Privacy Rule Provisions of the Health Insurance Portability and Accountability Act of 1996 and Virginia Health Record Privacy Laws

For additional information, please contact Stephen G. Reardon.

This article explains Privacy Rule provisions of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and Virginia health record privacy laws that define the rights of a personal representative to act on behalf of a patient. Specifically, it focuses on a parent or legal guardian’s rights to disclosure and use of the protected health information (“PHI”) of a minor, an emancipated minor, or a mentally incompetent adult.

First, it explains the federal requirements imposed by HIPAA in this context. Second, it discusses the applicable medical privacy laws of Virginia [1]. Finally, links are included to Department of HHS frequently asked questions and answers that may be helpful in demonstrating the practical PHI disclosure issues in this context.

Issue

Whether, and to what extent, a parent or legal guardian is considered a personal representative of a minor child, an emancipated minor, or a mentally incompetent adult, for uses and disclosures of protected health information under the Privacy Rule of HIPAA and Virginia privacy statutes.

Short Answer

Under HIPAA, a duly authorized personal representative, adult, or emancipated minor shall be treated as an individual patient. HIPAA emphasizes, however, that applicable state laws govern in defining an “authorized personal representative” and the PHI rights of parents and minors. Virginia law provides that only a legal guardian or parent, including a noncustodial parent, may assert the right to access or disclose a minor’s PHI, unless such person’s parental rights have been terminated. However, in a few instances an unemancipated minor is capable of consenting to specific healthcare services, in which case only the minor has a right to access the related PHI. If the health records are those of a mentally incapacitated adult, the health care entity may disclose them to the legal guardian or committee of the incompetent individual, or if no guardian or committee is appointed, to certain statutorily defined relatives. Finally, if a parent or legal guardian is not the individual’s personal representative, and there is no applicable PHI provision under state law, a licensed professional of the entity may exercise his or her judgment to provide or deny access to the patient’s protected health information.

Analysis

I. HIPAA and the Privacy Rule

A. Standards for Personal Representatives

In general, the HIPAA Privacy Rule establishes federally protected rights that permit individuals[2] to control certain uses and disclosures of their protected health information. With regard to a patient’s rights, the Rule requires a covered entity to treat a personal representative (“PR”) of the individual the same as the patient himself. A PR is a person legally authorized to make health care decisions on an individual’s behalf, or to act for a deceased individual’s estate. [3]

Section 164.502[4] contains general rules for the use and disclosure of PHI. Subpart (g)[5] of this section outlines when, and to what extent, a covered entity must treat a personal representative as the individual. Because the PR stands in the shoes of, and has the ability to act for the individual, the PR can exercise the individual’s rights to use and disclosure of PHI. The PR can utilize these PHI rights to the extent that such information falls within his or her authorized representation. In general, the scope of the PR’s authority to act for the individual under the Privacy Rule derives from his or her authority under applicable state law. In a press release summarizing the final modifications to the Privacy Rule, the Department of Health and Human Services (“HHS”) reiterated that:

The final [Privacy] Rule clarifies that state law, or other applicable law, governs in the areas of parents and minors. Generally, the Privacy Rule provides parents with new rights to control the health information about their minor children, with limited exceptions that are based on state or other applicable law and professional practice. For example, where a state has explicitly addressed disclosure of a minor’s health information to a parent, or access to a child’s medical record by a parent, the final Rule clarifies that state law governs.[6]

Accordingly, the health privacy laws of Virginia concerning personal representatives for minors, adults, and incompetent adults provide the lens through which to evaluate this issue. These Virginia statutes are addressed in detail in Section II of this memorandum.

B. Personal Representatives of Minors, Emancipated Minors, and the Mentally Incompetent

When the PR has broad authority under state law to act on behalf of an individual, such as a parent with respect to a minor child or a legal guardian of a mentally incompetent adult, the covered entity must treat the PR as the individual for all purposes under the Rule, unless an exception applies (e.g., abuse, neglect or endangerment situations). The following chart[7] illustrates whom a covered entity should recognize as the PR for each category of individuals:

C. Sharing Medical Information with Relatives or Friends

Fundamentally, the Privacy Rule defers to state laws that address the ability of a parent, guardian, or other person acting in loco parentis (collectively, “parent”), to obtain health information about a minor child. In most cases under the Rule, the parent is the PR of the minor child and can exercise the minor’s PHI rights, because state laws usually grant the parent authority to make healthcare decisions about his or her child. If state law is silent or unclear concerning parental access to the minor’s PHI, a covered entity has discretion to provide or deny a parent access, so long as the decision is made by a licensed health care professional in the exercise of professional judgment. [9]

If an individual is present and able to make his or her own health care decisions, and provided that the covered entity gives the individual an opportunity to object or agree to the disclosure, a covered entity may disclose relevant PHI to a family member, relative, or close personal friend of the individual, as well as any person identified by the individual who is involved in the health care treatment or related payment.[10] If the individual is not present or is unable to give permission because of incapacity or emergency, disclosure to the next of kin is permitted if the covered entity reasonably infers that the individual does not object, based on professional judgment under the circumstances and on its experience with common practice.[11]

II. Virginia Statutes on PHI Disclosure and Uses for Minors

Section 32.1-127.1:03 of the Code of Virginia, “Health records privacy,” recognizes an individual’s right of privacy in the content of his or her health records.[12] This comprehensive health records privacy statute is broad in scope, and it provides the general rules and procedures for access and disclosure of PHI in Virginia. It initially provides that health records are the property of the health care entity maintaining them, and, except when permitted or required by this section or by other provisions of state law, no health care entity or other person working in a health care setting may disclose an individual’s health records.[13] It next mandates that health care entities shall disclose health records to the individual who is the subject of the health record, unless specifically proscribed elsewhere in the section.

Subsection D of Section 32.1-127.1:03 presents a multitude of exceptions to the general ban on disclosure that allow, and, if provided, require health care entities to disclose health records. A health care entity may disclose the health records of an individual pursuant to the written authorization of (1) the individual or (2) in the case of a minor, (a) his custodial parent, guardian or other person authorized to consent to treatment of minors pursuant to section 54.1-2969 or (b) the minor himself, if he has consented to his own treatment pursuant to subsection E of Section 54.1-2969[14], or (3) in emergency cases or situations where obtaining written authorization is impracticable, pursuant to the individual’s oral authorization. Subsection D also provides that the health care entity may disclose the PHI of a mentally incapacitated individual to the personal representative, legal guardian, or committee of the incompetent or incapacitated individual. Additionally, if there is no personal representative, legal guardian, or committee appointed, the health care entity may disclose the incompetent’s PHI to the following persons in the order provided: a spouse, an adult son or daughter, either parent, an adult brother or sister, or any other relative in order of blood relationship.[15]

Virginia Code Section 2.2-3705.5[16] provides that when an individual who is the subject of the PHI is under the age of 18, the minor’s right of access to the PHI may be asserted only by his or her guardian or parent, including a noncustodial parent, unless such parent’s parental rights have been terminated, a court of competent jurisdiction has restricted or denied such access, or the parent has been denied access to the PHI in accordance with Section 20-124.6,[17] which provides two exceptions to the rule allowing parental access. In instances where the individual is an emancipated minor, a student in a public institution of higher education, or is a minor who has consented to his or her own treatment as authorized by Section 16.1-338[18] (voluntary admission to mental health institution) or Section 54.1-2969[19] (authority to consent to certain medical treatments), the subject individual may assert the right of PHI access himself or herself.[20]

Section 20-124.6, “Access to minor’s records,” specifically addresses a parent’s right to access his or her child’s PHI.[21] The Section provides that, notwithstanding any other provision of law, neither parent, regardless of whether the parent has custody, shall be denied access to the health records of that parent’s minor child unless (1) otherwise ordered by the court for good cause shown or (2) the minor’s treating physician or clinical psychologist has made a part of the minor’s record a written statement that, in the exercise of his professional judgment, the furnishing to or review by the parent of such health records would be reasonably likely to cause substantial harm to the minor or another person. In short, Virginia grants a parent or guardian an absolute right to access his or her minor child’s PHI, subject only to the two exceptions above.

Under Section 54.1-2969, whenever a minor has been separated from the custody of his parent or guardian, the authority to consent, commensurate with that of a parent, to necessary medical treatment for a minor is conferred upon various groups of individuals.[22] Subsection E dictates that a minor shall be deemed an adult for the purpose of consenting to medical or health services in cases treating venereal or infectious diseases reported to the State Board of Health; in cases of birth control, pregnancy, or family planning; in cases of outpatient substance abuse treatment; and in cases of outpatient treatment for mental illness or emotional disturbance. Subsection E also explicitly mandates that a minor shall be deemed an adult for the purpose of accessing or authorizing the disclosure of medical records relating to the above named medical treatments. Subsection K affirms that nothing in subsection E shall prevent a parent or legal guardian from obtaining (1) the results of a minor’s nondiagnostic drug test when the minor is not receiving treatment for substance abuse or (2) a minor’s other health records, except when the minor’s treating physician or clinical psychologist determines, in the exercise of professional judgment, that disclosure of health records to the parent or guardian would be reasonably likely to cause substantial harm to the minor or another person.[23]

In sum, Virginia law generally provides a parent or legal guardian with the sole right to access a minor child’s PHI, subject to two exceptions. Accordingly, an unemancipated minor cannot access his PHI without parental consent, unless he consented to a statutorily authorized medical treatment. But if emancipated, a minor has the exclusive right to access his or her PHI.

III. Frequently Asked Questions and Answers

Appendix A is a at the HHS website and is included because they address specific questions related to the issues discussed in this memorandum.[24] Through examples and explanations, the FAQs provide practical assistance to employers, employees, and covered entities on how to address PHI access and disclosure issues. For additional FAQs on a variety of other HIPAA issues, please access the HHS website at http://www.answers.hhs.gov.

Conclusion

Under HIPAA and Virginia’s privacy statutes, a parent, legal guardian, or person standing in loco parentis possesses the exclusive right to access or disclose the minor child’s PHI. Consequently, unless he or she has consented to one of several statutorily authorized medical treatments, an unemancipated minor cannot access his or her PHI without parental consent. However, an emancipated minor possesses the right to access his or her individual PHI, exclusive of any parental right to PHI access.

Under Virginia law an incompetent adult’s legally authorized guardian or personal representative can access or disclose the individual’s PHI. However, a healthcare entity should not disclose PHI to the personal representative if the incompetent adult objects to the disclosure, and the disclosure is merely permitted, but not required, under the rule. Finally, if a competent adult is present and able to make his or her own health care decisions, a health care entity must give the individual an opportunity to object or agree to the disclosure before the entity may disclose relevant PHI to anyone other than the individual, including family members, relatives, or close personal friends.

If a covered entity follows the guidelines set forth above, and obtains prior written consent from an individual or his or her authorized personal representative, in all likelihood the entity will not violate HIPAA Privacy Rule provisions or Virginia health privacy statutes concerning PHI access and disclosure for a minor, emancipated minor, or incompetent adult.

APPENDIX A

[1] The law in the Commonwealth concerning the privacy, disclosure, and access of an individual’s health records is currently in a state of flux. Recent statutory amendments and pending legislation have altered Virginia’s health record privacy statutes for both adults and minors. This memo will attempt to clarify the most current versions of Virginia’s privacy statutes in the corresponding section.

[2] This memorandum will use “patient” and “individual” interchangeably to mean a patient who is receiving or has received health services from a health care entity. This usage is common among the commentators and literature on the subject, and it also tracks the language used in HIPAA and Virginia privacy statutes.

[3] Office for Civil Rights, U.S. Dep’t of Health & Human Services, Summary of the HIPAA Privacy Rule 16, available at http://www.hhs.gov/ocr/privacysummary.pdf (last revised August 9, 2002).

[4] 45 C.F.R. § 164.502 (2005).

[5] § 164.502(g).

[6] U.S. Dep’t of Health & Human Services, Modifications to the Standards for Privacy of Individually Identifiable Health Information – Final Rule, available at http://www.hhs.gov/news/press/2002pres/20020809.html (last revised May, 2003) (emphasis added).

[7] Office for Civil Rights, U.S. Dep’t of Health & Human Services, Personal Representatives Guide 2-4, available at http://www.hhs.gov/ocr/hipaa/guidelines/personalrepresentatives.pdf (last revised April 3, 2003) (chart modified from original version).

[8] Appendix A is attached to this memorandum and contains a printout of various Frequently Asked Questions (“FAQs”) published by the Department of HHS that are related to this discussion. For a more detailed explanation of the PHI disclosure and uses rights of mentally retarded adults, please see FAQ # 225.

[9] Personal Representatives Guide, supra at 2-4.

[10] Jane M. Sullivan, HIPAA: A Practical Guide to the Privacy and Security of Health Data 43 (2004).

[11] Id.

[12] Va. Code Ann. § 32.1-127.1:03 (2005), amended by 2005 Va. Acts ch. 39, S.B. 1064; 2005 Va. Acts ch. 101, H.B. 2363; 2005 Va. Acts ch. 642, H.B. 2515; 2005 Va. Acts ch. 697, S.B. 1203.

[13] Id.

[14] Va. Code Ann. § 54.1-2969 (2005), amended by 2005 Va. Acts ch. 181, H.B. 2516; 2005 Va. Acts ch. 227, S.B. 1109.

[15] § 32.1-127.1:03(D)(23).

[16] § 2.2-3705.5(1) (2005), amended by 2005 Va. Acts ch. 181, H.B. 2516; 2005 Va. Acts ch. 227, S.B. 1109.

[17] § 20-124.6 (2005), amended by 2005 Va. Acts ch. 181, H.B. 2516; 2005 Va. Acts ch. 227, S.B. 1109.

[18] § 16.1-338, amended by 2005 Va. Acts ch. 181, H.B. 2516; 2005 Va. Acts ch. 227, S.B. 1109.

[19] Va. Code Ann. § 54.1-2969 (2005), amended by 2005 Va. Acts ch. 181, H.B. 2516; 2005 Va. Acts ch. 227, S.B. 1109.

[20] § 2.2-3705.5(1).

[21] Va. Code Ann. § 20-124.6 (2005), amended by 2005 Va. Acts ch. 181, H.B. 2516; 2005 Va. Acts ch. 227, S.B. 1109.

[22] § 54.1-2969, amended by 2005 Va. Acts ch. 181, H.B. 2516; 2005 Va. Acts ch. 227, S.B. 1109 (including, depending on the facts, judges, directors of social services, the Director of the Dept. of Corrections or Juvenile Justice, principal executive officers of institutions legally qualified to receive minors for care and maintenance).

[23] § 54.1-2969(K) (emphasis added).

[24] U.S. Dep’t of Health & Human Services, Frequently Asked Questions, Answer IDs 220-231, 340, at http://www.answers.hhs.gov (last updated July 18, 2003).

For additional information, please contact Stephen G. Reardon.