NOTE:  This policy does not govern the procedures to follow in cases involving requests for access to the PHI of an unemancipated minor by the parent, personal representative or legal guardian of such unemancipated minor.  In those instances, follow the procedures set forth in Manual Exhibit 2-7-Q, “Policy and Procedure for Protected Health Information of Unemancipated Minors.”
 

5 U.S.C. 552a(h)
 

45 CFR §§ 5b.5(b)(2)-5b.10
 

45 CFR §§ 164.502(g); 45 CFR 164.510(b)(1)(ii)
 

45 CFR 164.512(c)(1) and (2)
 

45 CFR 164.524(a)(3)(ii)
 

42 CFR Part 2
 

(5 U.S.C. § 552a (h); 45 CFR §§5b.10; and 45 CFR § 164.502(g) (1), (2), (5))

 

Personal Representative.  Any person who, under applicable law, has authority to act on behalf of an individual who is an adult or an emancipated minor in making decisions related to health care.  A personal representative may include, but is not necessarily limited to, the legal guardian of any such individual who has been declared incompetent due to physical or mental incapacity by a court of competent jurisdiction. (5 U.S.C. 552a (h); and (45 CFR § 164.502(g)(2))
 

Confirming the Status of the Personal Representative.  Before disclosure of the PHI of an adult or emancipated minor may be made to any individual claiming to have authority to access such PHI as the personal representative of such individual, the facility must obtain adequate documentation to support the determination that the requestor has the authority under applicable law to act as the patient’s personal representative. See Manual Exhibit 2-7-R, “Policy and Procedure on Verification of Identity Prior to Disclosure of Protected Health Information.”  The Chief Executive Officer (CEO) may contact the appropriate Office of General Counsel (OGC) where there is doubt regarding an individual’s personal representative status, including whether a court of competent jurisdiction has appointed the individual to serve as the patient’s legal guardian.
 

Disclosure of PHI to Personal Representatives.  If the CEO determines that an individual is the personal representative of an emancipated minor or adult, then the service unit must treat the personal representative as the patient for purposes of access under HIPAA Privacy Rule and the Privacy Act.  Any requests for access by the personal representative shall be handled pursuant to the IHS policy governing access to patient medical records, Manual Exhibit 2-7-A, “Policy and Procedure for Patients’ Rights to Access, Inspect, and Obtain a Copy of Their Protected Health Information.”
 

Exceptions.  The IHS does not have to inform the personal representative of an emancipated minor or an adult that it made a disclosure of the individual’s PHI to a government authority which is authorized by law to receive reports of abuse, neglect or domestic violence, if it reasonably believes the personal representative is responsible for the abuse, neglect or other injury and, in the exercise of its professional judgment, it believes that informing the legal representative would not be in the best interests of the individual. (45 CFR § 164.512(c)(1) and (2)(ii))
 

Requests for Disclosure of Alcohol/Drug Abuse Records.  Requests by a personal representative for access to records governed by the Confidentiality of Alcohol and Drug Abuse Patient Records, 42 CFR Part 2, shall only be released in compliance with those regulations.
 

Accounting Requirements.  Any PHI released to a personal representative (First party requestor) will be documented on the IHS-505, Disclosure Accounting Record, or in the Resource and Patient Management System, Release of Information software application. See Manual Exhibit 2-7-B, “Policy and Procedure for Matters Related to Accounting of Disclosures of Protected Health Information.”