Blog

Media Pa USA PATRIOT Act Privacy Rules

Less than two months after September 11th, President Bush signed the USA PATRIOT Act. The USA PATRIOT (Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism (the “U.S.A. P.A.T.R.I.O.T.” Act), announced a wide range of new tools to strengthen the U.S. economic system from, in addition to many other things, money laundering, terrorist financing, identity theft, and fraud. Among the tools of the USA PATRIOT Act was Section 326, which virtually overhauled the account-opening process at financial institutions.  Section 326 required that the Treasury Department establish minimum standards with which financial institutions must strictly comply in order to open new accounts.  This note will outline a brief history and a few aspects of Section 326 with which we are all now faced.

Media Pa USA PATRIOT Act Privacy Rules – The History

On July 23, 2002, the Treasury Department issued the Proposed Rules for Section 326, which received overwhelming criticism from all interests.  The criticism ranged from one side advocating for a rule containing an entirely risk-based approach without any minimum identification and verification requirements, to the opposing side desiring a rule with more specific requirements [because a completely] risk-based approach would leave too much room for interpretation.  The overwhelming sentiment from all sides, however, was that the Treasury Department had underestimated the compliance burden that would be imposed on financial institutions.

On April 30, 2003, the Treasury Department adopted the Joint Final Rule for Section 326, which attempted to both increase the verification effectiveness for new accounts and decrease the needless drain on financial institutions.  Changes from the Proposed Rules to the Joint Final Rule included a narrowed definition of customer (i.e., by excluding signatories on accounts) and redefined record-keeping requirements (i.e., by requiring only notations from, not copies of, identity-verifying documents such as driver’s licenses).  Most notably, the Joint Final Rule implemented the Customer Identity Program (C.I.P.) rules.

On October 1, 2003, the C.I.P. rules became mandatory, which dictated that [a]ll financial institutions, regardless of size, have a CIP that contains customer identification and verification procedures.

Media Pa USA PATRIOT Act Privacy Rules – The Purpose

The purpose of a C.I.P. is to ensure that financial institutions know the true identity of those opening accounts.  Each institution’s C.I.P should be risk-based, and should be an integrated part of its Bank Secrecy Act and Anti-Money Laundering programs.

In establishing a C.I.P., Section 326 dictates minimum, not maximum, standards.  Therefore, the measures taken by each financial institution will vary based on many factors.  With respect to the account, aspects will include the account type, the method by which it is opened (i.e., in person or electronically), and the identity verification information provided by the customer.  With respect to the institution, considerations will include its size, location, and customer base.

In activating a C.I.P., Section 326 dictates that it will occur anytime a new customer opens a new account.  However, it may also occur in varying degrees with existing customers and existing accounts.  The essence of the meaning of an account lies in ongoing relationships, not infrequent interactions.  It is defined as a formal relationship to provide or engage in services, dealings or other financial transactions.  The gist of the meaning of customer speaks to both individuals and entities, including estates and trusts.  It is defined as a person opening a new account and an individual who opens a new account for one who lacks legal capacity (i.e., a minor) or an entity that is not a legal person (i.e., a civic group).  Taken together, all of these factors and definitions should allow an institution to conclude that it has a reasonable belief as to a customer’s true identity.

Media Pa USA PATRIOT Act Privacy Rules – The Requirements

The hallmark of a C.I.P. should be flexibility.  Accordingly, the Joint Final Rule begins with the minimum steps for a C.I.P., and then allows each financial institution to develop its own C.I.P., which must be written and approved by the institution’s Board of Directors, by building upon those steps.  The four minimum steps to a CIP are verifying identities, keeping records, comparing lists, and notifying customers.

The 1st Step – Verifying Identities

The first element of a C.I.P is verifying identities.  This step is a two-pronged procedure – the customer provides identifying items and the financial institution validates those identifying items.

To satisfy the first prong, the customer (whether an individual or an entity) must provide three essential pieces of identifying items – name, address, and identification number (with a fourth requirement, date of birth, also required of individuals).

To satisfy the second prong, a financial institution’s C.I.P should specify by what methods (whether documentary proof and/or non-documentary confirmation) it will use to validate the customer’s identifying information.  Worthy of mention is the aspect that, although the Joint Final Rule specifically includes driver’s licenses and passports, it does not preclude other forms of identification.  Presently, however, some institutions only accept these two forms of identification.  Also of note is that the exact requirement of an identification number appears to be somewhat unsettled at this point.  Granted, with respect to estates and trusts, an Employer Identification Number is obligatory, but presently some institutions also require the individual fiduciary’s Social Security Number (as well as address and date of birth).  As a word of caution, the initial information provided to a financial institution for an estate or trust should be closely monitored to ensure that it is coded properly with the Employer Identification Number of the entity, and not the Social Security Number of the individual fiduciary.  Again, as the Joint Final Rule specifies only minimum requirements, it appears that these practices, which may be initially perceived as overreaching, are, in fact, not out of bounds.  The theme to keep in mind is that the financial institution is allowed to form a reasonable belief that it knows the true identity of the customer.

The 2nd Step – Keeping Records

The second element of a C.I.P is keeping records.  In other words, what measures must the financial institution take to document that the first step – verifying identities – was in fact performed.  The C.I.P rules contain a bifurcated record-keeping system.  The identifying information (i.e., name, address, and identification number, and, with individuals, date of birth) must be kept for five years after the account is closed, and all other information must be kept for five years after the record is made.

The 3rd Step – Comparing Lists

The third element of a C.I.P is comparing lists.  The C.I.P must include procedures for determining whether a customer appears on any list of known or suspected terrorist organizations issued by the federal government.  Although this requirement seems quite onerous upon first blush, financial institutions are not required to actively seek out any and all government lists.  Although no “Section 326 Government List” currently exists, it has been stated that the Department of the Treasury will create and provide a “Section 326 List” for the industry to use for this specific purpose.

The 4th Step – Notifying Customers

The fourth element of a C.I.P is notifying customers.  Every institution must provide customers with adequate notice that they are requesting information to verify their identities.  This notice can be either given to the customers on an individual basis, such as a handout, or on a collective basis, such as a placard displayed in the bank.  The statute also has sample language in the regulation that may be used.

Media Pa USA PATRIOT Act Privacy Rules – The Conclusion

The USA PATRIOT Act is a massive tome, with the commentary on it alone capable of filing a small warehouse.  I hope this note offers a little foothold to it.

Media Pa Probate Attorneys Guide

The Media Pa Probate Attorneys Guide is the core of this website. It consists of the best, most important articles, posts, and pages on this website. Their focus is to provide the best and most complete information on a particular topic, rather than to sell my services.

Related Posts

• West Chester Pa HIPAA Powers of Attorney
• West Chester Pa Probate Attorneys Guide
• West Chester Pa Payments Family Funerals
• Resume
• West Chester Pa Estate Administration Lawyers

John B. Whalen, Jr., JD., LL.M., is an AV Peer Review Rated Preeminent 5.0 and Avvo Rated 10.0 Superb (obtaining over 95 client reviews and peer endorsements) premier and prestigious Attorney and Counselor at Law. He is located at 696 Pont Reading Road Ardmore Pa 19003. He serves all surrounding counties, on all 7 days, from 9:00 AM to 10:00 PM, and on evenings, weekends, and holidays. He provides free initial consults all seven days, provides home visits, and provides flat fee structures. He can be reached by email at [email protected], and by telephone at 1-484-417-6244. He has amassed over 60 prestigious and premier professional awards and over 5000 client reviews and endorsements. Mr. Whalen has achieved the AV Peer Review Rated Preeminent award from Martindale, AV Peer Judicial Preeminent award, the Avvo Rated Superb 10.00 award, the Avvo Rated Top Lawyer award, the Clients’ Choice Award, and the Top One Percent (1%) award. He is the recipient of the Legum Magister Post-Doctorate Degree (LL.M.) in Taxation (from the Villanova University School of Law), a recipient of the American Jurisprudence Award in Wills, Trusts, and Estates (from the Widener University School of Law), and a recipient of the ABA-BNA Law Award for Academic Excellence (from the Widener University School of Law).

HIPAA is vast

Congress enacted The Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) on August 21, 1996. The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is enormous and complex.

Critical Concerns

One of its critical concerns was protecting the privacy of the average American citizen. Prior to HIPAA’s enactment, medical records had become increasingly accessible as a result of technological advances that contributed widespread information sharing. HIPAA targeted the potential for fraudulent or improper disclosure and transmission of medical records. In doing so HIPAA has created a challenge for lawyers in Pennsylvania who seek to protect the rights of clients who need to exercise Powers of Attorney for their loved ones within the HIPAA environment.

The Privacy Rules

One of HIPAA’s requirements was the establishment of the Privacy Rules.

Prior to the HIPAA Privacy Rules (which were enacted in their current form on August 14, 2002), there was a confusing mélange of federal and state laws to govern the transmission of, and access to, health information.

Under these pre-existing laws, an individual’s health information could be shared freely between doctors, hospitals, insurers, and third party payers, without either notice to, or authorization from, the individual.

Consequently, the HIPAA Privacy Rules set federal minimum standards for the disclosure of an individual’s private health information.  The rules attempt to strike a balance between the necessary disclosures of health care information and the privacy interests of those who seek medical care.

Given that the health care marketplace is diverse, the rules are designed to be flexible and comprehensive to cover the variety of uses and disclosures that need to be addressed.

Powers of Attorney

A Pa Power of Attorney is a document that convey legal authority (to the Pa Principal) to act in the name of another person (Pa Agent) for his or her health and welfare.

Historically, health care providers have accepted Powers of Attorney readily, without questioning their validity.

In the post-HIPAA world, however, one can expect a higher level of scrutiny. In fact, the HIPAA Privacy Rules can potentially create a conflict with respect to the traditional language of Powers of Attorney. Thus, to be effective, Powers of Attorney should be drafted to comply with the requirements of the Privacy Rules.

The Privacy Rules protect all individually identifiable health information (defined as Protected Health Information or PHI) of an individual held or transmitted by covered entities (defined as health care providers who transmit any health information in electronic form).  Although the Privacy Rules allow certain uses and disclosures of such information without the consent of the Individual or that Individual’s Personal Representative (defined as a person who has the present authority to make health care decisions for that Individual), the HIPAA Privacy Rules, with few exceptions, proscribe the disclosure of PHI unless the Individual or the Personal Representative authorizes it in writing.

The Granting of Authority

Pa Powers of Attorney are designed to allow an individual the ability to grant authority to another in order to allow the Pa Agent to act on behalf of the Principal.

They can be drafted to be effective now (current powers) or effective in the future occurrence of a specific event (springing powers).

Pennsylvania law (20 Pa.C.S. § 5602(h) and (i)) allows the Principal under the Power of Attorney to grant the Agent the power to authorize “my admission to a medical, nursing, residential or similar facility and to enter into agreements for my care and the power to authorize medical and surgical procedures.”

While Powers of Attorney can be drafted to provide for a wide variety of situations, this article is limited to the impact that the Privacy Rules have on General Durable Powers of Attorney that are presently effective.

If a Power of Attorney grants the Agent the present ability to make health care decisions on behalf of the Principal, the Agent qualifies as the Personal Representative under the HIPAA Privacy Rules.

However, if a Power of Attorney does not grant the Agent the present ability to make health care decisions on behalf of the Principal to the Agent, the Agent is not considered the Personal Representative under the HIPAA Privacy Rules, regardless of the scope of the health and medical authority otherwise granted to the Agent.

In order to be effective under HIPAA, the specific authority granted to the Personal Representative (Agent) under the state defined Power of Attorney rules thus must be consistent with the definition of Personal Representative under the federally defined HIPAA Privacy Rules.

Under the Privacy Rules, a Power of Attorney that is intended to allow the Personal Representative (Pa Agent) the power to access medical records, to authorize information disclosures, and to participate in medical decisions on behalf of the Principal, but not drafted to allow the Personal Representative (Agent) the presently effective power to make health care decisions on behalf of the Principal, may be technically deficient.

Consequently, the Pa Agent may lack the critical necessary powers to act on behalf of the Principal in time of need.

Although some health care professionals may rely upon a Power of Attorney that is not drafted to comply with the Privacy Rules, they do so at their own peril.

The Effective Clause

To address this issue of presently effective powers, I use the following clause in clients’ Durable General Powers of Attorney, as well as in Advance Directives for Health Care:

“to have and utilize the presently effective power and authority to act in accordance with and pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA), its attendant Privacy Rules, 45 CFR Part 164, and/or other federal and state legislation, by having the presently effective power and authority to make any and all health care decisions on my behalf; to give informed consent for any and all health care decisions on my behalf; to be deemed to be my Personal Representative; to act in any and all matters as my Personal Representative; to obtain any and all of my Protected Health Information; to consent to the disclosure and use of any and all of my Protected Health Information; and to have the presently effective power and authority to effectuate any and all of the above.”

As stated previously, this article is limited to the impact that the HIPAA Privacy Rules have on General Durable Powers of Attorney that are presently effective.

In light of the fact that the determination of capacity is central to the effectiveness of a Power of Attorney (as well as to many other legal documents), the HIPAA Privacy Rules should not create problems for health care purposes if the Agent possesses the presently effective ability to make health care decisions on behalf of a Principal.  With a properly drafted Power of Attorney, if the Principal becomes incapacitated, the authority of the Agent is not interrupted.

Conversely, the authority of the Agent will be interrupted if the Power of Attorney is not presently effective and a determination of capacity is required to be made.  This situation exists, for example, when an Agent is to act under a Springing Power of Attorney or when a Successor Trustee is to act under a Trust Agreement.

As these scenarios are outside the realm of this article, I would suggest referring to the article, HIPAA-POA: The Effect on Healthcare Power of Attorney by Stephen H. Frishberg, Esquire. This article is contained in the PBI Publication No. 2004-3355, 11th Annual Estate Law Institute.

Stay ahead of the HIPAA Privacy Rules.

Knowledge of the precise meanings of Protected Health Information, Personal Representative, and other HIPAA terms, and how they impact our practice are fundamental to our role as counselors.

A Power of Attorney is a highly effective document when drafted correctly.  Only with the proper wording in light of HIPAA, the Privacy Rules, and the changing practice of today’s health care profession, will the Power of Attorney remain the powerful tool it is mean to be.

West Chester Pa Probate Guide

The West Chester Pa Attorneys Guide is the core of this website. It consists of the best, most important articles, posts, and pages on this website. Their focus is to provide the best and most complete information on a particular topic, rather than to sell my services.

Related Posts

• West Chester Pa Powers of Attorney Lawyers
• West Chester Pa Probate Attorneys Guide
• West Chester Pa Powers
• West Chester Pa Estate Litigation Lawyers
• Can I Sue My West Chester Pa Power of Attorney?

John B. Whalen, Jr., JD., LL.M., is an AV Peer Review Rated Preeminent 5.0 and Avvo Rated 10.0 Superb (obtaining over 95 client reviews and peer endorsements) premier and prestigious Attorney and Counselor at Law.

He is featured on Avvo, Justia, Lawyers, LinkedIn, Martindale, Nolo, Quora, and Thumbtack. He is located at 696 Pont Reading Road, Ardmore, Pa, 19003. He serves all surrounding counties, on all 7 days, from 9:00 AM to 10:00 PM, and on evenings, weekends, and holidays. He provides free initial consults all seven days, provides home visits, and provides flat fee structures. He can be reached by email at [email protected], and by telephone at 1-610-999-2157.

Mr. Whalen has achieved the AV Peer Review Rated Preeminent award from Martindale, AV Peer Judicial Preeminent award, the Avvo Rated Superb 10.00 award, the Avvo Rated Top Lawyer award, the Clients’ Choice Award, and the Top One Percent (1%) award. He is the recipient of the Legum Magister Post-Doctorate Degree (LL.M.) in Taxation (from the Villanova University School of Law), a recipient of the American Jurisprudence Award in Wills, Trusts, and Estates (from the Widener University School of Law), and a recipient of the ABA-BNA Law Award for Academic Excellence (from the Widener University School of Law).