Featured Article. How To Be A HIPaa Lawyer

Featured Article How To Be A HIPaa Lawyer William H. Soskin Introduction The Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Pub L 104 191, 110 Stat 1936) and California s Con dentiality of Medical Information Act (CMIA) (CC 56 56.37) are intended to prevent doctors and other health care providers from inappropriately disclosing individuals health information. The language and coverage of the law and regulations (45 CFR pts 160 and 164) have been discussed in depth in numerous articles. See Hughes, When Worlds Collide: The Privacy Challenge to Casual Use of Protected Medical Information in Probate Courts and Estate Planning, 24 CEB Est Plan R 133 (June 2003); Graham & Blattmachr, Planning for the HIPAA Privacy Rule, 29 ACTEC J No. 4 (Spring 2004); Graham, I Fell and My HIPAA is Broken, 39 U Miami Inst Est Plan, chap 7 (2005); Summary of HIPAA Privacy Rule, published by the Of ce for Civil Rights (OCR) of the U.S. Department of Health and Human Services (HHS) and available on the HHS website at http://www.hhs.gov/ocr/hipaa. This article will focus on the challenges HIPAA and CMIA present to California estate planners and suggest drafting solutions. The Estate Planner s Quandary Revocable Trusts and Durable Powers of Attorney HIPAA and CMIA provide that, with few exceptions, personal health information may not be disclosed by a health care provider to third parties without a valid authorization. Unauthorized disclosure results in severe penalties under federal and California law. These rules create signi cant problems for California estate planning attorneys. Consider the typical revocable inter vivos trust in which the trustor is also the trustee. The trust provides that if the trustor does not have suf cient understanding or ability to make or communicate decisions about the nancial affairs of the trust, the trustor s oldest child shall become successor trustee. The family physician is to make the decision of incapacity. The trustor, because of age or illness, appears to have diminished capacity and the oldest child calls the physician to nd out whether he or she should take over as successor trustee. The physician tells the child that the father s mental health and condition is protected health information and cannot be disclosed under HIPAA! 45 CFR 164.508(a). Meanwhile, the trustor will not resign as trustee, insisting that he is completely competent and able to handle all of the trust s nancial affairs. The problem is virtually identical for nontrust assets, such as IRAs and annuities; only the nomenclature is different. The eldest child is, in this case, nominated as agent under his or her father s springing durable power of attorney to begin acting for him if the family physician makes a nding of incapacity. Once again, the physician is precluded from communicating a nding of incapacity under HIPAA and CMIA. Inadequate Strategies How does the estate planner effectively confront these challenges? Some commentators have suggested sidestepping the problem by eliminating a determination of incapacity by a physician. Instead, the recommendation is to use one or more trusted friends, family members, or third party trust protectors to decide when a trustor/principal is incapacitated and should be removed. In the author s experience, most clients will reject this alternative. Clients are reluctant to give nonphysicians such powers, especially without the bene t of medical data concerning incapacity. Most clients want decisions regarding incapacity to be made by an independent physician who has relevant medical information at hand. Nonphysicians asked to make this decision without medical information will often nd themselves caught between the trustor, who insists that he or she is ne, and the children or spouse, who claim otherwise. In such situations, the family friend or trust protector, very uncomfortable and wary of being sued, will frequently resign or ask a court to make the decision. More importantly, this solution does not effectively deal with what happens when a successor

agent or trustee appears to be incapacitated: We still need a mechanism for removing successor agents or trustees who can no longer carry out their duties. It has also been suggested that carefully phrasing the opinion a physician is to make can avoid the restrictions on communicating personal health information, e.g., the physician will opine solely on the ability of a principal to manage nances, under the theory that the opinion is not a communication of personal health information. Unfortunately, 45 CFR 160.103 de nes health information as including any information that relates to present or future physical or mental health or condition of an individual. (Emphasis added.) I would suggest that the ability to manage nances is information that relates to the condition of an individual and thus falls within the purview of HIPAA. Another solution occasionally recommended is that principals rely on immediately activated powers of attorney rather than documents that spring into effect only on the disability of the principal. Again, the problem is that in real life, clients do not want to give their children or others concurrent powers to sell assets and pry into their nancial affairs unless there is a clear-cut need to do so. This also is an approach that fails to address the possible incapacity of successor duciaries. Successor Trustees and Agents Another problem area in drafting trusts and durable powers concerns the removal of incapacitated successor agents and trustees. Imagine that Son is now the acting successor trustee, Dad having resigned. Son begins to exhibit signi cant forgetfulness and confusion and, to the rest of the family, appears unable to make effective nancial decisions regarding the trust. Son will not acknowledge the problem, refusing to go to a physician for evaluation and rejecting the request that he resign. What is the drafting solution to this problem? What can documents state that will compel the successor trustee or agent to agree to be evaluated by a physician? Even if Son is evaluated, how do we avoid the rules prohibiting the physician from disclosing the results to Son s successor trustee or agent? Health Care Directives Assume your client, an elderly woman, has a terminal illness. She is falling in and out of consciousness and cannot communicate with her family or physician effectively. Despite medication, she is in obvious distress and pain. Her daughter is the designated agent on her health care directive, which contains a no heroics clause. The daughter asks the physician for details of her mother s condition and prognosis so that she can make intelligent decisions regarding continuation of life support. The physician tells the daughter that he thinks, but is not positive, that California and federal privacy rules may apply and that he cannot disclose information regarding her mother s condition since her mother did not sign an authorization to disclose such information to the daughter. He tells the daughter he will ask the hospital ethics committee to further explore the problem. Note how different the above scenario is from the scenarios concerning trustees and nancial powers of attorney. Here, the scope of personal health information the agent will want to know is much greater. We are not simply asking for information concerning nancial managerial competence. Here, the agent wants to know personal medical history and detailed information regarding the principal s condition and prognosis. What also makes the health care directive situation different is that HIPAA appears to permit disclosure of personal health information to an agent under a health care directive. 45 CFR 164.502(g)(2); http://answers.hhs.gov/cgi-bin/hhs.cfg/php. California law also seems to make written authorization unnecessary. The health care provisions in Prob C 4600 4805 and 4235 are not conditioned on the principal/patient having previously signed an authorization to disclose personal health care information to the health care agent. See Prob C 4235, 4678, 4733. Still, commentators caution that health care providers may be reluctant to disclose health information without a written authorization. Others have expressed concern about a chicken and egg problem that arises when a prerequisite to appointment is that the principal be unable to make decisions because neither the agent nor the physician can act rst to establish that the principal is incapable of making health care decisions and neither can act until the other has done so. See, e.g., California Durable Powers of Attorney 1.21P (Cal CEB 1996). The author does not see this as a practical problem in California under a typical health care directive stating that the agent s authority commences when the principal cannot communicate health care decisions. It will be readily apparent to a physician when the patient cannot make his or her own

health care decisions; the doctor then signs a statement to that effect; the doctor can then disclose personal health information to the agent. Another possible strategy is to use immediately activated health care directives, rather than powers that spring into effect only when the principal is unable to communicate his or her health care preferences. As a practical matter, most clients will not want to give third parties even loved ones free reign to request and obtain con dential information when there is no health care crisis. A Road Map for Estate Planners The foregoing illustrates all too clearly that HIPAA and CMIA require a new approach to drafting estate planning documents. Clients need to understand that they can elect to have agents and trustees removed and reinstated without the bene t of medical information, but if they want decisions regarding incapacity to be made with the bene t of medical information, their estate planning documents will need to be revised as follows: Concurrently with the execution of revocable trusts and durable powers of attorney, the trustor/principal will need to execute a separate document authorizing a physician to disclose information concerning the capacity of the trustor/principal to make nancial decisions as the basis for a successor trustee or agent to assume control of the trustor/principal s nancial affairs or for a trustee to honor a trustor s purported directions, trust amendments, or trust revocation. The authorizations can be drafted to minimize concerns regarding invasion of privacy. Authorized disclosures can be limited, in the case of trusts and durable powers of attorney, to statements regarding capacity to manage nancial affairs or to modify documents, along with (if desired) a statement of the reasons relied upon by the physician in reaching such decision. Similar authorization is also needed for a client who is a partner, shareholder, or limited liability company member and who is to be removed from decision making if he or she is unable to manage his or her nancial affairs on the basis of a written declaration by a physician to such effect. Trusts and durable powers of attorney need to include or be amended to include provisions stating that: All trustees, successor trustees and agents must, as a prerequisite to appointment or to continuation of service, execute an authorization to release health information to determine if they have capacity to hold or continue in of ce. A subsequent revocation of the authorization by a trustee or agent will constitute a resignation of the duciary s of ce. As a condition to acceptance or continuing to act, each trustee and agent agrees to submit to and cooperate with an examination by a physician to determine capacity when reasonably requested to do so by a person with a substantial interest, such as a child or spouse of the trustor, a bene ciary, or a successor trustee or agent. The client needs to execute a separate written authorization to release personal health information that will be attached to health care directives. This will assure the disclosure of adequate health information concerning a principal to an agent who is charged with making decisions regarding life support and other medical procedures. Drafting Health Information Authorization Forms There are disclosure authorization forms currently available from several sources. See Durable Powers 1.21R (attorney-drafted authorization form) and 1.21S (CMA/Private Plan Associates, Inc.). Readers are encouraged to review Graham, I Fell and My HIPAA is Broken, 39 U Miami Inst Est Plan, chap 7 (2005), which provides language mandating continuously effective HIPAA authorization from the trustee (similar to that provided below) as well as language allowing selected parties to demand medical information. However, disclosure authorizations must comply with very speci c requirements of both California and federal law, and careful drafting is required. Federal requirements are found in 45 CFR 164.508(c). See http://www.hhs.gov/ocr/hipaa. Although HIPAA generally preempts state law, California law still applies to the extent it is more stringent. 45 CFR 160.203. The California rules are found in CC 56.11. For example, the form in Durable Powers 1.21R does not include a speci c disclosure required by 45 CFR 164.508(c)(2)(iii).

Again, note that the CMIA and HIPAA rules are not equivalent and that any authorization document must be carefully drafted to comply with both sets of rules. The following model forms and clauses can be used to implement the Road Map discussed above. Rather than have separate authorizations for trusts and, e.g., durable powers of attorney, this form applies in numerous situations in which a person must relinquish authority when he or she is unable to make proper nancial and business decisions. The information the health care provider can disclose is quite restricted under this provision. The language could permit the health care provider to prepare a written opinion encompassing far more information generally related to the principal s capacity or lack of capacity. Authorizations should be separate and stand-alone documents, not provisions integrated into trusts and powers of attorney. CC 56.11; 45 CFR 164.508(b)(3). AUTHORIZATION TO RELEASE HEALTH INFORMATION BY TRUSTOR, PRINCIPAL, OR OTHERS AUTHORIZATION FOR USE AND DISCLOSURE OF PROTECTED HEALTH INFORMATION Pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA), 42 USC 1320d and 45 CFR parts 160, 164, and the California Con dentiality of Medical Information Act, Civil Code 56 56.37, I authorize all health care providers and covered entities to disclose my protected health information and medical information as follows: A. To an agent appointed under a durable power of attorney signed by me, at the request of such agent, in the form of a written and signed opinion that I do or do not have capacity as de ned in the power of attorney [, along with a statement containing the minimum health information suf cient to support and explain the opinion] ; Comment: It is critical that the durable power of attorney be coordinated with this document; when used with this form, the durable power of attorney must refer to capacity and then de ne it. Alternatively, if the durable power of attorney does not refer to capacity but sets out a standard such as substantially unable to manage my nancial affairs, then the same language must be included in the authorization document. The phrase at the request of..., above, is suggested by 45 CFR 164.508(c)(1)(iv). B. To a co-trustee or designated successor trustee of any trust of which I am the trustee [or a bene ciary of such trust], at the request of such person, in the form of a written opinion that I do or do not have capacity to serve as trustee as de ned in the trust [, along with a statement containing the health information suf cient to explain and support the opinion] ; C. To the trustee of any revocable trust of which I am a trustor, at the request of such person, in the form of a written opinion that I do or do not have capacity to revoke or amend the trust [, along with a statement containing the health information suf cient to explain and support the opinion] ; D. To a general partner, or other person authorized to cause my removal as a general partner or managing general partner at the request of such a person, in the form of a written opinion that I do or do not have capacity to serve as general partner or managing general partner, as de ned in the partnership agreement dated [date], of which I am a member, along with a statement containing health information suf cient to support and explain the opinion; Comment: A variation of this paragraph would be for a manager of a limited liability company of which the principal has managerial authority. A similar paragraph can also be included when the principal can be removed from decision-making capacity or bought out in a corporate buy-sell agreement. Again, the language in the authorization document has to be closely coordinated with the capacity language in the partnership agreement, if any. E. To my attorney, [name], at my attorney s request, for the purpose of determining my capacity in making inter vivos gifts and to execute estate planning documents and I authorize my attorney to re-disclose such information in the minimum amount required to implement or not implement such actions, as the case may be; and Comment: HIPAA regulates the initial disclosure but not subsequent re-disclosure. Federal regulations require a warning on the authorization form about the risk of re-disclosure. 45 CFR 164.508(c)(2)(ii). California, however, goes further and prohibits the subsequent use of health information. CC 56.13, 56.36(c)(2)(A). Thus, this form speci cally authorizes appropriate re-disclosure.

F. To a person nominated by me, if any, in my power of attorney or any other document, to act as my conservator, at the request of such person, for the purpose of determining whether a conservatorship or other protective proceeding is necessary or desirable, and such person is authorized to re-disclose such information in the minimum amount necessary to accomplish that purpose. 2. Any person authorized above to receive my protected health information may bring a legal action against any covered entity or health care provider that refuses to provide my protected health information for the purposes described above, and shall be reimbursed from the trust for all costs pertaining to such legal action. 3. I understand that: A. I have a right to receive a copy of this authorization. Comment: See CC 56.11(i); 45 CFR 164.508(c)(4). B. I may revoke or modify this authorization at any time by written notice delivered to and received by the health care provider. Comment: See CC 56.15; 45 CFR 164.508(c)(2)(i). C. This authorization shall expire on the date of my death unless validly revoked prior to that date. Comment: See CC 56.11(h); 45 CFR 164.508(c)(1)(v). Even though 45 CFR 164.502(g)(4) authorizes disclosures to the personal representative, some attorneys recommend extending the expiration date to one or two years after death to facilitate obtaining medical information after death. D. Under California law, all recipients of protected health care information may not re-disclose it except as required or permitted by law. Comment: This language is not required to be in the form, but it is helpful to remind the recipient of such information that re-disclosure is limited (CC 56.13). E. The covered entity may not condition treatment, payment, enrollment, or eligibility for bene ts on whether I sign an authorization unless the law allows conditions. Comment: See 45 CFR 164.508(c)(2)(ii)(A). F. There is the potential for information disclosed pursuant to this authorization to be subject to re-disclosure by the recipient and no longer protected by HIPAA regulations. Comment: See 45 CFR 164.508(c)(2)(iii). Date: [Signature] [Typed name] Comment: This form is to be produced in a type face not smaller than 14-point type pursuant to CC 56.11(a). AUTHORIZATION BY TRUSTEES, CO-TRUSTEES, SUCCESSOR TRUSTEES AND AGENTS TO RELEASE HEALTH INFORMATION AUTHORIZATION FOR USE AND DISCLOSURE OF PROTECTED HEALTH INFORMATION 1. Pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA), 42 USC 1320d and 45 CFR parts 160, 164, and the California Con dentiality of Medical Information Act, Civil Code 56 56.37, I authorize all health care providers and covered entities to disclose my protected health information and medical information: A. To a successor agent or co-agent nominated under a durable power of attorney signed by [name of trustor] of which I am then acting or then eligible to act as an agent, at the request of a successor agent or co-agent, in the form of a written and signed opinion that I do or do not have capacity as de ned in the power of attorney [,along with a statement containing the minimum health information necessary to support and explain the opinion].

Comment: What the health care provider can state is quite restricted under this provision. The language could permit the health care provider to prepare a written opinion encompassing far more information generally related to the agent s capacity or lack of capacity. It is critical that the durable power of attorney be coordinated with this document: The durable power of attorney must refer to capacity and then de ne it. Alternatively, if the durable power of attorney does not refer to capacity but sets out a standard such as substantially able to manage my nancial affairs, then that same phrase must be included in the authorization document. B. To a successor trustee or co-trustee [or bene ciary] of any Trust of which [name of trustor] is the Trustor and of which I am nominated as a trustee [or a bene ciary of such trust], at the request of such co-trustee or successor trustee, in the form of a written opinion that I do or do not have capacity to serve as trustee as de ned in the trust, [, along with a statement containing the minimum health information necessary to explain and support the opinion] ]. C. To the attorney for [name of trustor] ], at his or her request, for the purpose of determining my capacity to serve as trustee, and I authorize [name of attorney] to re-disclose such information in the minimum amount required to implement or not implement such actions, as the case may be. 2. Any person authorized above to receive my protected health information may bring a legal action against any covered entity or health care provider that refuses to provide my protected health information for the purposes described above, and shall be reimbursed from the trust for all costs pertaining to such legal action. 3. I understand that: [Use Paragraphs 2.(a) (f) from Authorization for Use and Disclosure of Protected Health Information, above.] Date: [Signature] [Typed name] Comment: This form is to be produced in a type face not smaller than 14-point type pursuant to CC 56.11(a). FACILITATING TRUST PROVISIONS [The following provisions should be considered for inclusion in or amendment to all trust documents with comparable provisions included in durable general powers of attorney.] 1. Agreement to Execute Authorization. A speci c condition precedent to the appointment and acceptance of, or continuation in, the position of trustee, co-trustee or successor trustee is the execution of the Authorization for Use and Disclosure of Protected Health Information in the form set forth on Exhibit A (except for such changes as may be required to comply with subsequent changes in the law and regulations), attached hereto and incorporated herein by this reference, for purposes of determining whether the trustee, co-trustee or successor trustee is capable of managing the affairs of the trust. 2. Revocation of Authorization. Any trustee, co-trustee or successor trustee may revoke an authorization for disclosure of health information previously executed by such person, but revocation shall be deemed to constitute the immediate resignation of the trustee, co-trustee or successor trustee. 3. Determination of Capacity. Any individual holding or accepting the of ce of trustee or co-trustee of this trust agrees to be examined by a physician selected by such person to determine whether such person has the capacity to serve or continue serving as trustee or co-trustee, as de ned in this trust document [to determine whether such person is substantially incapable or capable of managing this trust] within thirty (30) days of being reasonably requested to do so by a successor trustee or co-trustee, if any, and otherwise by the next successor trustee or co-trustee, or if there is none, by any bene ciary who is currently entitled to receive income or principal distributions from this trust. A trustee, co-trustee, or successor trustee who refuses to be examined within thirty (30) days after being requested to do so in writing, as provided above, shall be deemed to have immediately resigned.

Comment: There is a risk of harassment and abuse by the person who can compel an examination, but there is no easy solution to the problem. A clause can be added limiting the right to compel an examination to once every speci ed number of months, but what if there is a precipitous decline in capacity before the next examination period commences? It should also be kept in mind that in many cases in which trustee capacity is questioned, a trustee resignation is the desired result. A clause compelling examination by a physician may facilitate achieving that result if a demand is made. AUTHORIZATION TO RELEASE HEALTH INFORMATION TO HEALTH CARE AGENT AUTHORIZATION TO RELEASE HEALTH INFORMATION I, [name], grant to my agent(s) under my advance health care directive the authority to advocate for my health care needs if I have been determined to lack capacity to make my own health care decisions. 1. Pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA), 42 USC 1320d and 45 CFR parts 160, 164, and the California Con dentiality of Medical Information Act (Civil Code 56 56.37), I authorize all health care providers and covered entities to disclose to my agent under my advance health care directive, at my agent s request, all of my individually identi able health and medical information and medical records regarding any past, present, or future medical or mental health condition in the minimum amount necessary to advocate for my health care needs. Comment: The limiting language is intended to prevent disclosure of embarrassing and/or personal data irrelevant to the health care decisions at hand. 2. I intend my agent to be dealt with by all my health care providers and covered entities, as required by HIPAA and California law, in the exact same way as I would be treated with respect to my rights regarding the use and disclosure of my identi able protected health information or other medical records. 3. I understand that: [Use Paragraphs 2.(a) (f) from Authorization for Use and Disclosure of Protected Health Information, above.] Date: [Signature] [Typed name] Comment: This form is to be produced in a type face not smaller than 14-point type pursuant to CC 56.11(a).