Marriage, Spouse, and Family Member
The definition of a family member in the Privacy Rule at 45 CFR 160.103 includes the terms spouse and marriage. The term marriage includes all lawful marriages. A lawful marriage is any marriage sanctioned by a state, territory, or a foreign jurisdiction as long as a U.S. jurisdiction would also recognize the marriage performed in the foreign jurisdiction. The term spouse includes all individuals who are in lawful marriages without regard to the sex of the individuals. The term family member includes lawful spouses and dependents of all lawful marriages. In addition, the terms marriage, spouse, and family member apply to all individuals who are legally married, regardless of where they live or receive health care services.
• The definition of a family member is relevant to the application of §164.510(b) regarding permitted uses and disclosures of PHI related to another person’s involvement in an individual’s care, and for making notifications about the individual’s location, general condition, or death. Under certain circumstances, covered entities are permitted to share an individual’s protected health information with a family member of the individual. Legally married spouses are family members for the purposes of applying this provision.
• The definition of a family member is also relevant to the application of §164.502(a)(5)(i) regarding the uses and disclosures of genetic information for underwriting purposes. This provision prohibits health plans, other than issuers of long-term care policies, from using or disclosing genetic information for underwriting purposes. For example, health plans may not use information regarding the genetic tests of a family member of the individual, or the manifestation of a disease or disorder in a family member of the individual, in making underwriting decisions about the individual. This includes the genetic tests of a lawful spouse of the individual, or the manifestation of a disease or disorder in the lawful spouse of the individual.
Subject to limited exceptions, the Privacy Rule at 45 CFR 164.502(g) requires covered entities to treat an individual’s personal representative as the individual with respect to uses and disclosures of the individual’s protected health information and for purposes of exercising the individual’s rights under the Privacy Rule. For example, a personal representative of an individual is able to review and obtain a copy of the individual’s medical record or authorize disclosures of protected health information. In determining who is considered a personal representative, and thus able to act on behalf of an individual and exercise the individual’s rights under HIPAA, the Privacy Rule generally looks to state laws governing which persons have authority to act on behalf of an individual in making decisions related to health care. Under the Privacy Rule, if a state provides legally married spouses with health care decision-making authority on behalf of one another, a covered entity is required to recognize the lawful spouse of an individual as the individual’s personal representative without regard to the sex of the spouses.