicable provision of State or other law permits or requires such disclosure. By adopting this provision, the Department makes clear that nothing in the regulation prohibits disclosure of health information to a parent if, and to the extent that, State or other law permits or requires such disclosure. The Privacy Rule defers to such State or other law and permits covered entities to act in accordance to such law. Section 164.502(g)(3)(ii)(B) states that a covered entity may not disclose protected health information about a minor to a parent if an applicable provision of State or other law prohibits such disclosure. Again, regardless of how the Privacy Rule would operate in the absence of explicit State or other law, if such law prohibits the disclosure of protected health information about a minor to a parent, so does the Privacy Rule. The revision also clarifies that deference to State or other applicable law includes deference to established case law as well as explicit provisions in statutes or regulations that permit, require, or prohibit particular disclosures.
The second change, regarding access to protected health information, also reflects the same policy as proposed in the NPRM. There are two provisions that refer to access, in order to clarify the Department's intent in this area. The first is where there is an explicit State or other law regarding parental access, and the second is where State or other law is silent or unclear, which is often the case with access.
Like the provisions regarding disclosure of protected health information to a parent, the final Rule defers to State or other applicable law regarding a parent's access to health information about a minor. The change assures that State or other applicable law governs when the law explicitly requires, permits, or prohibits access to protected health information about a minor to a parent. This includes deference to established case law as well as an explicit provision in a statute or regulation. This issue is addressed in paragraphs (g)(3)(ii)(A) and (B) of § 164.502 with the disclosure provisions discussed above.
In addition to the provision regarding explicit State access laws, the Department recognizes that the Privacy Rule creates a right of access that previously did not exist in most States. Most States do not have explicit laws in this area. In order to address the limited number of cases in which the parent is not the personal representative of the minor because one of the exceptions in the parents and minors provisions are met (see § 164.502(g)(3)(i)(A), (B), or (C)), the Department adds a provision, § 164.502(g)(3)(ii)(C), similar to a provision proposed in the NPRM, that addresses those situations in which State and other law about parental access is not explicit. Under this provision, a covered entity may provide or deny access to a parent provided that such discretion is permitted by State or other law. This new paragraph would assure that the Privacy Rule would not prevent a covered entity from providing access to a parent if the covered entity would have been able to provide this access under State or other applicable law. The new paragraph would also prohibit access by a parent if providing such access would violate State or other applicable law.
It is important to note that this provision regarding access to health information about a minor in cases in which State and other laws are silent or unclear will not apply in the majority of cases because, typically, the parent will be the personal representative of his or her minor child and will have a right of access to the medical records of his or her minor children under the Privacy Rule. This provision only applies in cases in which the parent is not the personal representative under the Privacy Rule.
In response to comments by health care providers, the final modifications also clarify that, the discretion to provide or deny access to a parent under '164.502(g)(3)(ii)(C) only may be exercised by a licensed health care professional, in the exercise of professional judgment. This is consistent with the policy described in the preamble to the NPRM, is similar to the approach in the access provisions in § 164.524(a)(3), and furthers the Department's interest in balancing the goals of providing appropriate information to parents and of assuring that minors obtain appropriate access to health care. This decision should be made by a health care professional, who is accustomed to exercising professional judgment. A health plan may also exercise such discretion if the decision is made by a licensed health care provider.
The Department takes no position on the ability of a minor to consent to treatment and no position on how State or other law affects privacy between the minor and parent. Where State or other law is unclear, covered entities should continue to conduct the same analysis of such law as they do now to determine if access is permissible or not. Because the Privacy Rule defers to State and other law in the area of parents and minors, the Department assumes that the current practices of health care providers with respect to access by parents and confidentiality of minor's records are consistent with State and other applicable law, and, therefore, can continue under the Privacy Rule.
Parental access under this section would continue to be subject to any limitations on activities of a personal representative in § 164.502(g)(5) and '164.524(a)(2) and (3). In cases in which the parent is not the personal representative of the minor and State or other law does not require parental access, this provision does not provide a parent a right to demand access and does not require a covered entity to provide access to a parent. Furthermore, nothing in these modifications shall affect whether or not a minor would have a right to access his or her records. That is, a covered entity's exercise of discretion to not grant a parent access does not affect the right of access the minor may have under the Privacy Rule. A covered entity may deny a parent access in accordance with State or other law and may be required to provide access to the minor under the Privacy Rule.
These changes also do not affect the general provisions, explained in the section "December 2000 Privacy Rule" above, regarding parents as personal representatives of their minor children or the exceptions to this general rule, where parents would not be the personal representatives of their minor children.
These changes adopted in this Rule provide States with the option of clarifying the interaction between their laws regarding consent to health care and the ability of parents to have access to the health information about the care received by their minor children in accordance with such laws. As such, this change should more accurately reflect current State and other laws and modifications to such laws.
Response to Other Public Comments.
Comment: Some commenters urged the Department to retain the approach to parents and minors that was adopted in December 2000. They claimed that the NPRM approach would seriously undermine minors' willingness to seek necessary medical care. Other commenters advocated full parental access to health information about their minor children, claiming that the Privacy Rule interferes with parents' rights.
Response: We believe the approach adopted in the final Rule strikes the right balance between these concerns. It defers to State law or other applicable law and preserves the status quo to the greatest extent possible.
Comment: Health care providers generally opposed the changes to the parents and minors provisions claiming that they would eliminate protection of a minor's privacy, and therefore, would decrease the willingness of adolescents to obtain necessary health care for sensitive types of health care services. They also argued that the NPRM approach is inconsistent with State laws that give minors the right to consent to certain health care because the purpose of these laws is to provide minors with confidential health care.
Response: Issues related to parents' and minors' rights with respect to health care are best left for the States to decide. The standards regarding parents and minors are designed to defer to State law in this area. While we believe that there is a correlation between State laws that grant minors the authority to consent to treatment and confidentiality of the information related to such treatment, our research has not established that these laws bar parental access to such health information under all circumstances. Therefore, to act in a manner consistent with State law, the approach adopted in this Final Rule is more flexible than the standards adopted in December 2000, in order to assure that the Privacy Rule does not preclude a provider from granting access to a parent if this is permissible under State law. However, this new standard would not permit activity that would be impermissible under State law.
Some State or other laws may state clearly that a covered entity must provide a parent access to the medical records of his or her minor child, even when the minor consents to the treatment without the parent. In this case, the covered entity must provide a parent access, subject to the access limitations in the Privacy Rule at § 164.524(a)(2) and (3). Other laws may state clearly that a covered entity must not provide a parent access to their minor child's medical records when the minor consents to the treatment without the parent. In this case, the covered entity would be precluded from granting access to the parent. If the State or other law clearly provides a covered entity with discretion to grant a parent access, then the covered entity may exercise such discretion, to the extent permitted under such other law.
If State law is silent or unclear on its face, then a covered entity would have to go through the same analysis as it would today to determine if such law permitted, required, or prohibited providing a parent with access to a minor's records. That analysis may involve review of case law, attorney general opinions, legislative history, etc. If such analysis showed that the State would permit an entity to provide a parent access to health information about a minor child, and under the Privacy Rule, the parent would not be the personal representative of the minor because of one of the limited exceptions in § 164.502(g)(3)(i), then the covered entity may exercise such discretion, based on the professional judgment of a licensed health care provider, to choose whether or not to provide the parent access to the medical records of his or her minor child. If, as the commenters suggest, a State consent law were interpreted to prohibit such access, then such access is prohibited under the Privacy Rule as well.
Comment: One commenter asserted that the Privacy Rule inappropriately erects barriers between parents and children. Specifically, the commenter stated that § 164.502(g)(5) delegates to private entities government power to decide whether a child may be subjected to abuse or could be endangered. The commenter also stated that the access provisions in § 164.502(g)(3) would erect barriers where State law is silent or unclear.
Response: The Department does not agree that the Privacy Rule erects barriers between a parent and a minor child because the relevant standards are intended to defer to State law. Health care providers have responsibilities under other laws and professional standards to report child abuse to the appropriate authorities and to use professional discretion to protect the child's welfare in abuse situations. Similarly the Privacy Rule permits (but does not require) the provider to use professional discretion to act to protect a child she believes is being abused. If the Privacy Rule were to mandate that a provider grant a parent access to a medical record in abuse situations, as the commenter suggests, this would be a change from current law. In addition, the Privacy Rule does not allow a denial of parental access to medical records if State or other law would require such access.
Comment: Commenters continue to raise preemption issues. A few commenters called for preemption of all State law in this area. Others stated that there should be one standard, not 50 standards, controlling disclosure of protected health information about a minor to a parent and that the NPRM approach would burden regional and national health care providers. Others urged preemption of State laws that are less protective of a minor's privacy, consistent with the general preemption provisions.
Response: The Department does not want to interfere with a State's role in determining the appropriate rights of parents and their minor children. The claim that the Privacy Rule introduces 50 standards is inaccurate. These State standards exist today and are not created by the Privacy Rule. Our approach has been, and continues to be, to defer to State and other applicable law in this area.
Comment: One commenter requested the Privacy Rule state that good faith compliance with the Privacy Rule is an affirmative defense to enforcement of contrary laws ultimately determined to be more stringent than the Rule, or that it provide specific guidance on which State laws conflict with or are more stringent than the Privacy Rule.
Response: The Privacy Rule cannot dictate how States enforce their own privacy laws. Furthermore, guidance on whether or not a State law is preempted would not be binding on a State interpreting its own law.
Comment: Some commenters remain concerned that a parent will not get information about a child who receives care in an emergency without the consent of the parent and that the provisions in § 164.510(b) are not sufficient.
Response: As we have stated in previous guidance, a provider generally can discuss all the health information about a minor child with his parent, because the parent usually will be the personal representative of the child. This is true, under the Privacy Rule, even if the parent did not provide consent to the treatment because of the emergency nature of the health care. A parent may be unable to obtain such information in limited circumstances, such as when the minor provided consent for the treatment in accordance with State law or the treating physician suspects abuse or neglect or reasonably believes that releasing the information to the parent will endanger the child.
Comment: A couple of commenters were concerned that the provisions regarding confidential communications conflict with the Fair Debt Collection Practices Act (FDCPA), which allows collection agencies to contact the party responsible for payment of the debt, be it the spouse or parent (of a minor) of the individual that incurred the debt, and share information that supports the incurrence and amount of the debt. They feared that the Privacy Rule would no longer allow collection agencies to continue this practice.
Response: Our analysis of the relevant provisions of the Privacy Rule and the FDCPA does not indicate any conflicts between the two laws. An entity that is subject to the FDCPA and the Privacy Rule (or that must act consistent with the Privacy Rule as a business associate of the covered entity) should be able to comply with both laws, because the FDCPA permits an entity to exercise discretion to disclose information about one individual to another.
The FDCPA allows debt collectors to communicate with the debtor's spouse or parent if the debtor is a minor. The provisions of the FDCPA are permissive rather than required.
Generally, the Privacy Rule permits covered entities to use the services of debt collectors as the use of such services to obtain payment for the provision of health care comes within the definition of "payment." The Privacy Rule generally does not identify to whom information can be disclosed when a covered entity is engaged in its own payment activities. Therefore, if a covered entity or a debt collector, as a business associate of a covered entity, needs to disclose protected health information to a spouse or a parent, the Privacy Rule generally would not prevent such disclosure. In these cases where the Privacy Rule would permit disclosure to a parent or spouse, there should be no concern with the interaction with the FDCPA.
However, there are some circumstances in which the Privacy Rule may prohibit a disclosure to a parent or a spouse for payment purposes. For example, under § 164.522(a), an individual has the right to request restrictions to the disclosure of health information for payment. A provider or health plan may choose whether or not to agree to the request. If the covered entity agreed to a restriction, the covered entity would be bound by that restriction and would not be permitted to disclose the individual's health information in violation of that agreement. Also, § 164.522(b) generally requires covered entities to accommodate reasonable requests by individuals to receive communications of protected health information by alternative means or at alternative locations. However, the covered entity may condition the accommodation on the individual providing information on how payment will be handled. In both of these cases, the covered entity has means for permitting disclosures as permitted by the FDCPA. Therefore, these provisions of the Privacy Rule need not limit options available under the FDCPA. However, if the agreed-to restrictions or accommodation for confidential communications prohibit disclosure to a parent or spouse of an individual, the covered entity, and the debt collector as a business associate of the covered entity, would be prohibited from disclosing such information under the Privacy Rule. In such case, because the FDCPA would provide discretion to make a disclosure, but the Privacy Rule would prohibit the disclosure, a covered entity or the debt collector as a business associate of a covered entity would have to exercise discretion granted under the FDCPA in a way that complies with the Privacy Rule. This means not making the disclosure.
| HHS Description from Original Rulemaking General Rules for Uses and Disclosures of Protected Health Information: Personal Representatives |
In the proposed rule we defined “individual” to include certain persons who were authorized to act on behalf of the person who is the subject of the protected health information. For adults and emancipated minors, the NPRM provided that “individual” includes a legal representative to the extent to which applicable law permits such legal representative to exercise the individual's rights in such contexts. With respect to unemancipated minors, we proposed that the definition of “individual” include a parent, guardian, or person acting in loco parentis, (hereinafter referred to as “parent”) except when an unemancipated minor obtained health care services without the consent of, or notification to, a parent. Under the proposed rule, if a minor obtained health care services under these conditions, the minor would have had the exclusive rights of an individual with respect to the protected health information related to such health care services.
In the final rule, the definition of “individual” is limited to the subject of the protected health information, which includes unemancipated minors and other individuals who may lack capacity to act on their own behalf. We remove from the definition of “individual” the provisions regarding legal representatives. The circumstances in which a representative must be treated as an individual for purposes of this rule are addressed in a separate standard titled “personal representatives.” (§ 164.502(g)). The standard regarding personal representatives incorporates some changes to the proposed provisions regarding legal representatives. In general, under the final regulation, the “personal representatives” provisions are directed at the more formal representatives, while § 164.510(b) addresses situations in which persons are informally acting on behalf of an individual.
With respect to adults or emancipated minors, we clarify that a covered entity must treat a person as a personal representative of an individual if such person is, under applicable law, authorized to act on behalf of the individual in making decisions related to health care. This includes a court-appointed guardian and a person with a power of attorney, as set forth in the NPRM, but may also include other persons. The authority of a personal representative under this rule is limited: the representative must be treated as the individual only to the extent that protected health information is relevant to the matters on which the personal representative is authorized to represent the individual. For example, if a person's authority to make health care decisions for an individual is limited to decisions regarding treatment for cancer, such person is a personal representative and must be treated as the individual with respect to protected health information related to the cancer treatment of the individual. Such a person is not the personal representative of the individual with respect to all protected health information about the individual, and therefore, a covered entity may not disclose protected health information that is not relevant to the cancer treatment to the person, unless otherwise permitted under the rule. We intend this provision to apply to persons empowered under state or other law to make health related decisions for an individual, whether or not the instrument or law granting such authority specifically addresses health information.
In addition, we clarify that with respect to an unemancipated minor, if under applicable law a parent may act on behalf of an unemancipated minor in making decisions related to health care, a covered entity must treat such person as a personal representative under this rule with respect to protected health information relevant to such personal representation, with three exceptions. Under the general rule, in most circumstances the minor would not have the capacity to act as the individual, and the parent would be able to exercise rights and authorities on behalf of the minor. Under the exceptions to the rule on personal representatives of unemancipated minors, the minor, and not the parent, would be treated as the individual and able to exercise the rights and authorities of an individual under the rule. These exceptions occur if: (1) the minor consents to a health care service; no other consent to such health care service is required by law, regardless of whether the consent of another person has also been obtained; and the minor has not requested that such person be treated as the personal representative; (2) the minor may lawfully obtain such health care service without the consent of a parent, and the minor, a court, or another person authorized by law consents to such health care service; or (3) a parent assents to an agreement of confidentiality between a covered health care provider and the minor with respect to such health care service. We note that the definition of health care includes services, but we use “health care service” in this provision to clarify that the scope of the rights of minors under this rule is limited to the protected health information related to a particular service.
Under this provision, we do not provide a minor with the authority to act under the rule unless the state has given them the ability to obtain health care without consent of a parent, or the parent has assented. In addition, we defer to state law where the state authorizes or prohibits disclosure of protected health information to a parent. See part 160, subpart B, Preemption of State Law. This rule does not affect parental notification laws that permit or require disclosure of protected health information to a parent. However, the rights of a minor under this rule are not otherwise affected by such notification.
In the final rule, the provision regarding personal representatives of deceased individuals has been changed to clarify the provision. The policy has not changed substantively from the NPRM.
Finally, we added a provision in the final rule to permit covered entities to elect not to treat a person as a personal representative in abusive situations. Under this provision, a covered entity need not treat a person as a personal representative of an individual if the covered entity, in the exercise of professional judgment, decides that it is not in the best interest of the individual to treat the person as the individual's personal representative and the covered entity has a reasonable belief that the individual has been or may be subjected to domestic violence, abuse, or neglect by such person, or that treating such person as the personal representative could endanger the individual.
Section 164.502(g) requires a covered entity to treat a person that meets the requirements of a personal representative as the individual (with the exceptions described above). We note that disclosure of protected health information to a personal representative is mandatory under this rule only if disclosure to the individual is mandatory. Disclosure to the individual is mandatory only under §§ 164.524 and 164.528. Further, as noted above, the personal representative's rights are limited by the scope of its authority under other law. Thus, this provision does not constitute a general grant of authority to personal representatives.
We make disclosure to personal representatives mandatory to ensure that an individual's rights under §§ 164.524 and 164.528 are preserved even when individuals are incapacitated or otherwise unable to act for themselves to the same degree as other individuals. If the covered entity were to have the discretion to recognize a personal representative as the individual, there could be situations in which no one could invoke an individual's rights under these sections.
We continue to allow covered entities to use their discretion to disclose certain protected health information to family members, relatives, close friends, and other persons assisting in the care of an individual, in accordance with § 164.510(b). We recognize that many health care decisions take place on an informal basis, and we permit disclosures in certain circumstance to permit this practice to continue. Health care providers may continue to use their discretion to address these informal situations.
| HHS Response to Comments Received from Original Rulemaking General Rules for Uses and Disclosures of Protected Health Information: Personal Representatives |
Comment: It was observed that under the proposed regulation, legal representatives with “power of attorney” for matters unrelated to health care would have unauthorized access to confidential medical records. Commenters recommended that access to a person's protected health information be limited to those representatives with a “power of attorney” for health care matters only. Related comments asked that the rule limit the definition of “power of attorney” to include only those instruments granting specific power to deal with health care functions and health care records.
Response: We have deleted the reference to “power of attorney.” Under the final rule, a person is a personal representative of a living individual if, under applicable law, such person has authority to act on behalf of an individual in making decisions related to health care. “Decisions relating to health care” is broader than consenting to treatment on behalf of an individual; for example, it would include decisions relating to payment for health care. We clarify that the rights and authorities of a personal representative under this rule are limited to protected health information relevant to the rights of the person to make decisions about an individual under other law. For example, if a husband has the authority only to make health care decisions about his wife in an emergency, he would have the right to access protected health information related to that emergency, but he may not have the right to access information about treatment that she had received ten years ago.
We note that the rule for deceased individuals differs from that of living individuals. A person may be a personal representative of a deceased individual if they have the authority to act on behalf of such individual or such individual's estate for any decision, not only decisions related to health care. We create a broader scope for a person who is a personal representative of a deceased individual because the deceased individual can not request that information be disclosed pursuant to an authorization, whereas a living individual can do so.
Comment: Some commenters asked that the NPRM provision allowing informal decision-makers access to the protected health information of an incapacitated individual should be maintained in the final rule.
Response: We agree with the commenters, and retain permission for covered entities to share protected health information with informal decision makers, under conditions specified in § 164.510(b). A person need not be a personal representative for such disclosure of protected health information to be made to an informal decision-maker.
Comment: Commenters urged that individuals with mental retardation, who can provide verbal agreement or authorization, should have control over dissemination of their protected health information, in order to increase the privacy rights of such individuals.
Response: Individuals with mental retardation have control over dissemination of their protected health information under this rule to the extent that state law provides such individuals with the capacity to act on their own behalf. We note that a covered entity need not disclose information pursuant to a consent or authorization. Therefore, even if state law determines that an individual with mental retardation is not competent to act and a personal representative provides authorization for a disclosure, a covered entity may choose not to disclose such information if the individual who lacks capacity to act expresses his or her desire that such information not be disclosed.
Comment: A commenter suggested that the final rule should provide health plans with a set of criteria for formally identifying an incapacitated individual's decision-maker. Such criteria would give guidance to health plans that would help in not releasing information to the wrong person.
Response: The determination about who is a personal representative under this rule is based on state or other applicable law. We require that a covered entity verify the authority of a personal representative, in accordance with § 164.514(h) in order to disclose information to such person.
Comment: Commenters were troubled by the inclusion of minors in the definition of “individual” and believed that the presumption should be that parents have the right to care for their children.
Response: We agree that a parent should have access to the protected health information about their unemancipated minor children, except in limited circumstances based on state law. The approach in the final rule helps clarify this policy. The definition of “individual” is simplified in the final rule to “the person who is the subject of protected health information.” (§ 164.501). We created a new section (§ 164.502(g)) to address “personal representatives,” which includes parents and guardians of unemancipated minors. Generally, we provide that if under applicable law a parent has authority to act on behalf of an unemancipated minor in making decisions relating to health care about the minor, a covered entity must treat the parent as the personal representative with respect to protected health information relevant to such personal representation. The regulation provides only three limited exceptions to this rule based upon current state law and physician practice.
Comment: Many commenters agreed with our approach in the NPRM to give minors who may lawfully access health care the rights to control the protected health information related to such health care.
Several commenters disagreed with this approach and recommended that where states allow minors too much independence from parents, the rule should not defer to state law. One commenter suggested that we give an individual the right to control protected health information only when the individual reaches the age of majority.
Response: In the final rule, the parent, as the personal representative of a minor child, controls the protected health information about the minor, except that the parent does not act as a personal representative of the minor under the rule in three limited circumstances based on state consent law and physician practice. The final rule defers to consent laws of each state and does not attempt to evaluate the amount of control a state gives to a parent or minor. If a state provides an alternative means for a minor to obtain health care, other than with the consent of a parent, this rule preserves the system put in place by the state.
The first two exceptions, whereby a parent is not the personal representative for the minor and the minor can act for himself or herself under the rule, occur if the minor consents to a health care service, and no other consent to such health care service is required by law, or when the minor may lawfully obtain a health care service without the consent of a parent, and the minor, a court, or another person authorized by law consents to such service. The third exception is based on guidelines of the American Pediatric Association, current practice, and agreement by parents. If a parent assents to an agreement of confidentiality between a covered provider and a minor with respect to a health care service, the parent is not the personal representative of the minor with respect to the protected health information created or received subject to that confidentiality agreement. In such circumstances, the minor would have the authority to act as an individual, with respect to such protected health information.
Comment: Some commenters requested that we permit minors to exercise the rights of an individual when applicable law requires parental notification as opposed to parental consent.
Response: We adopt this policy in the final rule. If the minor consents to a health care service, and no other consent to such health care service is required by law, regardless of whether the consent of another person has also been obtained or notification to another person has been given, only the minor may be treated as the individual with respect to the protected health information relating to such health care service. The rule does not affect state law that authorizes or requires notification to a parent of a minor's decision to obtain a health care service to the extent authorized or required by such law. In addition, state parental notification laws do not affect the rights of minors under this regulation.
Comment: Some commenters requested clarification that when a minor may obtain a health care service without parental consent and voluntarily chooses to involve a parent, the minor retains the rights, authorities and confidentiality protections established in this rule.
Response: We agree that minors should be encouraged to voluntarily involve a parent or other responsible adult in their health care decisions. The rule is not intended to require that minors choose between involving a parent and maintaining confidentiality protections. We have added language in § 164.502(g)(3)(i) to clarify that when a minor consents to a health care service and no other consent is required by law, if the minor voluntarily chooses to involve a parent or other adult, the minor nonetheless maintains the exclusive ability to exercise their rights under the rule. This is true even if a parent or other person also has consented to the health care service for which the minor lawfully consented. Under the rule, a minor may involve a parent and still preserve the confidentiality of their protected health information. In addition, a minor may choose to have a parent act as his or her personal representative even if the minor could act on his or her own behalf under the rule. If the minor requests that a covered entity treat a parent as his or her personal representative, the covered entity must treat such person as the minor's personal representative even if the minor consents to a health care service and no other consent to such health care service is required by law.
Comment: Some commenters requested that the rule provide for the preservation of patient confidences if a health care provider and a minor patient enter into an agreement of confidentiality and a parent assents to this arrangement.
Response: We have addressed this concern in the final rule by adding a provision that ensures that a minor maintains the confidentiality protections provided by the rule for information that is created or received pursuant to a confidential communication between a provider and a minor when the minor's parent assents to an agreement of confidentiality between the provider and the minor. (§ 164.502(g)(3)(ii)). The American Academy of Pediatrics Guidelines for Health Supervision III, which are meant to serve as “a framework to help clinicians focus on important issues at developmentally appropriate time intervals,” recommends that physicians interview children alone beginning at the age of twelve (or as early as the age of ten if it is comfortable for the child). This recommendation is based on the fact that adolescents tend to underutilize existing health care resources, in part, because of a concern for confidentiality. The recommended interview technique in the Guidelines states that the provider discuss the rules of confidentiality with the adolescent and the parent and that the adolescent's confidentiality should be respected. We do not intend to interfere with these established protocols or current practices. Covered entities will need to establish procedures to separate protected health information over which the minor maintains control from protected health information with respect to which the minor's parent has rights as a personal representative of the minor.
A covered provider may disclose protected health information to a parent, regardless of a confidentiality agreement, if there is an imminent threat to the minor or another person, in accordance with § 164.512(j)(1)(i).
Comment: Several commenters suggested that we add a provision in the final rule to provide minors and parents with concurrent rights under certain circumstances, particularly when the minor reaches 16 years of age or when a parent authorizes his or her minor child to exercise these rights concurrently.
Response: We do not add such provision in the final rule. We believe that establishing concurrent rights through this rule could result in problems that effect the quality of health care if the minor and the parent were to disagree on the exercise of their rights. The rule would not prevent a parent from allowing a minor child to make decisions about his or her protected health information and acting consistently with the minor's decision. In all cases, either the parent has the right to act for the individual with respect to protected health information, or the minor has the right to act for himself or herself. The rule does not establish concurrent rights for parents and minors.
Comment: Commenters requested clarification about the rights of an adult or emancipated minor with respect to protected health information concerning health care services rendered while the person was an unemancipated minor.
Response: Once a minor becomes emancipated or attains the age of majority, as determined by applicable state law, the parent is no longer the personal representative under § 164.502(g)(3) of such individual, unless the parent has the authority to act on behalf of the individual for some reason other than their authority as a parent. An adult or emancipated minor has rights under the rule with respect to all protected health information about them, including information obtained while the individual was an unemancipated minor.
Comment: One commenter pointed out that language in the definition of individual in the NPRM that grants a minor the rights of an individual when he or she “lawfully receives care without the consent of, or notification to, a parent . . .” would have the effect of granting rights to an infant minor who receives emergency care when the parent is not available.
Response: This result was not our intent. We have changed the language in § 164.502(g)(3)(i) of the final rule to provide a minor the right to act as an individual when the minor can obtain care without the consent of a parent and the minor consents to such care. Because an infant treated in an emergency situation would not be able to consent to care, the infant's parent would be treated as the personal representative of the infant. Section 164.502(g)(3)(ii) provides that the parent is not the personal representative of the minor under the rule if the minor may obtain health care without the consent of a parent and the minor, a court, or another person authorized by law consents to such service. If an infant obtains emergency care without the consent of a parent, a health care provider may provide such care without consent to treatment. This situation would fall outside the second exception, and the parent would remain the personal representative of the minor.
Comment: Commenters were concerned about the interaction of this rule with FERPA with respect to parents' right to access the medical records of their children.
Response: We direct the commenters to a discussion of the interaction between our rule and FERPA in the "Relationship to Other Federal Laws" section of the preamble.