Does having a health care power of attorney (POA) allow access to the patient’s medical and mental health records under HIPAA?

Answer:

Generally, yes. If a health care power of attorney is currently in effect, the named person would be the patient’s personal representative (The period of effectiveness may depend on the type of power of attorney: Some health care power of attorney documents are effective immediately, while others are only triggered if and when the patient lacks the capacity to make health care decisions and then cease to be effective if and when the patient regains such capacity).

“Personal representatives,” as defined by HIPAA, are those persons who have authority, under applicable law, to make health care decisions for a patient. HIPAA provides a personal representative of a patient with the same rights to access health information as the patient, including the right to request a complete medical record containing mental health information. The patient’s right of access has some exceptions, which would also apply to a personal representative. For example, with respect to mental health information, a psychotherapist’s separate notes of counseling sessions, kept separately from the patient chart, are not included in the HIPAA right of access.

Additionally, a provider may decide not to treat someone as the patient’s personal representative if the provider believes that the patient has been or may be subject to violence, abuse, or neglect by the designated person or the patient may be endangered by treating such person as the personal representative, and the provider determines, in the exercise of professional judgment, that it is not in the best interests of the patient to treat the person as the personal representative. See 45 CFR 164.502(g)(5).