Custodial Care Issues: The Patient with Diminished Capacity

Providers often feel unsure about what information they can disclose about their patients when the disclosure is related to that patient’s safety and wellbeing. This blog post, the second in a series addressing custodial care issues, offers guidance to practices on how to help their patients with diminished capacity without violating their privacy. It will help practices answer the following questions:

• Do they have a procedure for evaluating whether to disclose the protected health information (“PHI”) of a patient with diminished capacity?
• Are there circumstances in which a patient diagnosed with diminished capacity is still competent to consent?
• If patients are not competent to consent, what does the practice need before it can disclose PHI to caregivers or family members?

The Case

Beverly, an 85-year-old patient who has been seen by the same practice for a long time, was diagnosed with an early stage of dementia about a year ago. Since her diagnosis, an adult woman named Nora has always accompanied Beverly to the physician’s office. Her appointments are usually scheduled before lunch, as that seems to be when Beverly is reliably lucid. Despite Nora’s regular attendance and participation in Beverly’s treatments, the doctor and the two women have never formally discussed the nature and extent of Nora’s authority or role in Beverly’s care.

Beverly and Nora show up at the office one afternoon at 4:00 p.m., and Nora explains that she needs to access certain records from Beverly’s file. Has the practice violated HIPAA by including Nora in past appointments? Can the practice disclose Beverly’s PHI to Nora now?

The Authority

HIPAA’s Privacy Rule centers around an individual’s right to access and protect his or her own PHI. At the rule’s most fundamental level, a competent adult can authorize disclosure of his or her own PHI. However, obtaining express consent from the patient is not always possible. Fortunately, HIPAA also provides guidance for disclosure in circumstances either where the patient has not consented or cannot consent.

In some cases, the patient is present and capable of giving consent, but simply has not formally done so. In these situations, a covered entity may disclose PHI if the patient has the opportunity to object but says nothing, or if the provider “reasonably infers from the circumstances, based upon the exercise of professional judgment, that the individual does not object to disclosure” (45 CFR 164.510[b][2]). Notably, however, this section does not apply in situations where the patient does not have the capacity to make healthcare decisions.

In cases where the patient cannot consent, such where the patient lacks the capacity to make health care decisions, the absence of an objection is no longer a reliable indicator of consent. Instead, a covered entity must use his or her own professional judgment to determine whether the disclosure is in the best interests of the individual (45 CFR 164.510[b][3]).

Regardless of whether the patient has not consented or cannot consent, absent a competent and express authorization, covered entities should limit their disclosure of PHI to information directly relevant to the requester’s involvement in the patient’s care or payment for that care (45 CFR 164.510[b][2],[3]).

The Result

In light of the practice’s lengthy treatment of Beverly, it can likely discern when Beverly is and is not lucid. Looking back, Nora accompanied Beverly to all of her recent treatments, scheduled at times when Beverly was usually lucid, and Beverly never objected to the practice disclosing her PHI with Nora in the room. Therefore, it was reasonable for the practice to infer that Beverly did not object to past disclosures of her PHI.

However, Nora’s request today is different. Whether the practice can make this disclosure depends on two things. First, it must determine whether Beverly has the capacity to make health care decisions this late in the day. What can be observed about Beverly’s behavior or demeanor? Second, it needs to ask Nora to specify which records she wants and why she needs them. It is much easier to conclude that disclosure is in Beverly’s best interests if, for example, Nora is only interested in Beverly’s most recent CT scan because she wants a second opinion. The broader the scope of records sought, or the more attenuated the purpose is to Beverly’s ongoing health issues, the more the practice should scrutinize the request.

Tips on Dealing with Disclosure Requests

• Ask questions. Which records are needed and how will they be used?
• Review the file before making any disclosure to make sure what may be disclosed is known.
• Avoid scenarios like this one by having patients fill out a form identifying persons who may obtain the patient’s PHI, and the duration of that person’s right to access.
• Use Curi’s HIPAA Final Rule Survival Guide as a resource. With more than sixty form templates, policies, and educational items, this document set contains the information necessary to implement privacy and security best practices.

Disclaimer: This post is written in general terms and is not a substitute for legal advice or intended to create an attorney-client relationship.