HIPAA Authorizations in Decherd

Choose information access separately from decision-making authority

A HIPAA authorization can identify people you permit to receive health information and define the information and circumstances covered. It does not, by itself, appoint a healthcare decision-maker. Conversely, a person with healthcare authority under applicable state law may qualify as a HIPAA personal representative; a separate authorization is not automatically required in every situation.

Think through the roles separately: an information recipient may need updates without being asked to make decisions. A healthcare agent may need decision-making authority, and state law can affect whether that person is treated as your personal representative for HIPAA purposes. Avoid assuming that naming someone in one document gives them every other role.

• Information recipient: access to the health information described in the authorization.
• Healthcare agent or alternate: a role addressed through healthcare-planning documents, such as an advance directive.
• HIPAA personal representative: a status that can arise from healthcare authority under state law; it is not created by an information-sharing authorization alone.

Compare scope and duration before naming recipients

A broad authorization may be convenient when several people need information, but it can allow disclosure beyond a particular event or provider relationship. A narrower authorization can identify a specific person, type of information, or purpose. Consider whether the person should be able to receive routine updates, help coordinate care, or only obtain information in a defined situation.

Also decide how long the permission should last and whether it should continue if your circumstances change. The right choices depend on whom you trust and what access is useful; the authorization should not be treated as a substitute for setting out healthcare preferences or appointing an agent.

• Who should receive information, and should each recipient have the same access?
• What information and circumstances should the permission cover?
• How long should it remain effective, and what changes should prompt a review?

Prepare a one-page access map

Before discussing documents, make a simple list with four columns: person, role, information needed, and when access is appropriate. Mark whether each person is only an information recipient or is also intended to have healthcare decision-making authority. This comparison helps reveal gaps—for example, a trusted family member may need updates while a different person is intended to act as agent.

Gather existing healthcare documents and note where copies are kept and who has them. Tennessee’s Advance Directive for Health Care form addresses an agent or alternate and healthcare preferences, and includes instructions about signing and sharing copies. Review that document alongside any authorization so the names and intended roles are consistent; the documents serve different purposes.

• List the people you are considering and their intended roles.
• Note the providers or categories of information relevant to each person.
• Identify any current advance directive or authorization and the locations of copies.

Questions to resolve in a planning conversation

Ask whether the proposed authorization matches the access each person actually needs, whether its duration and limits are clear, and how it fits with your healthcare agent and alternate. If someone has authority under a healthcare document, ask how that role relates to HIPAA personal-representative status under applicable law. Dale Law Group, PLLC offers HIPAA authorizations and related healthcare planning, including healthcare powers of attorney and advance healthcare directives.

For Decherd clients, these are Tennessee planning questions; the firm’s office is in Murfreesboro. A clear role-and-access list is a practical starting point for deciding which documents to prepare or review.