Most of us have heard of HIPAA — the federal law designed to protect the privacy of our medical information. But the way our medical information is collected and stored has changed dramatically since HIPAA’s current “Security Rule” was last substantially updated.
Medical records are now largely electronic. We communicate with doctors through online patient portals. Health care systems increasingly rely on outside technology companies, and artificial intelligence (AI) is beginning to be used for everything from transcribing doctor visits to assisting with medical diagnoses.
Unfortunately, these technological advances have also created new opportunities for hackers and identity thieves. Federal regulators at HHS (Health and Human Services) report dramatic increases in major health information breaches, particularly those involving hacking and ransomware.
New HIPAA Protections Are Coming — But Not Yet
The federal government has proposed a major overhaul of the HIPAA Security Rule. Among other things, the proposed changes would generally require stronger protections such as encryption of electronic health information, multi-factor authentication (like when your bank or credit card company sends you a verification text), more frequent security testing and improved procedures for responding to cyberattacks.
The new requirements were originally expected much sooner. However, the government’s current regulatory agenda now projects July 2027 for final action — and even that date is not guaranteed. Until a new rule becomes final, the existing , weaker HIPAA Security Rule remains in effect.
So what does all of this have to do with your estate plan?
Quite a bit.
Privacy Is Important — But So Is Access
HIPAA is designed, in part, to prevent your private medical information from getting into the wrong hands. That’s obviously important.
But there may come a time when it is equally important to make certain that your medical information does get into the right hands.
Suppose you become seriously ill or incapacitated. The person you have chosen to make health care decisions for you may need to speak with your doctors, obtain medical records, discuss your condition and evaluate treatment alternatives.
That’s one reason our estate plans typically include a separate Authorization for Release of Medical Information under HIPAA and California’s Confidentiality of Medical Information Act (CMIA).
The purpose is straightforward: to make sure the appropriate people can obtain the medical information they may need when acting on your behalf.
Three Documents That Should Work Together
Your medical information authorization shouldn’t be viewed in isolation. It should be coordinated with two other important documents in your estate plan:
• Your Advance Health Care Directive, which identifies who can make health care decisions for you when you can’t; and
• Your Durable Power of Attorney, which authorizes the people you select to handle certain financial and other matters if necessary, including paying for your health or nursing care expenses not covered by insurance or government benefits.
You also should have a valid Health Document Emergency Card, to speed up the availability of your private medical information to your legal representatives when the time comes. (If you’re not sure whether you have this card and it is still valid, simply reach out to us and we’ll check.)
As the years go by, the people you originally selected to act for you regarding your medical care may no longer be the people you want acting for you. A family member may have died, become ill, moved away or simply no longer be the best choice. Your relationship with them could have changed as well.
That’s why periodically reviewing who is authorized to receive your medical information — and making sure those choices remain consistent with the rest of your estate plan — is important.
The Bottom Line
Technology will continue to change. HIPAA will continue to evolve with it. And eventually, the federal government is likely to impose significantly stronger requirements for protecting electronic medical information.
But you don’t have to wait until 2027 to address the part of HIPAA that directly affects your estate plan.
Make sure your medical information is protected from the wrong people — while remaining accessible to the right ones when you need them most.
Based in part on an article provided by Elder Law Answers.
