HIPAA and Advance Directives

HIPAA and Advance Directives must be considered working partners.

"Each time a patient sees a doctor, is admitted to a hospital, goes to a pharmacist or sends a claim to a health plan, a record is made of their confidential health information...the use and disclosure of this information is protected by a patchwork of state laws, leaving gaps in the protection of patients' privacy and confidentiality."(HHS Fact Sheet, U.S. Department of Health and Human Services, May 9, 2001 @ www.hhs.gov/news).

To address this concern, Congress enacted the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

The law gave Congress until August 21, 1999 to pass comprehensive health privacy legislation. Congress did not enact such legislation within three years. Thus, the law required the Department of Health and Human Services (HHS) to craft protections by regulation. HHS' final rule took effect on April 14, 2001. The law provided most covered entities two full years (April 14, 2003) to get up to speed in compliance with the final rule's provisions.

The final regulation covers health plans, health care clearinghouses, and those health care providers who conduct certain financial and administrative transactions electronically.

Health care providers who see patients will be required to obtain patient consent before sharing their information for treatment, payment, and health care operations.

The law also requires spearate patient authorization to be obtained for non-routine disclosures and most non-health care purposes. The patient also has the right to request restrictions on uses and disclosures of his information.

The law establishes the privacy safeguard standards that covered entities must meet, but it gives covered entities the flexibility to design policies and procedures for themselves to meet those standards. Every hospital or medical center has developed its own policy for Health Insurance Portability and Accountability Act compliance.

Medical providers may not be well versed in the nuances and language of HIPAA.

However, medical providers will be well versed in their hospital or medical center's policy.

Does the doctor go against hospital policy and face a significant criminal penalty (up to $50,000 and one year in prison for disclosing protected health information)?

Even though HIPAA does permit disclosures of health information without individual authorization for specific public responsibilities, such as identification of the body of a deceased person, or the cause of death,or "emergency circumstances", the hospital or medical center's policy will be what the doctor has become familiar with, not the legal nuances of HIPAA and Advance Directives. Thus, it is prudent planning to utilize HIPAA and Advance Directives together. Make certain that health care and medical proxies, and the like, contain a HIPAA release.

Time is critical in the employment of these documents. A HIPAA Release incorporated within the document minimizes the confusion and emotionality of the moment, and worst case scenarios that you might imagine.

Click the link, HIPAA and advance directives for more information regarding Advance Directives.