Mary Miller is the surviving spouse of Stanton Miller, who resided in a nursing care facility owned and operated by Alvista Healthcare Center, Inc. After he died intestate on March 19, 2006, Ms. Miller, who was investigating a potential wrongful death action, requested copies of his medical records from Alvista in January and March 2008. Those requests were denied on the ground that, under the Health Insurance Portability and Accountability Act of 1996 HIPAA and the privacy regulations promulgated thereunder, the records could be released only to a permanent executor or administrator of Mr. Miller’s estate, which was still unrepresented. On March 4, 2008, Ms. Miller brought this action against Alvista and related entities Appellants, seeking a temporary restraining order and permanent injunction requiring release of the medical records, as well as a declaratory judgment that she is entitled to those records. The trial court granted all requested relief, determining that, because OCGA § 31-33-2 a 2 B specifically authorizes a surviving spouse to obtain access to her deceased spouse’s medical records, Ms. Miller “has authority to act on behalf of a deceased individual or of the individual’s estate” and, therefore, must be treated as a “personal representative” to whom protected health information may be disclosed. 45 CFR § 164.502 g 4. R. 59-62 The Court of Appeals affirmed, holding that a surviving spouse who wishes to pursue an action for the decedent’s wrongful death has authority to act on his behalf, as the measure of damages for wrongful death in Georgia is the full value of the decedent’s life to him, rather than to the surviving spouse who brings the action. Alvista Healthcare Center v. Miller , 296 Ga. App. 133, 137 1 673 SE2d 637 2009. Having granted certiorari to review this ruling, we affirm the judgment of the Court of Appeals, but on a different basis. We hold that OCGA § 31-33-2 a 2 B authorizes a surviving spouse to act on behalf of the decedent or his estate in obtaining medical records and, therefore, that the surviving spouse is entitled to access the decedent’s protected health information in accordance with 45 CFR § 164.502 g 4.
HIPAA “authorized the Secretary of the department of Health and Human Services to promulgate rules and regulations which would ensure the privacy of patients’ medical information. 42 USC § 1320d-2 d 2 A.” Moreland v. Austin , 284 Ga. 730, 731 670 SE2d 68 2008. Those privacy regulations apply ” ‘to the protected health information of a deceased individual.’ 45 C.F.R. § 164.502 f . . . . In cases of a deceased individual, the covered entity must ‘treat a personal representative as the individual.’ 45 C.F.R. § 164.502 g 1.” Estate of Broderick , 125 P3d 564, 570 Kan. App. 2005. If under applicable law an executor, administrator, or other person has authority to act on behalf of a deceased individual or of the individual’s estate, a covered entity must treat such person as a personal representative under this subchapter, with respect to protected health information relevant to such personal representation. 45 CFR § 164.502 g 4. This definition is a functional one and, therefore, the “ applicable law” to which the regulation refers clearly is state law. See Daniel B. Evans, What Estate Lawyers Need to Know about HIPAA and “Protected Health Information” , 18-AUG Prob. & Prop. 20, 22 2004; Helen W. Gunnarsson, Are Statutory Health Care POAs HIPAA-Compliant , 92 Ill. B.J. 302, 303 2004 ” ‘Applicable law’ generally means state law, since that’s what governs who may act on behalf of another.”. Ms. Miller asserts that OCGA § 31-33-2 a 2 B constitutes the “ applicable law” which gives her “authority to act on behalf of the deceased individual or of the individual’s estate.”
