1. WHAT GUARDIANSHIP ATTORNEYS SHOULD KNOW BY RACHEL ANNE BROOKS MARCH 15, 2016 Health Care Privacy

2. Sources of Law THE BIG ONES HIPAA (43 CFR 164) RCW Chapter 70.02

3. More Sources of Law GR 22 CPG SOP 402.5 RPC 1.6 RCW 5.50.060

4. HIPAA Health Insurance Portability and Accountability Act

5. HIPAA Applies to “Covered Entities”: Health Care Providers Health Plans Health Care Clearinghouses

6. HIPAA Applies to “Protected Health Information” (“PHI”)

7. HIPAA HIPAA does not directly apply to lawyers.......... However,

8. HIPAA If you represent a Covered Entity, and You receive PHI, then Congratulations, HIPAA applies to you!

9. HIPAA A lawyer for a Covered Entity who receives PHI is considered a “Business Associate.” This is a fairly new (2013) expansion of the definition of “Business Associate.”

10. HIPAA Duties of a lawyer as “Business Associate”: Enter into a Business Associate Agreement. This is really your client’s duty as the “covered entity,” but you’re the lawyer, so make sure it happens. Sample Business Associate Agreements can be found at HHS.gov

11. HIPAA Other duties of a lawyer as “Business Associate” include but are not limited to: Do not disclose PHI except as permitted Limit disclosure of PHI to “minimum necessary” Report breaches of confidentiality to client (and report significant breaches to HHS) Ensure employees and subcontractors are compliant

12. HIPAA Duties of lawyer as “Business Associate” – Further Reading: http://www.americanbar.org/publications/gp_solo/ 2013/july_august/new_hipaa_liability_lawyers.htm l http://www.americanbar.org/publications/gp_solo/ 2013/july_august/new_hipaa_liability_lawyers.htm l http://www.lawtechnologytoday.org/2015/04/lawye rs-as-business-consultants-under-hipaa-how-to- stay-compliant/ http://www.lawtechnologytoday.org/2015/04/lawye rs-as-business-consultants-under-hipaa-how-to- stay-compliant/

13. HIPAA When can a “Covered Entity” disclose PHI to a lawyer? [When] the covered entity, in good faith, believes the use or disclosure * * * “is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person” and “is to a person * * * reasonably able to prevent or lessen the threat.” 45 CFR 164.512(j).

14. HIPAA When can a lawyer disclose PHI to another party? Pursuant to the Business Associate Agreement To the extent minimally necessary Here’s my standard business associate agreement: http://www.rachelbrookslaw.com/hipaa-policies/ http://www.rachelbrookslaw.com/hipaa-policies/ Feel free to copy and improve it.

15. RCW 70.02 MEDICAL RECORDS— HEALTH CARE INFORMATION ACCESS AND DISCLOSURE

16. RCW 70.02.060 HEALTH CARE SUBPOENA PROCEDURE Applies to discovery request and subpoenas served on a health care provider Requires at least 14 days advanced notice to the provider and the patient