HIPAA privacy rules become complex in dementia cases

Key Points

He is saddened by the senility of some of these patients, and he is worried about their ability to consent to various office-provided procedures. One of his patients with dementia has a brother who is the next of kin. This brother holds a power of attorney that becomes effective when the described patient is no longer able to make decisions for himself.

Dr. Doe has been provided with a copy of that power of attorney. At almost all times, the patient in question is not lucid. However, there are rare moments in which the patient understands what Dr. Doe is doing.

Would it be a HIPAA violation to call the brother at that exact time? Can Dr. Doe simply call the brother, or must other steps be taken?

Personal representation

The key to these questions lies in the HIPAA regulatory provision concerning an individual's "personal representative." Certainly, Dr. Doe is permitted to release protected healthcare information to the patient himself. But what does the term "personal representative" mean?

The HIPAA regulation clearly states that if, under applicable law, a person has authority to act on behalf of an individual who is an adult in making decisions related to healthcare, then the physician must treat this individual as a personal representative with respect to relevant protected health information.

If the conditions stipulated by the power of attorney have been met, then that person now has the authority to make decisions for the patient.

Although there are, in fact, exceptions to the above rule, they are quite limited. If, for example, Dr. Doe reasonably determines that the brother, with power of attorney, has abused or neglected his patient, he may not be obligated by law to treat the brother as a "personal representative." If this were not the case, then Dr. Doe can feel perfectly comfortable discussing the patient's condition with the brother.

Added complications

The situation becomes even more difficult if Dr. Doe's patient is lucid most of the time, instead of the opposite situation described above. This is because the releasability of protected health information depends on whether a person has, at the time of the release, the actual authority to make healthcare decisions on behalf of the patient.

In some cases, the patient's inability to make decisions for him or herself is perfectly clear, and no one would dispute it. But because dementia usually has such a slowly progressive nature, the point of incompetence may be subject to debate.

On some days, the patient may be able to make complex decisions for himself; on other days, not. In this situation, the HIPAA regulations are not at all clear.

When the patient is plainly competent, the privacy rule would in fact prohibit Dr. Doe from revealing the biopsy results and treatment plan to the patient's brother. The brother, holding the power of attorney, represents an "agent in waiting."

Before the power of attorney becomes effective, the brother in this particular case might become frustrated at not being able to receive updates from Dr. Doe. However, that is the entire purpose of the HIPAA privacy rule.

Although HIPAA privacy rules have some basis in common sense, they can also be confusing. To avoid this frustration and uncertainty, some lawyers have begun to draft medical powers of attorney that actually take effect before the patient loses full capacity to make decisions. Unfortunately, such "early" power of attorney is not recognized by every state.

Dr. Doe's predicament is not unusual. His decisions must be guided by both the law and reasonable common sense.

David Goldberg, M.D., J.D., is director of Skin Laser & Surgery Specialists of New York and New Jersey; director of laser research, Mount Sinai School of Medicine; and adjunct professor of law, Fordham Law School.