Your Medical Privacy and Who is Authorized to Access Your Medical Records

In this episode, Lisa Shoalmire and John Ross discuss your medical privacy and the people that could be authorized to access your medical records, and the HIPAA law that trumps even our state law with regard to medical privacy.

Episode Transcript
John
Welcome to another addition of Aging Insight. I'm John Ross, Elder Law Attorney here and here with my partner Lisa Shoalmire, also an elder law attorney. When we say that, when we say we're elder law attorneys, some people don't even know what that is. I've had people say, "Well John you're not elderly".
Lisa
Right. They thought you were an elderly...
John
It's not an elderly attorney, it's that we try to address the needs of seniors or people that have similar needs to seniors. Needs like not wanting to have to go to a nursing home if they can avoid it, not becoming a burden on their friends and family as they get older and need more help. And frankly preserving those assets, not going broke trying to pay for yourself through the end of your life. That's what elder law attorneys do, that's what we do. And we know that you can accomplish those goals as long as you have information. You've got to know what's out there, you've gotta know whats to be expected, because sometimes the smallest problems, things that seem like small problems can turn into just big old nightmares.
Lisa
Yeah well, I tell folks all the time that you would think that life would get simpler as you get older, but really in some ways it really becomes more complicated.
John
That's right, there's a famous quote out there that "Aging is not for sissies".
Lisa
And you've gotta stay on top of it.
John
That's right. Let me give you a scenario, so let's say your husband, or wife, or mom, or dad. Let's say something has happened and they have found themselves up at the hospital. Maybe they've fallen, maybe they've had a stroke, maybe they've had a heart attack, who knows. But they're up at the hospital and maybe they're loaded up on pain medicines, maybe they're unconscious, maybe they just don't know what's going on and so they're unable to make their own decisions, they're not able to to communicate, they're not able to sign anything or talk or whatever. And let's say that maybe it was a fall and it's caused a hip injury, and the doctor comes out and he's talking to you about your husband, or wife, or parent. And the doctors says, "You know? We've looked at the situation and we think that your loved one needs surgery but it's gonna be kinda dangerous. If we don't do the surgery with the hip injury they may not be able to walk again, but if we do do the surgery it could be life threatening, they may not live through the surgery."
John
This is a big deal, and of course as the family member who's looking out for that person, you say, "Well, okay. Doc, it's not that I don't trust you, I think you're a good doc, but I've always heard that if I get a big thing like that I probably should get a second opinion." And so you say, "Well you know what, I think I'm gonna go have another doctor look over this situation". So you head downstairs at that hospital and you go over to the medical records department and you say, "Hey, my dads upstairs, he's in the emergency room, and they've said he needs surgery and I just don't know, I wanna get a second opinion. So give me a copy of his medical records so that I can take them to this other doctor." Well let me just forewarn you, you're not gonna get those medical records if you're walking in there empty handed.
Lisa
That's right because there's a particular medical privacy law that would restrict access to those medical records even though you're that husband or wife or that closest family member that the patient has. Even though you may be on that persons bank account, you may be the one that brought them into that hospital. The bottom line, however, is there is a federal law that absolutely prohibits the dispersement of medical information to anyone but a very short list of people. And that law is called the Health Insurance Privacy and Portability Act.
John
They did such good job of coming up with indistinguishable hard to say names.
Lisa
That's right, so everybody in the business calls it the HIPAA law.
John
Right, H-I-P-A-A.
Lisa
Yeah I think I messed that up or something.
John
No, Health Insurance Portability and Accountability Act.
Lisa
Okay, but that HIPAA law, you'll hear it referenced as that shorthand, and it does a lot of things but for most folks the most common effect they see from this law is it just gets really aggravating to be able to get into the medical records for that spouse or for that parent when all you have is the best of intentions.
John
And people it seemed to me that they're often seem surprised because they'll say but this is my husband of 50 years, this is my parent, or maybe even in reverse, this is my child, this is my adult child that we're talking about. Why can't I as a parent, child, husband, wife, sibling, why can't I get those records? Well, because that HIPAA law says that nobody has access to your medical records without your signed written permission.
Lisa
That's right. And John, just to draw on your scenario a little more, what happens if that surgeon says, "Your spouse really needs that surgery." But I need to know, it looks like there's a lot of bleeding in there, are they on blood thinners? Are they taking their medicine? Are they on any kind of medication? Did they take it properly? Is that what caused the fall? Maybe they weren't taking their blood pressure medicine correctly and you as that child or spouse, you may not have that information.
John
That's right. You might even, the doctor may come out and say, "We think he needs surgery. But when we called the insurance company, the insurance company has denied and said that they're not gonna pay for it." And you call that insurance company up and you say, "Hey, I need to talk to you about dad's insurance." You have just run straight in to HIPAA. So addressing this HIPAA law can be very important. We're gonna talk about how to address the HIPAA law when we come back here in just a second.
John
Hi. I'm John Ross, elder law attorney and board member for the Alzheimer's alliance, and welcome to Our Place. Our Place is a day program designed to provide rest and relief for the caregivers of people with Alzheimer's and related dementias. Our Place is a safe environment where our friends benefit from socialization in a home-like environment. Alzheimer's is devastating and affects over 17,000 families in our area. To find out how Our Place can benefit you, please visit our website.
Lisa
Welcome back to Aging Insight. I'm Lisa Shoalmire and I'm here with John Ross and we're Elder Law Attorneys here in the Ark-latex. And today's topic we're covering has to do with your medical privacy and the people that could be authorized to access your medical records. The law in play here that we're talking about is the HIPAA law, this is a federal law, John, that trumps even our state law with regard to medical privacy.
John
That's an interesting thing about the dynamics of our country is we have state created laws and then we have laws created by the folks up there in Washington, the federal government. And when they create laws up there at the federal government level, there's a provision in that constitution that we have called the preemption clause. And that preemption clause says that the federal government laws trump our state laws.
Lisa
That's right. So that's how come frequently whenever you go to the doctor, they'll hand you a clipboard and they'll say "You've been given notice of our privacy, our privacy practices here in this doctor's office." And they may even give you a form that says, "Who would you authorize to look at your medical records." And so a lot of times, people think that that's all they have to do is sign that piece of paper at the doctor's office, but in a situation where you may be admitted into the hospital for a health crisis, maybe something that's not happened to you before, you might be seeing other doctors, other medical providers and so, John, one of the biggest frustrations to a lot of folks has to do with the fact that they feel like, "Hey, I signed that paper at my Doctor's office, my daughter, my husband, whoever, I've already said they can have access to my records. But you know what? If you're at the ER and you're being seen by an ER physician that's not affiliated with your doctor's office, then they don't have that form, and so now they are prohibited by federal law from sharing health information about you, and now you've reached that point of frustration.
John
Right, and of course I've had folks, as I explain that to them, they say, "Well, that's okay, 'cause I signed one at the hospital too." And that's great at that hospital, but a lot of times, like in a crisis, you may show up at the hospital, and there's an ER physician, who's an employee of the hospital. But as part of that they say, "We need to take some X-rays." And they roll you down the hall and have some X-rays done, but the doctor who does those X-rays, he's not actually an employee of the hospital, he works for an independent radiology group in that hospital. So now, did you ever sign a HIPAA release with that radiologist? Nope. And then you go over to an anesthesia guy, and he's also private. And maybe during all of this, they say, "We don't have the type of resources to care for you, so we're gonna carry you up to the roof, stick you on a helicopter, and fly you to Dallas or to Little Rock." And of course, you certainly haven't signed one at those hospitals either. So don't just assume that just because you have signed a HIPAA release at your doctor's office or at the hospital that you usually go to, that that's gonna be good for all purposes out there.
Lisa
Yeah, that's right, and I know it's frustrating, but you have to think that the deal here is that your medical records, you generally do wanna keep them private as to all the busybodies of the world, so this federal law put some real teeth into protecting those records. It's just sometimes we have to be aware of it so that we can make sure that we've addressed it, so that the people that are going to be helping us if we're in that medical crisis can have access.
John
Yeah, and of course, the HIPAA law protects not just your health records, your treatment records, and things like that, but it also covers things like the billing of that medical procedure and things like that. Oftentimes people, when they think about the HIPAA law, they think of it in terms of a doctor's office, but like we talked about before the break, if you're dealing with your health insurance company about somebody's medical care, that is a HIPAA issue as well. I tell you, I find that people... We started the program talking about the fact that we're Elder Law Attorneys. The people that I have found to be the most surprised by this HIPAA law are people whose adult child, maybe that 18-year-old kid that goes off to college, gets into a car wreck, and the parents, who pay for the health insurance, but when they call that health insurance company to discuss their child's care, can't speak to them because of this HIPAA law.
Lisa
Well, that's right, and another circumstance like that has to do with, once you receive that bill or statement for services from the hospital and maybe the amount is larger than you expected, and so you want your daughter, who is a CPA or a business person, to call about your hospital bill. When she gets on the phone, the hospital cannot talk to her, even though we're talking about just the bill. Because health information can be gleaned from the charges and the types of charges that are placed on that bill. So John, what do we do?
John
Right, so really that's... Isn't that the point? What do we do? So yeah, okay, you've talked about what a problem it is, what do we do to solve that problem? Well, of course, the first thing is, what is your situation? As long as you have the ability to grant somebody the authority, under that HIPAA law you have a right to your own records, you can see them, you can have copies of them, you can decide how those records are used. So for example, maybe you don't want your health records to be used by that hospital for their marketing purposes or for anything like that. You have a right to know what they've done with your records, who's seen your records, and of course again, you have the right to get a copy of those records. But what if you're incapacitated? What if you cannot make those decision? That's where the problem arises. And of course, you're gonna have to wait until we come back from this break to find out the solution. We'll be right back.
Lisa
Welcome back to Aging Insight. I'm Lisa Shoalmire here with John Ross, and today we're talking about a nuisance that follows all of us around in the medical world, and that is dealing with access to medical records. And we're talking specifically about the HIPAA law and the HIPAA requirements and prohibitions that we all have to think about if we want some assistance, or we want another pair of eyeballs on our medical records.
John
That's right. And the key here is that knowing that there surely could come a time that you're incapable of making your own medical decisions and that when that time comes, somebody who's helping you out might need access to those medical records. What do they need? Well, of course, the first thing when it comes to medical decisions is a Medical Power of Attorney. And if you have a Medical Power of Attorney, you're able to make medical decisions. There's actually a part of the HIPAA law and it says that "A person who has the authority to make medical decisions for somebody should be treated like that person for HIPAA purposes." So arguably if you have a Medical Power of Attorney where you can make medical decisions for somebody, then you should have all of the rights to that person's medical records under that HIPAA law. However, as with so many laws, it's just not written very well. And there's almost a conflict in the way that it reads because in one part it says that "A person with decision making authority can have access to records under HIPAA, but then in the next section it talks about that any disclosure needs to have a authorization."
Lisa
A written authorization. And you know what happens is that your medical providers who are the custodians of your medical records who are actually making your medical records, this law has some real teeth in it as far as punishing medical providers if they share your information without that authorization. So, what happens in this situation is if your agent under a Power of Attorney, that you're unconscious but you have an agent under a Medical Power of Attorney and that agent says, "Let me look at the records." The health care provider who has those records, they may get real nervous because they may not feel comfortable with just your Power of Attorney for health care decisions being the only document that they have on file, because they know that they can get big fines and in big trouble for sharing records if they don't have the proper paperwork.
John
And these people are not lawyers, they're not specialists in HIPAA, their job is just to protect those records and make sure they're not inadvertently disclosed. So even though you may have a Medical Power of Attorney in place, you should also have a HIPAA release, a document that authorizes, presumably the same people you've appointed in that Medical Power of Attorney, to be able to access medical records under the HIPAA law. In fact, it's not a bad idea to have a stand alone HIPAA release, so one document that is just a HIPAA release, that says "Anybody holding my medical records, or medical information, can release it to this person or to these people." It's also not a bad idea to have that same type of release in the Medical Power of Attorney itself, so the Medical Power of Attorney says "I appoint this person to make all of my medical decisions, and they also have authority under HIPAA to access my medical records."
John
And here's one more, we've talked about on this show the general Durable Power of Attorney. That's the business Power of Attorney. Well, Lisa was talkin' about insurance companies, if you're talking to an insurance company about somebody's billing, well guess what? That is a business decision, it's not covered under the Medical Power of Attorney, that's the business Power of Attorney, and yet it's also a HIPAA issue. So wouldn't be a bad idea to have a HIPAA release in that general Durable Power of Attorney as well. So it's one of those things, you just can't have too many of these.
Lisa
Well, that's true. But the way I often describe it to folks is that that HIPAA release is an information-only document, that stand alone HIPAA release. That means any of the people that you've named in that document, they all can get information. So for instance, if you have a spouse and three children, you may nominate your spouse to be your agent for healthcare decisions, but you may be fine with having your spouse and all three children being able to have access to information. Something as simple as your child that lives two states away, if they're on that HIPAA release and there's a medical crisis, that child while they're in route can call the nurse's station, or call the desk at the ER and say, "Hey I'm so and so, you have a patient there that's my mom, how's she doing?" And if that HIPAA release is already been presented to the facility they'll be able to answer that question.
John
Yeah, so even though the person you've appointed... A lot of times we see this, especially if there's a conflict in the family, maybe there's two kids, one of them is making medical decisions, but the other one just wants to be kept informed. Maybe that sibling of theirs is not keeping them informed very well, maybe a HIPAA release can solve that where they're not making medical decisions, but at least they have access to records so that they know what's going on.
Lisa
Well and that just made me think, John, we have a lot of what I call blended families or Brady Bunch families, and maybe it's a second marriage or more for someone. And maybe the senior member has children from a prior marriage, but they've remarried and they have all the confidence in the world in their spouse, but they wanna make sure that when a crisis time comes that the kids from the first marriage are still able to get information. So again, that HIPAA release can do a lot to address some family dynamic issues.
John
Yeah, there was a time where I used to tell people that there were three things that everybody needed, that you needed a General Durable Power of Attorney for business decisions, you needed a Medical Power of Attorney for medical decisions, and you needed a living will to talk about how you wanted to have your medical care if you were on life support. Well now I tell everybody there's four documents, and that fourth one; it's a HIPAA release. And so, if you don't have one, get one, that's really the key, it can save a lot of time, a lot of problems. And of course, making sure you know that, that's why we're here, that's why we're on Aging Insight.
Lisa
That's right, you can see us every week right here on KLFI Aging Insight and you can catch us every Saturday on the radio 107.1 at noon, and of course I bet you can jump on Facebook and find us at Aging Insight. We always love to hear from our viewers and listeners.
John
That's right, you can even follow me on Twitter if you're a Twitter user @txkelderlaw, that's txkelderlaw on Twitter. And email us, ask us questions, if there's a topic that we haven't covered and you wanna hear about it, let us know, and that way we can make sure that what we're talking about is exactly what you wanna hear. So until next time I'll see you later.
Lisa
Bye-bye.

Leave a Comment

Your email address will not be published. Required fields are marked *

Aging Insight is brought to you in part by: