Section Review

Fractured HIPAA: Dealing with the new privacy regulations in estate planning

Kenneth P. Brier is the principal of Brier & Associates, Needham, whose practice focuses on tax, estate planning and wealth preservation matters.

HIPAA (the Health Insurance Portability and Accountability Act of 1996) has thrown a monkey wrench into estate planning. The problem may represent a classic example of the law of unintended consequences. But the consequences are real - and serious. Estate planners will now need to take HIPAA considerations into account in drafting new estate-planning documents, and they will also need to focus on the need to update existing documents.

HIPAA, among other things, sought to strike a balance between the free flow of medical information, especially electronic information, and the assurance of privacy of such information. As required by HIPAA, the Department of Health and Human Services in 2002 issued lengthy and detailed privacy regulations, which required compliance by April 14, 2003. These regulations strictly prohibit doctors, hospitals and other health care providers from disclosing any private medical information to non-patients, except pursuant to a carefully structured set of exceptions. This is the rub.

Effect of HIPAA privacy regulations on estate planning

Estate planning necessarily deals, in several contexts, with the possibility of an individual's losing the ability to handle his own affairs. Estate-planning documents have commonly dealt with possible incapacity by providing for a letter from the individual's doctor to certify as to the individual's ability or inability to handle his affairs. Now the law may prohibit the doctor, in many instances, from writing any such letter.

The need to determine an individual's competence may arise in several types of legal arrangements:

•  Durable powers of attorney that "spring" into effect only when the principal is incapacitated;

•  Health care proxies under which the agent similarly is empowered only when the principal is incapacitated;

•  Trust documents that provide for the automatic removal of individual trustees upon their incapacity;

•  Partnership and limited liability company agreements that automatically change the status of general partners and managing members upon incapacity; and

•  Revocable trusts where the donor has retained full powers to revoke the trust and to exercise various other retained powers.

The individual's lawyer might also need to know whether he has the capacity to sign any new documents or make new gifts.

General authorization to disclose medical information

The HIPAA problem can be dealt with by properly crafting the legal documents. As a backstop to the incorporation of HIPAA provisions in the "regular" estate-planning documents, it makes sense for an individual to sign an authorization for release of HIPAA-protected information as needed for estate-planning purposes. Among other regulatory requirements, such an authorization must be a document separate from any other document. The authorization should deal with all of the situations described in the bulleted information above, as well as disclosures to the client's lawyer.

Health care providers are not legally required to honor any such omnibus authorization, but they are permitted to do so, and presumably most will do so in most circumstances. The written authorization is itself a backstop to a general "friends and family" authorization provided in the regulations, which may permit disclosures even in the absence of any written document. But just as no planner would rely on the somewhat vague "friends and family" exception, neither should any planner rely on a merely permissive written authorization, to the extent that any alternatives are available. HIPAA should be specifically addressed in the "regular" documents.

Health care proxies

A health care proxy (under whatever name it may bear in a particular state) doubtless is the key document for purposes of HIPAA estate planning. However, the interrelationship of HIPAA and estate-planning considerations is probably most troublesome for health care proxies, since the state law in many states (apparently most states) requires that the power of the agent "spring" only upon a showing of incapacity, usually by a doctor's certification. In these states, a lawyer may only draft a springing power. Under the privacy regulations, once the agent is empowered under state law, the agent is treated as a HIPAA "personal representative" and the doctor then is required to disclose any and all information to him. But how can the doctor disclose such information if the agent is not yet empowered? There is a real chicken-and-egg problem in states where information provided by the doctor is critical in triggering the agent's power.

The Massachusetts health care proxy statute is of the "springing" kind, but it appears to be kinder to estate planning than the analogous statutes in many other states. Though the specific interrelationship of HIPAA and the Massachusetts health care proxy statute is open to some question, the better view seems to be that an agent's power "springs" under the Massachusetts statute without the agent needing first to obtain any information from the patient's doctor. If that is the case, then, as a strictly legal matter, no special HIPAA language is needed in a Massachusetts health care proxy, and no procedures are required to authorize the doctor to talk with the agent.

The Massachusetts statute, General Laws chapter 201D, section 6, states in pertinent part:

The authority of a health care agent shall begin after a determination is made, pursuant to the provisions of this section, that the principal lacks the capacity to make or to communicate heath care decisions. Such determination shall be made by the attending physician. … The determination shall be in writing….. [It] shall be entered into the principal's permanent medical record.

… Notice of a determination that a principal lacks capacity to make health care decisions shall promptly be given orally and in writing: (1) to the principal, where there is any indication of the principal's ability to comprehend such notice; (ii) to the agent; and (iii) if the patient is in or is transferred from a mental health facility, to the facility director.

Under section 6, the agent's power apparently "springs" as soon as the doctor makes a determination of incapacity (an internal, subjective mental process), and in any event it should "spring" no later than the time when the doctor records his determination in writing and enters it into the medical record (an external, objective process). To make such a determination, the doctor may want to confer with the patient's designated agent. Though the doctor could not yet disclose protected information to the designated agent, there should be no bar on the designated agent conveying any relevant information to the doctor. Once the doctor has made (and recorded) a determination, the agent is empowered under Massachusetts law and entitled under HIPAA to receive medical information. At that point, the Massachusetts statute indeed directs the doctor to disclose information regarding the patient-principal's incapacity. If the agent were not already empowered under Massachusetts law, then presumably the state law direction to disclose incapacity would be in conflict with the HIPAA privacy regulations.

Irrespective of this reading of the Massachusetts statute, for present purposes it is still prudent to include HIPAA authorization language in a Massachusetts health care proxy. There are three reasons to do so. First, until there is a definitive judicial determination, there is always a possibility that the Massachusetts statute could be construed in a manner different from the interpretation suggested here. Second, a client might end up receiving medical care in another state where a less favorable "springing" statute prevails (and where the health care providers are accustomed to a different standard). Third, at a time of medical emergency, even one occurring in Massachusetts, the last thing that a doctor or hospital, or a patent's family, would want to be doing would be to be calling in the lawyers to untangle the relationship of HIPAA and the Massachusetts health care proxy statute. Providing the "magic" language right in to the document might serve to provide comfort to the health care providers and shortcut the medical consultation process. If they see the "right" language in the document, they might be prompted to put aside any further question of the agent's authority.

The health care proxy should contain an explicit statement that the agent is intended to be the principal's personal representative for HIPAA purposes, and it may be suggested that the agent be expressly authorized to receive medical information immediately upon execution of the document. That immediate authorization, of course, is not really consistent with the "springing" Massachusetts statute, so a health care provider (employing a sharp-eyed lawyer) might reasonably take the position that the immediate designation to receive HIPAA-protected information is void. This problem might be dealt with by stating the health care proxy is also intended to constitute a durable power of attorney (and is not affected by the principal's incapacity), to the extent that it bestows any powers beyond those authorized under the health care proxy statute. The provisions effectuated as a durable power of attorney could be effective immediately. In drafting a health care proxy, the draftsman in all events should avoid any language, more restrictive than Massachusetts law, to the effect that the agent's power is effective only after he has received notification of the principal's incapacity.

With a valid Massachusetts health care proxy in place, the client will have appointed a "personal representative" (in HIPAA parlance) entitled, and not just authorized, to receive medical information in all events. Having such an appointment in place may be particularly important to unmarried partners (opposite sex or same sex) whose eligibility to receive protected information on the other partner might otherwise be questioned. All of this makes the health care proxy the keystone in HIPAA estate planning.

Durable powers of attorney

Assuming that a "personal representative" is validly appointed under a health care proxy, there seems little reason to do anything further in a client's general durable power of attorney. It has been suggested that the power of attorney could be used as an additional vehicle to appoint "personal representatives," though there is a real question whether any such appointment would be valid. A close reading of the privacy regulations indicates that a "personal representative" must first be a person possessing authority under state law to make health care decisions, and that would not generally be the case for an attorney-in-fact. Moreover, it is questionable whether having multiple individuals in the personal representative role would serve any useful purpose or whether it might indeed make matters more confusing.

There have always been good reasons to avoid springing durable powers of attorney, and HIPAA now adds another. It imposes still one more obstacle in getting to use the power for its intended purposes when the occasion arises. To the extent that a planner may still decide to structure the power as springing, he should generally avoid any arrangement requiring the delivery of a doctor's certification to the designated attorney(s)-in-fact. The certificate might be delivered instead to the health care agent, though there would then need to be a mechanism to insure that the information will be forwarded to the attorney(s)-in-fact. As a backstop, the client's omnibus HIPAA authorization should authorize the delivery of medical information to any person designated to serve as an attorney-in-fact (not restricted to persons already so serving).

Other documents

Appointment of "personal representative" under a valid health care proxy should eliminate any problems in obtaining medical evidence of a client's incapacity for purposes of his own revocable trust, as long as the agent is willing to share such evidence. Neither the client nor his lawyer, however, can fully control the documentation of other individuals - trustees and beneficiaries - whose capacity or incapacity would be relevant to the administration of a trust (revocable or irrevocable). The trust instrument might still designate a doctor's certificate as presumptive evidence of incapacity, but it is dangerous to make it the exclusive means of determining incapacity. The trust instrument might require each trustee, as a condition of accepting office, to sign an authorization to disclose medical information. A better, and certainly less intrusive, approach probably would be to provide for a trustee's automatic resignation if he does not timely provide such an authorization upon reasonable request. Another possibility is to appoint a separate "protector" to remove trustees. (But then who removes an incompetent protector?) A draftsman could deal in a similar way with the provisions in a partnership agreement related to general partners and in an LLC operating agreement related to managers and managing members.

©2017 Massachusetts Bar Association