Lead Opinion
Mаry Miller is the surviving spouse of Stanton Miller, who resided in a nursing care facility owned and operated by Alvista Healthcare Center, Inc. After he died intestate on March 19, 2006, Ms. Miller, who was investigating a potential wrongful death action, requested copies of his medical records from Alvista in January and March 2008. Those requests were denied on the ground that, under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the privacy regulations promulgated thereunder, the records could be released only to a permanent executor or administrator of Mr. Miller’s estate, which was still unrepresented. On March 4, 2008, Ms. Miller brought this action against Alvista and related entities (Appellants), seeking a temporary restraining order and permanent injunction requiring release of the medical records, as well as a declaratory judgment that she is entitled to thosе records.
The trial court granted all requested relief, determining that, because OCGA § 31-33-2 (a) (2) (B) specifically authorizes a surviving spouse to obtain access to her deceased spouse’s medical records, Ms. Miller “has authority to act on behalf of a deceased individual or of the individual’s estate” and, therefore, must be treated as a “personal representative” to whom protected health informаtion may be disclosed. 45 CFR § 164.502 (g) (4). The Court of Appeals affirmed, holding that a surviving spouse who wishes to pursue an action for the decedent’s wrongful death has authority to act on his behalf, as the measure of damages for wrongful death in Georgia is the full value of the decedent’s life to him, rather than to the surviving spouse who brings the action. Alvista Healthcare Center v. Miller,
HIPAA “authorized the Secretary of the Department of Health and Human Services to promulgate rules and regulations which would ensure the privacy of patients’ medical information. 42 [USC] § 1320d-2 (d) (2) (A).” Moreland v. Austin,
If under applicable law an executor, administrator, or other person has authority to act on behalf of a deceased individual or of the individual’s estate, a covered entity must treat such person as a personal representative under this subchapter, with respect to protected health information relevant to such personal representation.
45 CFR § 164.502 (g) (4). This definition is a functional one and, therefore, the “applicable law” to which the regulation refers clearly is state law. See Daniel B. Evans, What Estate Lawyers Need to Know about HIPAA and “Protected Health Information”, 18-AUG Prob. & Prop. 20, 22 (2004); Helen W. Gunnarsson, Are Statutory Health Care POAs HIPAA-Compliant?, 92 Ill. B.J. 302, 303 (2004) (“ ‘Applicable law’ generally means state law, since that’s what governs who may act on behalf of another.”). Ms. Miller asserts that OCGA § 31-33-2 (a) (2) (B) constitutes the “applicable law” which gives her “authority to act on behalf of [the] deceased individual or of the individual’s estate.”
Prior to 2006, OCGA § 31-33-2 did not expressly recognize the applicability of HIPAA, and it specified several different persons, any of whom could obtain a deceased patient’s record. Ga. L. 2002, pp. 641, 642, § 2. In 2006, however, the General Assembly amended subsections (a) and (b) of the statute so as “to change certain provisions relating to furnishing a copy of records to patient, provider, or other authorized person” and “to provide for compliance with” HIPAA. Ga. L. 2006, p. 494. Thus, OCGA § 31-33-2 (b) (1) now provides, in pertinent part, that any request for a deceased patiеnt’s medical records by a person authorized under subsection (a) (2) shall be accompanied by an authorization in compliance with HIPAA and its implementing regulations. Subsection (a) (2) requires
(A) The executor, administrator, or temporary administrator for the decedent’s estate if such person has beеn appointed; (B) If an executor, administrator, or temporary administrator for the decedent’s estate has not been appointed, by the surviving spouse; (C) If there is no surviving spouse, by any surviving child; and (D) If there is no surviving child, by any parent.
Thus, subsection (a) (2) establishes a definite order of priority with respect to who is authorized to obtain a deceased patient’s medical records. The first priority, set forth in OCGA § 31-33-2 (a) (2) (A), obviously is consistent with the specification in 45 CFR § 164.502 (g) (4) of an executor, administrator, or other person having authority to act on behalf of the decedent or his estate. OCGA § 31-33-2 (a) (2) (B) applies only if an executor or administrator has not been appointed. The evident purpose of subsection (a) (2), when read in conjunction with subsection (b) (1), is to identify several persons, the executor or administrator being the first choice and the surviving spouse being thе second, who have authority to submit an authorization in compliance with HIPAA and to obtain medical records on behalf of the decedent or his estate. Accordingly, we conclude that OCGA § 31-33-2 (a) (2) constitutes the applicable state law to which 45 CFR § 164.502 (g) (4) refers and that subsection (a) (2) (B) necessarily implies that, when there is no executor or administrator, the surviving spouse is granted authority to act on behalf of the decedent or his estate with respect to requests for medical records.
45 CFR § 164.502 (g) (4) requires that “a covered entity” such as Alvista “treat such person” having authority to act on behalf of the decedent or his estate “as a personal representative . . . with respect to protected health information relevant to such personal representation.” As the preceding discussion of OCGA § 31-33-2 (a) (2) makes clear, that statute trеats the surviving spouse as a personal representative in lieu of the executor or administrator with respect to requests for medical records. Subsection (a) (2) (B) of the statute establishes a limited personal representation in the surviving spouse for the express purpose of obtaining the decedent’s medical records in compliance with HIPAA. The Georgia statute does not provide for personal representation by the surviving spouse for other purposes. However, the statute permits her to obtain all types of medical records, other than mental health records as excepted by OCGA § 31-33-4, and subject to the preservation in OCGA § 31-33-6 of the privileged or confidential nature of communications recognized in
Contrary to the contention of the dissent, the federal regulation does not require that the person having authority to act on behalf of the decedent or his estate and requesting medical records must intend to make future use of those records in her fiduciary capacity as a personal representative. When the person having authority to act on behalf of the decedent or his еstate makes a request for medical records which is within the scope of that authority, the very request constitutes an action in that person’s capacity as a limited personal representative. Indeed, such request is the only action which can come within the limited personal representation established by OCGA § 31-33-2 (a) (2) for the purpose of obtaining medical records. Once the medical records arе obtained by a person authorized by state law to act on behalf of the decedent or his estate by requesting them, 45 CFR § 164.502 (g) (4) does not restrict the future use of those records. After obtaining the medical records, therefore, the surviving spouse may pursue a wrongful death claim, she may seek appointment as administrator in order to bring a survival action on behalf of the estate pursuant to OCGA § 51-4-5 (b), she may do both, or she may do neithеr.
The logical result of the dissent’s analysis is that a wrongful death complaint, together with any affidavit required by OCGA § 9-11-9.1, cannot be filed unless and until an estate has been opened, there has been an appointment of an executor or administrator who is willing to cooperate with the potential wrongful death claimant, and the executor or administrator has made a request for the decedent’s medical records soon enough to prevent the action from being barred by the statute of limitations. However, nothing in either OCGA § 31-33-2 (a) (2) or 45 CFR § 164.502 (g) (4) requires the appointment of an executor or administrator and what may be an otherwise unnecessary administration of an estate. To the contrary, both the Georgia statute and the federal regulation provide for a request by a person who is neither an executor nor an administrator. If the very statutе tailored to comply with 45 CFR § 164.502 (g) (4) could not be considered to provide anyone other than an executor or administrator with authority to act on behalf of the decedent or his
Appellants contend that 45 CFR § 164.502 (g) (4) preempts OCGA § 31-33-2 (a) (2). However, HIPAA and the related regulations do not preempt any state law which provides more stringent requirements for the disclosure of protected health information. Moreland v. Austin, supra at 733; Allen v. Wright,
Accordingly, we hold that, when OCGA § 31-33-2 (a) (2) (B) is applicable, a surviving spouse has authority thereunder to act on behalf of the decedent or his estate by requesting his medical records and, thus, is entitled to access the decedent’s protected health information pursuant to 45 CFR § 164.502 (g) (4). We further hold that the Court of Appeals correctly affirmed the trial court’s entry of injunctive and declaratory relief. Contrary to Appellants’ contention, the Court of Appeals did not hold that a trial court could circumvent HIPAA merely by entering an order compelling the production of medical records. The Court of Appeals clearly required that any such order must, as did the trial court’s order here, “ ‘compl[y] with HIPAA requirements for the disclosure of such records.’ [Cit.]” Alvista Healthcare Center v. Miller, supra at 138 (2). The entry of the trial court’s order was not erroneous on the ground that the constitutional right of privacy, as set forth in King v. State,
Judgment affirmed.
Dissenting Opinion
dissenting.
Under the Health Insurance Portability and Accountability Act of 1986 (HIPAA) and its regulations, a covered entity may release the protected health information of a deceased individual to a requesting individual if three requirements are met: (1) under state law, the individual requesting the information is “an executor, administrator, or other person [who] has authority to act on behalf of a deceased individual or of the individual’s estate”; (2) the executor, administrator, or other person is acting in this capacity on behalf of a deceased individual or his estate; and (3) the protected health information which is being requested is “relevant to such personal representation.” 45 CFR § 164.502 (g) (4). In this case, irrespective of any raw authority Mary Miller might have to request the protected health information of her deceased husband under Georgia law, she was not acting on her husband’s behalf when she made the request which is the subject of this litigation. To the contrary, she was acting on her own behalf in pursuit of a wrongful death claim, and her request for records was in no way relevant to any authority to act on behalf of her deceased husband. Accordingly, Miller’s request did not satisfy the requirements of 45 CFR § 164.502 (g) (4), and I must respectfully dissent.
HIPAA was passed to guarantee the privacy of a patient’s medical information. Moreland v. Austin,
Mere authorization to act is not sufficient, however. In addition to having authorization, an individual seeking the protected health
Applying these prerequisites to the facts of this case, Miller has some authority under state law to request the health records of the decedent. OCGA § 31-33-2 (a) (2) (B) allows a surviving spouse to request the health reсords of a decedent if no executor, administrator, or temporary administrator has been appointed. Accordingly, HIPAA’s first prerequisite may be arguably satisfied. This bare authority, standing alone, does not satisfy the remaining two requirements of HIPAA, however. For her request for protected health information to be valid, Miller must have made her request in her capacity as a personal representative, and the requеsted documents must be relevant to the furtherance of her responsibilities as a personal representative.
It is undisputed that the basis for Miller’s request was her desire to file a wrongful death action. Such an action is for the benefit of a decedent’s survivors, not the decedent or his estate. See Lovett v. Garvin,
To find otherwise, the majority opinion focusеs only on the first prerequisite under HIPAA and fails to properly consider the other two. This deficiency is evident in the majority’s holding, which states: “We hold that OCGA § 31-33-2 (a) (2) (B) authorizes a surviving spouse to act on behalf of the decedent in obtaining medical records and, therefore, that the surviving spouse is entitled to access the decedent’s protected health information in accordance with 45 CFR § 164.502 (g) (4).” As explained above, howevеr, the mere authority to act on behalf of the decedent, standing alone, is insufficient to pierce the privacy guarantees of HIPAA. Authority to act must be combined with an appropriate fiduciary purpose, and the protected health information must be relevant to the completion of this fiduciary purpose. By failing to give full consideration to these additional requirements, the majority eliminates the morе exacting privacy protections of a federal law with the less stringent requirements of a state law which does not require that the release of health care records of a deceased person be relevant to the personal representation of the deceased. The fundamental problem with the majority’s analysis is that it interprets HIPAA as if it were concerned only with the identity of the person whо requests protected health information without any consideration for the purpose or nature of the request. By status alone, a surviving spouse is allowed to access the protected health information of the decedent, irrespective of whether she intends to use that information for her own benefit. In fact, under the majority’s analysis, it would be possible for a surviving spouse, who has been disinherited under a decedent’s will, to immediately request health care records before an administrator or executor is appointed in order to raise a caveat. This would hardly qualify under any scenario as an act by a personal representative on behalf of the decedent. It is, in fact, the opposite extreme of a self-interested party acting against the interest of the decedent or his estate. In short, the majority misconstrues 45 CFR § 164.502 (g) (4) by effectively deleting the words “on behalf of” from its text and ignoring the most basic meaning of the term “personal representative.”
While 45 CFR § 164.502 (g) (4) restricts the field of persons qualified to request documents and the purposes for which such requests may be made, OCGA § 31-33-2 limits only the field of persons, not purposes. For this reason, the majority is also incorrect in its preemption analysis. 45 CFR § 164.502 (g) (4) is more stringent than OCGA § 31-33-2. Because HIPAA allows the relеase of protected health information for a much more limited purpose than OCGA § 31-33-2 (a) (2), to the extent that there is any conflict,
Therefore, for all of the reasons set forth above, I believe that Miller’s request for the protected health information of her deceased husband did not satisfy the requirements of HIPAA, and the Court of Appeals erred by finding otherwise.