Confidentiality, Privacy & Security


Bonnie S. Ormond, RHIA07-25-2018 05:33

Victor N Moturi, MBA with Health Care Adm,RHIA,CHTS-CP,CHTS-IS,MBA07-26-2018 06:35

  • 1.  POA

    Posted 07-25-2018 00:18
    Hi, I am receiving conflicting information regarding Power of Attorneys. I have been told by my Risk Manager that we cannot release records or speak to the designated POA unless the patient is declared incapacitated. However my CEO is telling me we can release records and talk to the POA. Could someone please help me with this?

    Cyli Resendiz
    Medical Records Supervisor

  • 2.  RE: POA

    Posted 07-25-2018 05:33
      |   view attached
    You have received a secure message
    Read your secure message by opening the attachment, securedoc.html. You will be prompted to open (view) the file or save (download) it to your computer. For best results, save the file first, then open it in a Web browser. To access from a mobile device, forward this message to to receive a mobile login URL.

    If you have concerns about the validity of this message, contact the sender directly.

    First time users - will need to register after opening the attachment. For more information, click the following Help link.
    Help -
    About Cisco Registered Email Service -



  • 3.  RE: POA

    Posted 07-26-2018 09:47

    It depends on how the POA is worded. 

    Some stipulate that they do not go into effect unless the person is unable to make decisions and give clear guidance on what documentation is required.    Typically a doctor's note, sometimes two.  

     It really is a matter of reading the POA completely. 

    Ruth Heinz

    Manager, Health Information Management Department

    R1 RCM Inc. |

    St Vincent Health

    2001 W 86th Street | Indianapolis, IN 46260

    phone 317-338-2067

    fax 317-583-2155  

    Please note my email address has recently changed. 

    The information transmitted in this message (including any attachments) is intended only for the person or persons to whom it is addressed, and may contain material that is confidential and/or privileged. Any review, re-transmission, dissemination or other use of the information contained herein by persons or entities other than the intended recipient is prohibited. If you have received this message in error, please notify the sender immediately and delete this message.

  • 4.  RE: POA

    Posted 07-25-2018 07:35
    Let look at it this using my own example. I am the POA for my Dad ,he is still alive,but I handle all his health communications.
     Just thinking..Good morning. 

  • 5.  RE: POA

    Posted 07-25-2018 08:48
    In Wisconsin, we will not honor a POA that has NOT been activated.   The patient is still competent to make his or her own decisions.

    Nancy Davis, MS, RHIA, CHPS
    Director of Compliance & Safety
    Door County Medical Center

  • 6.  RE: POA

    Posted 07-26-2018 06:35
    Please review the Power of Attorney. There should be provisions in it stating when it should be effective. Also confirm if it’s a Health Care Power of Attorney or the other for managing financial. If you are in doubt contact the Attorney that drafted it ...


  • 7.  RE: POA

    Posted 07-26-2018 17:20
    ​Thank you all for your help, I will pass this information along

    Cyli Resendiz
    Medical Records Supervisor

  • 8.  RE: POA

    Posted 07-27-2018 12:31
    ​We do not honor POA if there is not a healthcare clause in it for records, only for financial documents.  If it is strictly financial we don't release records.  I am POA for my mother and have been for 3 years.  I have not had to prove enactment in any way.  I have been able to use it for banking, selling property, changing address with insurance/Medicare, terminating phone/cable service, etc.   How would one know that it was enacted?

    Pamela Gonterman
    Director of HIS/Coding

  • 9.  RE: POA

    Posted 07-28-2018 14:34

    Here are some front-line tips and cautions about POAs and related documents, in medical records and in patient care.  (I'm *not* an attorney, but this is how it played out in my office in one US state. I say "Agent" to describe the "A" in POA - A person creates a POA to delegate powers to their Agent.)

    People often are confused because there are many variations among POA's. You have to answer a few questions before you start problem-solving!

    A basic distinction is between a POA that goes into effect immediately - versus - one that is "springing" or "triggered," meaning it will go into effect only when certain conditions become true. Either type of POA might also be set up to be "Durable" - meaning that once it goes into force, those powers belong to the agent permanently (unless overridden by a court).

    (1) Your Risk Manager is thinking of the second basic type: one that is designed to go into effect *ONLY* if the person becomes incapacitated, or is unable to communicate, or is permanently unconscious, or becomes temporarily psychotic or manic, etc. The POA itself should specify exactly what those triggering conditions are. Sometimes it will specify exactly *how* those conditions are to be judged - for example, "if two physicians agree that..." or "if testing determines that..."  Once the POA is triggered, the Agent takes over the powers listed and their judgment is substituted for the person's. If the POA is "Durable" then, once the person is incapacitated by dementia or other conditions, the Agent is in charge, even if the person wants to write a check or becomes angry at the agent. (Some POAs, e.g., Advanced Psychiatric Directives, may have provisions for being turned back "off" when the person has recovered their capacity.)

    Understand that a well-executed health-care POA doesn't "expire," any more than a marriage certificate or adoption does. Get legal consultation before you reject one based only on its date.

    CHECK YOUR STATE LAW to understand obligations and limitations for health-related POAs or Durable POA's. (They may be bundled into the same document as an Advance Directive, or may be a separate Power of Attorney for Health Care, or appointment of a Health Care Proxy.)  These are pretty serious directives and are generally witnessed and notarized - but as far as I know, no states require them to be filed with a court.


    (2) There is another whole category of POA documents that are created more informally and don't follow the state-law specifications for the first group. Essentially, these delegate chores or errand to an agent, for the convenience of the person. The person *DOES NOT* give the agent any power to make decisions to overrule them. If the person and the Agent disagree, follow the instructions of the person!

    These POA's go into effect as soon as they are written, unless they say differently. They appoint an agent to carry out certain tasks in the person's absence. These can be revoked at any time by the person. (Just as with HIPAA authorizations, as soon as you get a statement from the person revoking the informal POA, treat it as revoked from that time forward.)

    Those lesser POA's often delegate the agent to do a few specific things (charge items to the person's account, pick up packages, pick up their employer's child at school, transport them, enroll them in activities, consent to routine or urgent medical care). Some of them broadly allow the agent to run the household and finances and care for the kids while the person is out of the country or incarcerated. The wording matters, and they're all different! (If the basic document passes inspection, and the desired power is specifically named, we usually went ahead if the instructions seemed reasonable and fit what we knew already about the person and family - but we had a manager or clinician sign off on that plan to go along.)

    Watch out for the POA's that use a few words to cover anything and everything, *or* that only specifically mention financial items. I did not accept any for non-emergency health-care or HIPAA purposes unless they specifically addressed heath care / health records.

    There are two big issues with this big category of less-formal POAs -- "Is it forged, or real?" AND "Is it outdated, or still good?" I usually try to determine those conditions before getting far into the details of what kinds of permission the specific document gives.

    If the *person* brings the document to you, and says it is still in force, document that! And ask for confirmation at each readmission. (Perhaps have the person execute those same instructions on your own form, if you have an appropriate one.)

    If the *agent* brings you a document, claiming to have powers, then apply due diligence: check whether it has the person's notarized signature, and whether it has a recent date. If not, is there any way you can contact the person directly to confirm the document? A phone call can solve a lot of problems. With the passage of time, it may have been revoked, relationships may have changed, etc.


    We tried to balance customer service and practical problem-solving against a healthy amount of suspicion against scammers and stalkers! You see how that can get complicated. You can set policies to require recency of date, notarization, etc. I like to involve a clinical manager to try to reach a sensible decision that didn't put undue burdens on the person or family. Particularly in low-income families, or those who are fearful of courts or attorneys, people may give serious instructions about their wishes in formats that don't tick all the formal boxes. Telling them to "go to court and then come back with an order" isn't always a patient-centered policy. Even telling the person to appear at your office to sign a new document might require taking a day off work, getting childcare, paying for a ride, etc. Balance your own risk management against the patient's needs and resources. When you're crafting policies and procedures in these areas, you need Social Work or Patient Advocates sitting in as well as Risk Management, or your procedures won't work in true-life practice.

    (Finally, notice that people often confuse a POA with a Guardianship. A guardianship is more sweeping, and it SUBSTITUTES the guardian's judgment over the persons. It must be ORDERED by a court, based on persuasive evidence that the person is incapacitated. Guardianships rank over POAs; Health providers *must* follow a Guardian's instructions in much the same way they would follow a parent's instructions for a minor's care. If someone says they're the Guardian, but can't produce a signed, dated COURT ORDER, they haven't proven their status. You could be helpful by offering to contact the court that allegedly issued it, but you do encounter people who think they are Guardians... who aren't.)

    Hope this is helpful in untangling the real-life messes!

    Ruth Czirr
    Retired Privacy Officer / Compliance Officer

  • 10.  RE: POA

    Posted 08-09-2018 12:53
    Hello Ruth,

    I'm not sure if you can help me with this question.... Say a patient's condition rapidly declines and they are non responsive but not yet in a coma. The doctor wants to put them on hospice asap because of the patients severe state. The patient does not have a POA of any sort. Is the patient's spouse able to make emergent medical decisions? Is the doctor able to make a "good faith" decision and put the patient on hospice? In this situation the facility social worker is making them go to court to get guardianship papers, I believe. This is not in my facility but someone was asking me about a situation like this. My thinking was that the provider/spouse should be able to make an emergent good faith decision to put the patient on hospice. Is that thinking off base?


    Jennifer Hoffman
    Health Information Manager

  • 11.  RE: POA

    Posted 08-10-2018 12:44
    Your hypothetical scenario: Say a patient's condition rapidly declines and they are non responsive but not yet in a coma. The doctor wants to put them on hospice asap because of the patients severe state. The patient does not have a POA of any sort. Is the patient's spouse able to make emergent medical decisions? Is the doctor able to make a "good faith" decision and put the patient on hospice? The facility social worker is making them go to court to get guardianship papers... shouldn't the provider/spouse be able to make an emergent good faith decision to put the patient on hospice?

    Hi, Jennifer - You're raising a question of risk management, where your facility and docs are balancing duties and risks in a situation without a clear directive. I'm not an attorney, and your state may have laws that touch this, or court decisions that do. (e.g., Your state *might* have a line in a statute that says the next-of-kin can make urgent medical decisions, or a recent decision that said a guardianship should have been required.)

    Strategically: Is the objecting social worker at the sending hospital, or the receiving hospice? (Or are you just changing treatment plans within the same facility?) Are they citing a firm facility RULE? If they're giving their *opinion* it may well be mistaken; even a "rule" may have exceptions if you talk with someone higher up the organization.

    My much-appreciated malpractice attorney used to ask: "As a clinician, what do you think is the *best* thing to do for the patient?" Then she would lay out *who* might have a right to object, what *grounds* they might rely on, and how *likely* it seemed that the conflict could result in actual trouble for us, and encouraged us to weigh what risk we were willing to take. (Some attorneys are implacably risk-adverse, and will insist on court orders for everything. My personal feeling is that's not who you need in a health-care setting - it becomes both unwieldy and cruel.)

    In this scenario: if you work from a humane, best-for-patient, don't-cause-unneeded-suffering position, then forcing the patient to die in an ICU when they could have hospice comforts seems cruel. And making a grieving spouse leave the bedside, go to court, and pay for lawyering seems harsh. The spouse is the next of kin (everywhere in the US, as far as I know). The physician sees nothing else available to cure in an acute setting. You may be running up ICU bills for the family, basically so you can continue to torture the patient and withhold the standard-of--palliative-care.

    From a risk standpoint: Who's afraid of getting sued? (Or are they afraid of not getting paid?) Is the hospital afraid of being sued for "not continuing aggressive treatment"? (Or is the hospice afraid to admit for some reason?) My lawyer would ask, "*Who* could sue for that?"  If there's a conflicted family in an uproar, or one person is insisting on DOING EVERYTHING, then asking the spouse to get an order might be the least-painful next step for everybody. (Do remember that a guardianship hearing requires proof / evidence / testimony that the person is incompetent - with most judges, it's not just filling out a form.) Even if a relative *is* objecting, do they have "standing" to sue? Would they have grounds to sue? In many situations, the answers are no.

    (Some of the high-profile cases in the US have been a Parent of an adult patient who's demanding treatment at all costs, while the Spouse says patient would not want that and the team is saying they can't benefit. If you're in a state where that could get highly politicized as a right-to-life case like the Terry Schiavo one, you need an attorney to guide your decisions, and asking for a guardianship is probably the lowest-impact way to protect the spouse as well as the facility.)

    In my own ethical worldview, as a clinician, I'd be assessing the family as the next step. If they were in agreement with the spouse, we'd document that along with the medical team's recommendation. Often the spouse or others can make statements about how they know the patient would have made this choice. Document all that and go forward.

    If family was conflicted, I'd call in my best family therapist (or best chaplain) for a serious counseling meeting. Address the emotional blocks or family conflicts, and also make sure they understood the actual medical prognosis and actual subjective experience of a patient in hospital vs a patient in hospice. (Some of those situations arise between the caregiver, who knows exactly how dire things are and how much as been tried, and the least-involved kid or sibling, who is *shocked* to see the patient's condition and thinks there *must* be something the doctors can do.) See whether the objector(s) shift their feelings.

    (Your scenario doesn't say whether this was a sudden emergency - e.g., a catastrophic brain bleed out of nowhere - vs a long decline. I'm guessing the former, since it comes with more confusion and shock, and family not all gathered on site. That's another element in the risk equation - are you afraid the spouse will change their mind and blame the doc? Has there been too much confusion in the family?)

    Sometimes there's one very loud relation who's a baby sister or a grandparent, who's a strong personality but actually very far down the list of legal kin - then, what the rest of the family may need to move forward is the experience of seeing how unreasonable they are being, and your reinforcement that they are indeed doing the best thing, despite what they wish could be possible.

    Sure, a family session costs resources, but far less than an acute care day. Sometimes we try to frame things as legal problems with legal solutions, just to be able to move forward. But telling spouse to go get guardianship does nothing to lance the boil if the underlying problem is a nasty family mess. (My mom was still catching hell 50 years later for getting an emergency order to hospitalize a family member in a crisis.)

    Hope this is a helpful viewpoint.

    Ruth Czirr
    Retired Privacy Officer / Compliance Officer

  • 12.  RE: POA

    Posted 08-17-2018 11:01
    Yes this does help! Thank you so much, Ruth!

    Jennifer Hoffman
    Health Information Manager

  • 13.  RE: POA

    Posted 08-16-2018 11:46
    Good questions, but bottom line is you need to check with your state law.  Perhaps you have a hospital or agency attorney who could help you with the answer.

    Kathryn Boyes
    Director, HIM

  • 14.  RE: POA

    Posted 07-28-2018 15:44

    Cyli: You said: However my CEO is telling me we can release records and talk to the POA.

    Another problem-solving approach is to shift frames away from "POA," and ask "What does HIPAA Friends and Family allow us to do?"

    If patient has executed a POA appointing this person as their health care proxy in extremis, then surely the person named is close enough to fit the "Friends and Family involved in care" category of HIPAA. Unless the patient specifically objects, you absolutely have HIPAA clearance to SPEAK with this person!

    Once you determine what the person wants / needs, first look at it in a HIPAA frame - do they want info from records to help care for the person? Need records to be shared with other provider? Their request might be totally covered by basic HIPAA exceptions. (And if you haven't already, go to the HHS site and download a selection of the big set of guidance and FAQ docs released early in 2017 to explain Friends and Family involvement! Very handy to share with Risk Manager, balky clinicians, others who are not up to date on those important provisions.)

    *Also* read the POA using the pointers in my other post. If it *is* set up so that it does not take effect *until* a trigger event occurs, then helpfully point that out to the Agent. They may need to get a second, much simpler document to use in the meantime (e.g., one appointing them as a Representative for HIPAA or for Social Security Disability purposes).

    (I see some POA's that are very over-written - they go on for pages beyond what's needed. As a result people believe they "cover everything" but crucial provisions get buried in all the garble and others aren't there after all.)

    Best, RC 

    Ruth Czirr
    Retired Privacy Officer / Compliance Officer

  • 15.  RE: POA

    Posted 07-30-2018 20:35

    Cyli, you asked: could you help me find the link where the HHS has guidance and FAQ docs released early in 2017 to explain Friends and Family involvement!

    Now I can't find the list-of-links page, but here are several direct spots. A lot of this is *not* well known among clinical and medical-records professionals!

    Fact Sheets for Patients:

    Providers Guide:

    several specific FAQs with citations - skim the questions, may directly address your situation:

    MANY fact sheets etc that touch on mental health / friends & family

    Hope this is helpful.

    Ruth Czirr
    Retired Privacy Officer / Compliance Officer

  • 16.  RE: POA

    Posted 08-16-2018 11:48
    ​The POA document should state when it becomes effective.  Most I have seen requires 1-2 doctors to declare incompetent to make decisions for the medical decision making POA to be effective.  Make sure the POA covers medical and not just business, etc.

    Kathryn Boyes
    Director, HIM