[Cross-posted at HealthLawProfs blog.]
Under HIPAA, patients’ spouses and other family members have certain rights to access health information. In an important guidance document in the wake of United States v. Windsor, the Office for Civil Rights (OCR) at HHS has clarified that “spouse” under HIPAA refers to legally married same-sex spouses, even if the individual is receiving services in a jurisdiction not recognizing same-sex marriage.
This guidance deals with several specific provisions of HIPAA. First is the definition of “family member” in 45 CFR 160.103, added in the omnibus rule-making for the HITECH Act and GINA. This definition applies to both the HIPAA security and the HIPAA privacy rules. It provides that relatives by “marriage” are to be treated the same as relatives by consanguinity and that spouses are first-degree relatives. According to the guidance, “spouse” includes “individuals who are in a legally valid same-sex marriage sanctioned by a state, territory, or foreign jurisdiction (as long as, as to marriages performed in a foreign jurisdiction, a U.S. jurisdiction would also recognize the marriage).” In addition, “marriage” includes “both same-sex and opposite-sex marriages” and “family member” includes “dependents of those marriages.” These definitions hold whether or not an individual lives in a jurisdiction recognizing same sex marriage and whether or not the individual is receiving health care services in a jurisdiction recognizing same sex marriage.
The second provision treated in the guidance is 45 CFR §164.510(b), the section of the Privacy Rule governing when individuals must be given an opportunity to agree or object to uses or disclosures of protected health information. This standard permits disclosure to family members of information directly relevant to the family member’s involvement in a patient’s care, with certain limitations. It also permits disclosure of information needed to inform family members of the patient’s location, general condition, or death, again with limitations. If the patient is available and competent, they must agree to or be given an opportunity to object to the disclosure, or the provider must reasonably infer that they do not object. An example is a family member picking up a prescription for another family member.
The third provision to which the guidance applies is 45 CFR §164.502(a)(5)(i), the provision that prohibits health plans, other than issuers of long-term care policies, from using or disclosing genetic information for underwriting purposes. Such plans may not use information about family members’ genetic tests or the manifestation of disease in family members to make underwriting decisions. Here, too, “family member” encompasses same-sex spouses on the same basis as opposite sex spouses.
The HIPAA privacy rule also contains provisions regarding rights of personal representatives. In general, the structure of the rule is to defer to state law regarding who counts as a patient’s personal representative. Many states have surrogate decision making statutes authorizing a prioritized list of others to make decisions for patients lacking decision making capacity; typical priority lists begin with the holder of the patient’s power of attorney for health care, the patient’s guardian if any, and then the patient’s spouse. These provisions are a matter of state law, however, and not part of the Privacy Rule itself. Many states also provide that personal representatives have the same rights as patients themselves with respect to health information, although some states now have advance directive statutes that invite patients to specify rights of their personal representatives to access health information. The guidance indicates that OCR is planning to issue “further clarification” or a notice of proposed rulemaking regarding same sex spouses as personal representatives. Stay tuned.
[LPF]