HIPAA and court orders and custody oh my!

[T-Bird78]

Ugh. We have a pt threatening to file a HIPAA complaint against my office. Mom has custody of child and only listed mom and mom’s siblings on HIPAA form. Child was with dad and dad called to schedule a follow up appt for child, which we did schedule. Mom was about 10 minutes late to appt and is very upset that we even allowed dad to schedule the appt, let alone allow dad to be in the room with the child without mom. Dad did bring child to appt. That’s not a HIPAA violation, right? We can’t screeen every person who calls to schedule an appt, and scheduling in and of itself isn’t giving any information out.

Second one recently, mom has custody of child and did not put dad on HIPAA form. Dad called to ask results of office visit and we could not, and did not, provide any information other than telling dad he is not on HIPAA form. Dad is very mad and has been sending copies of DNA tests and court documentation that he is in fact the bio dad and has equal legal rights to child. Mom refuses to put dad on HIPAA, so we can’t really tell dad anything despite court orders, right?

[Here.I.Stand, BSN, RN]

On 8/2/2019 at 6:10 AM, T-Bird78 said:

We’re not removing their rights to the child at all. What the HIPAA communication form does is tell us who we CAN share information with. If someone who is NOT on that communication form calls to get information from us, we can’t provide any information. We have married couples who don’t put their spouse on the HIPAA form and have the same conversation with them.

By denying the legal FATHER his child’s medical information, that’s kind of EXACTLY what you are doing.

[NICUmiiki, DNP, NP]

My understanding is that as long as dad is legally dad (on birth certificate or established by court) and there is no court order taking away his rights to his child, then he has the EXACT same rights to health information as mom. Mom doesn't get to take away his rights by filling out a form. He could actually fill out his own HIPAA form since he's just as entitled to the child as the mom.

Most custody orders provide joint custody with a domiciliary parent and visitation for the non-domiciliary. The non-domiciliary still retains the right to make decisions for the child.

[T-Bird78]

I’ll see if we ever got clarification on this. The first situation, where noncustodial dad scheduled the appointment, that mom did complain about it on our survey and cited it as a HIPAA violation (scheduling an appointment isn’t a violation) and was mad at us. Second one, I haven’t heard an update since dad did send his legal documents in. All we were going by at the time of the initial contact was mom specifically not putting dad on the HIPAA communication form. It’s not a “special form we made up”, but the standard form where people can indicate which phone number we can contact them at, if we can leave a detailed message, and with whom we can share medical information. If someone calls to seek medical information and that name is not on the HIPAA form, I don’t provide information. I’ll let you know. Thanks!!

And I agree completely that mom and dad need to grow up and willingly share information about their child. I had another one where custodial parent didn’t send child’s medication for non-custodial parent’s visitiation, so child didn’t receive the medication. At least it was something OTC, but the principle still applies.

[MunoRN, RN]

On 8/9/2019 at 7:44 AM, T-Bird78 said:

I’ll see if we ever got clarification on this. The first situation, where noncustodial dad scheduled the appointment, that mom did complain about it on our survey and cited it as a HIPAA violation (scheduling an appointment isn’t a violation) and was mad at us. Second one, I haven’t heard an update since dad did send his legal documents in. All we were going by at the time of the initial contact was mom specifically not putting dad on the HIPAA communication form. It’s not a “special form we made up”, but the standard form where people can indicate which phone number we can contact them at, if we can leave a detailed message, and with whom we can share medical information. If someone calls to seek medical information and that name is not on the HIPAA form, I don’t provide information. I’ll let you know. Thanks!!

And I agree completely that mom and dad need to grow up and willingly share information about their child. I had another one where custodial parent didn’t send child’s medication for non-custodial parent’s visitiation, so child didn’t receive the medication. At least it was something OTC, but the principle still applies.

I think you're misunderstanding the HIPAA form. The purpose is to indicate persons who can receive information who aren't already legally defined as having access to information. If the father has parental rights (which are different from custodial rights), then he doesn't have to be listed on the HIPAA form to have access to information.

[JKL33]

23 hours ago, T-Bird78 said:

It’s not a “special form we made up”, but the standard form where people can indicate which phone number we can contact them at, if we can leave a detailed message, and with whom we can share medical information. If someone calls to seek medical information and that name is not on the HIPAA form, I don’t provide information.

We all know the form you are talking about. Still, your employer, and you the employees are using it outside of its intended purpose due to misunderstanding. And in that regard employees of your office are indeed essentially making things up through the way you are using the form.

We have made it very clear: The form is merely an opportunity to list those people who otherwise would not have a legal right to the information.

Just about everyone has concurred here.

Good luck in pressing this issue with your OM.

[NRSKarenRN, BSN, RN]

Per HHS HIPAA FAQ

Does the HIPAA Privacy Rule allow parents the right to see their children’s medical records?

Quote

Answer:

Yes, the Privacy Rule generally allows a parent to have access to the medical records about his or her child, as his or her minor child’s personal representative when such access is not inconsistent with State or other law.

There are three situations when the parent would not be the minor’s personal representative under the Privacy Rule. These exceptions are:

1. When the minor is the one who consents to care and the consent of the parent is not required under State or other applicable law;
2. When the minor obtains care at the direction of a court or a person appointed by the court; and
3. When, and to the extent that, the parent agrees that the minor and the health care provider may have a confidential relationship.

However, even in these exceptional situations, the parent may have access to the medical records of the minor related to this treatment when State or other applicable law requires or permits such parental access. Parental access would be denied when State or other law prohibits such access. If State or other applicable law is silent on a parent’s right of access in these cases, the licensed health care provider may exercise his or her professional judgment to the extent allowed by law to grant or deny parental access to the minor’s medical information.

Finally, as is the case with respect to all personal representatives under the Privacy Rule, a provider may choose not to treat a parent as a personal representative when the provider reasonably believes, in his or her professional judgment, that the child has been or may be subjected to domestic violence, abuse or neglect, or that treating the parent as the child’s personal representative could endanger the child.

[Horseshoe, BSN, RN]

Just because a parent (in this case the father) doesn't have primary custody of his child DOES NOT MEAN that the mother can dictate that you not share information on the child with the father. The only entity that could deny the father his rights to his child's medical information is a court by virtue of court order, or as stated above, a very defendable and rational conclusion that the father presents a clear and present danger to the child.

You and your office need to better educate staff and clarify your policies before you get sued.

[Horseshoe, BSN, RN]

On 8/9/2019 at 7:44 AM, T-Bird78 said:

Second one, I haven’t heard an update since dad did send his legal documents in. All we were going by at the time of the initial contact was mom specifically not putting dad on the HIPAA communication form. It’s not a “special form we made up”, but the standard form where people can indicate which phone number we can contact them at, if we can leave a detailed message, and with whom we can share medical information. If someone calls to seek medical information and that name is not on the HIPAA form, I don’t provide information. I’ll let you know. Thanks!!

And I agree completely that mom and dad need to grow up and willingly share information about their child. I had another one where custodial parent didn’t send child’s medication for non-custodial parent’s visitiation, so child didn’t receive the medication. At least it was something OTC, but the principle still applies.

The father's name doesn't have to be on the HIPAA form as being allowed to receive information...because he is the father.

The mother's name isn't on that list either, because she filled out the form...as is her right as the mother. But the father is also entitled to fill out a HIPAA form too...because he is the father and has not had his parental rights taken away by court order. This is the part you aren't getting.

PARENTS have the right to access medical information on their children...they don't need the other parent's permission unless the court has dictated that to be the case. IF that were the case, the burden falls on the mother to provide proof of that.

Your office is IN THE WRONG. You need to amend your policy here and pay special attention to divorced/unmarried/estranged parents and make sure you are not violating their rights. I'm sure it's a hassle, but it must be done.

[beachynurse, ASN, BSN]

On 8/1/2019 at 9:10 AM, JKL33 said:

1. Custody and parental rights are two different things. The general idea is that non-custodial parents have the same rights to their child's information as non-custodial parents unless court proceedings or state law applied to the situation says otherwise. HIPAA does not give custodial parents the power to write something on a random office form with the expectation that having done so blocks the other parent's rights. *My understanding.

2.

I suspect your office is very wrong about this (or at least your rationale is) and I would get the correct answer from your legal counsel PRONTO. HIPAA does not remove anyone's lawful rights!!

It sounds like your office would also do well to inform parents of your legal obligations and what this does/doesn't mean - once you get the correct answer.

I don't think you are in the right by blocking a parent whose parental rights have not been altered by the courts or limited according to the laws of your state!

These things are pretty big deal. I would talk to your OM about your concerns right away.

I agree totally. Unless Mom can produce something legally binding from the court barring Dad from the information, your office might be in more trouble with holding the information from Dad if he chooses to take legal action. Unless legally barred he is just as entitled to any information as the mother.