On July 14, 2010, the Department of Health and Human Services ("HHS") formally published its proposed regulations implementing changes made to the HIPAA Privacy and Security Rules by the Health Information Technology for Economic and Clinical Health Act ("HITECH"). The proposed regulations also include other changes intended to confirm or clarify the original Privacy and Security Rules. Because the proposed regulations cover a broad range of topics, we are issuing several more Alerts in our HIPAA Impact Series to provide further analysis of those topics. This Alert covers the provisions of the proposed regulations regarding the protected health information ("PHI") of decedents.
Period of Protection for Decedent Information
Currently, the Privacy Rule protects the privacy of a decedent's PHI in the same manner and to the same extent that is required for PHI of living individuals. This means that a covered entity must obtain an authorization from the decedent's personal representative (i.e., the executor, administrator, or other person who has authority under applicable law to act on behalf of the decedent's estate) any time an authorization is required for the use or disclosure of the decedent's PHI.
Citing concerns regarding the difficulty of locating a personal representative to authorize the use or disclosure of a decedent's PHI after an estate is closed, and the frustrations expressed by archivists and historians regarding the lack of access to records of historical value held by covered entities, HHS proposes that the Privacy Rule requirements only apply to PHI relating to a deceased individual for a period of 50 years following the date of death. HHS also proposes to modify the definition of PHI to exclude the individually identifiable health information of any person who has been deceased more than 50 years.
HHS believes that a 50 year period will protect the privacy interests of most, if not all, currently living relatives, or other affected individuals, and that this time period will minimize the difficulty of obtaining authorizations from personal representatives as time passes. This time period is consistent with recommendations made by the National Committee for Vital and Health Statistics. HHS is requesting public comment on the appropriateness of this time period.
Disclosures about a Decedent to Family Members and Others Involved in Care
The Privacy Rule allows a covered entity to disclose PHI to persons involved in an individual's care or payment related to the individual's health care. However, many family members, relatives, and others who had access to an individual's PHI prior to the individual's death are not permitted access following the individual's death since many do not qualify as the individual's "personal representative" after death.
To address these concerns, HHS proposes to permit (but not require) covered entities to disclose a decedent's PHI to family members and others who were involved in the individual’s care or payment for care of the individual prior to death, unless doing so would be inconsistent with the decedent's expressed preferences.
HHS is requesting public comment on any unintended consequences that the permissive disclosure of a decedent's PHI might cause. Note that, despite these proposed changes, the decedent's personal representative will still have the authority to request access to or an accounting of a decedent's PHI and to authorize any use and disclosure of the decedent's PHI that is not otherwise permitted or required by the HIPAA regulations.
HHS will accept comments regarding the proposed regulations from the public and the industry for a 60-day period ending September 13, 2010. Sometime thereafter, HHS will issue final regulations. For most provisions, including those described in this Alert, HHS intends to set the effective date for compliance at 180 days after the final rule is published.
