The HIPAA authorization and the successor trustee

Suppose a revocable trust says the grantor becomes incapacitated when a licensed physician determines it in writing and delivers that determination to the successor trustee. The clause is ordinary, and it lets the successor trustee take over without a court. It also assumes the physician will talk to the successor trustee.

Under the HIPAA Privacy Rule, a successor trustee has no right to the grantor’s medical information, and neither does an agent under a financial power of attorney. A provider may share some information with people involved in the patient’s care, but whether to share is the provider’s decision. A HIPAA authorization signed in advance gives the provider the patient’s own written permission to share with the people it names. Anyone left off the list who is not the patient’s personal representative is back to relying on the provider’s discretion.

Who the privacy rule treats as the patient

The rule has a category for people who stand in the patient’s place. Under 45 CFR 164.502(g), a person whom state or other applicable law allows to make health care decisions for an adult must be treated as that adult’s personal representative, with respect to the health information relevant to that authority. A personal representative can see the records, exercise the patient’s other rights under the rule, and sign authorizations for the patient. The rule has an exception that lets a provider decline to treat a person as a personal representative when it reasonably believes doing so could endanger the patient and judges that declining is in the patient’s best interest.

The HHS guidance on personal representatives gives three examples: a health care power of attorney, a court-appointed guardian, and a general or durable power of attorney, but only one “that includes the power to make health care decisions.” A durable power of attorney that covers only money does not make its agent a personal representative. A trustee holds no authority over health care, so the trust does not make its trustee one either. After death the category changes. An executor or administrator becomes the personal representative for the information relevant to administering the estate.

HHS ties the scope of personal-representative status to the person’s authority under state law and says that law should be consulted. Health care documents often give the agent authority only after the patient can no longer make decisions. It follows, though HHS does not say so in terms, that an agent whose authority has not begun is unlikely to be treated as a personal representative yet.

What family can be told without one

The rule does let providers talk to family. Under 45 CFR 164.510(b), a provider may disclose to a family member, a relative, a close friend, or anyone else the patient identifies, the information directly relevant to that person’s involvement in the patient’s care or in paying for it. When the patient is present and able to decide, the provider asks, gives the patient a chance to object, or infers from the circumstances that the patient does not object.

When the patient is not present, or cannot agree or object because of incapacity or an emergency, the provider decides whether a disclosure is in the patient’s best interest and limits it to what is directly relevant to the person’s involvement in care or payment. The disclosure is permitted, not required, so a provider can decline. A written determination that lets a trustee take over the grantor’s finances is not clearly information about the trustee’s involvement in care or in paying for it, and a provider may not see the request as falling under this section at all.

What an authorization adds

An authorization under 45 CFR 164.508 is written permission for providers to disclose health information to specific people. The regulation sets out core elements a valid one must contain, among them a description of the information, the name of each person or class of persons who may receive it, the purpose, an expiration date or event, and a signature and date. Among the statements it must carry is notice that the signer can revoke it in writing.

Signed in advance, the authorization records the patient’s own choice of recipients. A successor trustee on that list has a signed basis to ask the grantor’s physician for the determination the trust requires, and the provider can release it without first deciding whether the trustee is involved in the grantor’s care. The authorization permits that disclosure and does not compel it, so a provider can still decline, and the provider’s question becomes whether the authorization is valid and covers the record requested.

An authorization can also be signed later by a personal representative, within that person’s authority. Once a health care agent’s authority is in effect, the agent may be able to authorize disclosure to the successor trustee. That route runs through the agent’s own authority having begun, which often depends on a determination of the same kind the trustee is waiting for.

An authorization grants no authority over care. It lets the named people receive information and gives none of them the power to make medical decisions. That power still comes from a health care power of attorney or a similar designation under state law.

The recipient list beside the other documents

Each incapacity document in a plan names people. The trust names a successor trustee and often one or more after that. A financial power of attorney names an agent and successors, and a springing power of attorney may take effect on a physician’s statement. The health care document names an agent. The HIPAA authorization names its recipients. The trust and the powers of attorney each come from their own questionnaire, so a successor trustee or a financial agent can be named in one document and absent from the authorization.

The question to put to the household at a review meeting is a factual one: are the people named in the trust and the powers of attorney also named in the HIPAA authorization? The answer is on the face of the documents, and the household is the one who says whether it matches what it intended. The comparison includes the second successor trustee, who serves if the first cannot or will not. Whether a person named in the trust has agreed to serve at all is a separate question, and the conversation before signing is where it belongs.

A mismatch is sometimes deliberate. A grantor may want a successor trustee to receive a physician’s determination without seeing mental health treatment records, or may not want an adult child reading anything until the child has a role. An authorization can be limited by category of record, so the household can include one person for some purposes and leave another off. A household that wants a different list can sign a new authorization. The old one ends when it is revoked in writing or reaches the expiration it states.

How Bancroft handles it

The revocable trust the platform generates treats the grantor as incapacitated on a written determination delivered to the successor trustee named in the trust. The methods it lists include a physician’s written determination. Where the governing law allows a delayed start, the financial power of attorney asks whether the agent can act immediately or only after a physician’s written statement.

The HIPAA authorization is its own document with its own questionnaire:

• Recipients. The household lists as many people as it wants, each by full legal name and relationship. The health care agent and successors named in the household’s health care power of attorney are suggested as recipients for the household to confirm.
• Scope. All records or a defined subset, with custom restrictions routed to attorney review where the questionnaire offers them.
• Sensitive records. Separate yes-or-no answers for HIV/AIDS test results, substance use treatment records, and mental health treatment records.
• Expiration. Until the household revokes it in writing, stated as the expiration event, or a date the household chooses, in the forms the governing law accepts.

The generated authorization states the purpose of the disclosures it permits. Generating a document carries no fee on any plan, and HIPAA authorizations sit outside the Advisor plan’s annual limit on wills and trusts, so a household that wants a different recipient list can sign a new authorization without a charge for the document. The billing and plans help article lists what each plan includes, and the successor trustee guide is written for the person the trust names.

To see the trust, power of attorney, and HIPAA questionnaires side by side, book a demo.