A person who qualifies under applicable law as an Individual’s Personal Representative may be treated by System as the individual for purposes of this Manual. The purpose of this Policy is to identify the process by which a determination shall be made. It does not represent an attempt to set forth all the applicable laws under which a person may qualify as a Personal Representative of an Individual.
4.12(1) Identification of Personal Representatives
- A person qualifies as an Individual’s “Personal Representative” to the extent the person has authority under applicable state or federal law to act on the Individual’s behalf in connection with the individual’s PHI including a person with authority to act on behalf of a deceased Individual or the Individual’s estate.
- A person who presents him or herself to System as the Personal Representative of an Individual in order to exercise the rights of that Individual under the HIPAA Privacy Rules and/or this Manual shall be required to provide documentation of his or her status to the Privacy Officer, except that in the case where a person presents himself or herself as the parent of an Individual who is a minor child, verification may be based on confirmation of the child’s enrollment as the dependent minor child of the person in a benefit plan administered or sponsored by System, in the absence of evidence that the person is not the child’s legal representative.
- In the case of a person whose representation is based on an attorney-client relationship with the Individual, the person must present or transmit by facsimile a verification of legal representation.
- The Privacy Officer shall determine whether the documentation indicates that under applicable law the person is legally entitled to act on behalf of the Individual.
- Notwithstanding paragraph c of this subsection, the Privacy Officer may elect not to treat a person as an Individual’s Personal Representative if (i) the Privacy Officer has reasonable belief that (A) the Individual has been or may be subjected to domestic violence, abuse, or neglect by such person or (B) treating such person as the personal representative could endanger the Individual; and (ii) the Privacy Officer, in the exercise of professional judgment, decides that it is not in the best interest of the Individual to treat the person as the Individual’s personal representative.
- To be considered an Individual’s Personal Representative, the person must also verify his or her identity as that person through the verification processes described in Section 4.10 of this Policy.
- System reserves the right to request a person previously determined to be a Personal Representative to reconfirm that status by producing current sufficient proof of such status at any time that System believes such reconfirmation is in the best interest of the Individual or System.
4.12(2) Authority of Personal Representatives
If the Privacy Officer determines that a person is an Individual’s Personal Representative, System shall treat such person as the Individual for purposes of this Manual. For example, the person has the authority to sign and revoke Authorizations on behalf of the Individual, and the person has the authority to exercise the Individual’s privacy rights described in this Manual on behalf of the Individual.
4.12(3) Documentation of Personal Representative Determinations
Upon making a determination regarding whether to recognize a person as an Individual’s personal representative, the Privacy Officer shall+ document the determination and retain such documentation in accordance with Section 9.2 of this Manual.
REFERENCES/CITATIONS
45 C.F.R. § 164.502(g)
