How does a covered entity identify an individuals personal representative?
State or other law determines who is authorized to act on an individuals behalf, thus the Privacy Rule does not address how personal representatives should be identified. Covered entities should continue to identify personal representatives the same way they have in the past. However, the HIPAA Privacy Rule does require covered entities to verify a personal representatives authority in accordance with 45 CFR 164.514(h).
