89OAG081

81 GUARDIANSHIPS MEDICAL RECORDS - APPLICATION OF FEDERAL HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (HIPAA) TO MEDICAL CERTIFICATIONS IN GUARDIANSHIP PROCEEDINGS April 14, 2004 The Honorable John J. Hafer Maryland Senate You have asked for our opinion whether new federal regulations that protect the confidentiality of medical records affect the procedures governing guardianships in Maryland. In particular, you ask whether those regulations prevent health care providers from submitting the medical certifications required under Maryland law to initiate a guardianship proceeding. Your inquiry spotlights an important application of the federal health privacy regulations adopted under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). In our opinion, the HIPAA regulations and the requirements of the State guardianship law can be harmonized in many instances. However, in light of the new federal regulations, the General Assembly and the Court of Appeals may wish to consider amending the statutes and rules governing guardianships to address directly the confidentiality of medical information submitted to a court as part of a guardianship proceeding. In addition, the Governor could request that the Secretary of Health and Human Services grant an exception from any applicable HIPAA regulations for the issuance of medical certifications for guardianship proceedings. I HIPAA The HIPAA regulations, which became effective in April 2003, represent a federal effort to set national minimum standards for the confidentiality of medical records. See Standards for Privacy of 82 Individually Identifiable Health Information, Final Rule, 65 Fed. Reg. 82461, 82471-72 (December 28, 2000); see also 88 Opinions of the Attorney General 205 (2003). The regulations, which are codified at 45 CFR Parts 160 and 164, restrict disclosure of “protected health information” by most health care providers. “Protected health information” is individually identifiable health information in any form or medium. See 45 CFR §164.501. While the HIPAA regulations are intended to protect the confidentiality of individual health information, they are also designed to allow that information to be used for the purposes of treatment, payment, and health care operations. 45 CFR §164.506. Those terms are each defined in elaborate detail in the regulations. “Treatment” includes the provision, coordination, or management of health care and related services, including communications with a third party. 45 CFR §164.501. “Payment” is defined to include “activities undertaken by ... a health care provider or health plan to obtain or provide reimbursement for the provision of health care.” Id. “Health care operations” are administrative and legal activities necessary to provide health care and support the core functions of treatment and payment. Id. The regulations specify in elaborate detail other circumstances in which “protected health information” may be disclosed with patient authorization and those circumstances in which disclosure may be made without patient authorization. See 45 CFR §§164.508, 164.510, 164.512. HIPAA contains a selective preemption provision that overrides conflicting state laws concerning disclosure of medical information, unless the particular state law falls within certain categories or is “more stringent” with respect to confidentiality than HIPAA. See 45 CFR §160.203(b); see 88 Opinions of the Attorney General 205, 210 (2003). Finally, a state law also survives preemption if the Secretary of HHS finds that the law is “necessary” for certain purposes, including a “compelling need related to public health, safety, or welfare.” 42 U.S.C. §1320d-7(a)(2)(A)(i); 45 CFR §160.203(a)(1)(iv). 83 Maryland law also provides for the appointment of a guardian of 1 an individual’s property if the individual is “unable to manage his property and affairs effectively because of physical or mental disability, disease, habitual drunkenness, addiction to drugs, imprisonment, compulsory hospitalization, confinement, detention by a foreign power, or disappearance” and the individual is entitled to property or benefits that require management. ET §13-201(a), (c); see also Rule 10-103(b)(2). The phrase “interested person” includes the heirs of the disabled 2 person, any government agency paying benefits to that person, other relatives or entities eligible to serve as a guardian of the individual, as well as “any other person designated by the court.” See ET §§13-101(j), 13- 707; Rule 10-103(f). We understand that, in practice, hospitals and other health care facilities often initiate guardianship proceedings for individuals in their care. II Guardianship Proceedings In Maryland, proceedings to appoint a “guardian of the person” are governed by statute and court rule. See Annotated Code of Maryland, Estates and Trust Article (“ET”), §13-704 et seq.; Maryland Rule 10-101 et seq. A court may appoint a guardian for a person who “because of mental disability, disease, habitual drunkenness, or addiction to drugs, has been adjudged by the court to lack sufficient understanding or capacity to make or communicate responsible decisions concerning himself or herself, such as provisions for health care, food, clothing, or shelter, and who, as a result of this inability, requires a guardian of the person.” Rule 10- 103(b)(1); see also ET §13-705(b).1 To obtain appointment of a guardian, an “interested person”2 must file a petition with the court requesting the guardianship and justifying the need for it. Among other things, the petition must include basic information about the petitioner and the person in need of a guardian, a description of the latter’s disability, and an explanation of why the individual needs a guardian. Rules 10-201, 10-301(c). The petition must be accompanied by two certificates – either by two physicians or by a physician and a psychologist – that describe the “cause, nature, extent, and probable duration of the disability,” whether the individual needs institutional care, and his or her capacity to consent to the guardianship. ET §13-705(c); Rules 84 Where only a guardianship of property is sought, a trial may not be 3 necessary. See Rule 10-304(b). Under the statute, the director of the local department of social 4 services would be appointed guardian for an adult less than 65 years old. If the individual in need of a guardian is 65 years of age or older, the Secretary of Aging or the director of the local agency on aging would ordinarily be appointed. ET §13-707(a)(10). 10-202, 10-301(d). Upon the filing of the petition, the court then issues a show cause order to be served on interested parties. Rule 10-104. A trial is to be held to determine whether a guardian of the person should be appointed. See ET §13-705(e); Rules 10-205(b); 3 10-304(b). A statute establishes an order of priority for individuals who can be appointed guardian of a disabled person, but allows the court to select a person of lower priority for good cause. ET §13-707. If no relative or other individual designated in the statute is available for appointment, the statute provides for the appointment of a government official as guardian. ET §13-707(a)(10). Such 4 guardians are often referred to as “public guardians.” See Rule 10- 103(h). The Legislature has also established the Adult Protective Services Program to protect the health, safety, and welfare of adults who lack the physical or mental capacity to care for their daily needs. Annotated Code of Maryland, Family Law Article (“FL”), §14-101 et seq. That law authorizes the director of a local department of social services to petition a court for the appointment of a guardian, if necessary to protect the health or welfare of an adult. FL §14-307(b). A petitioner who initiates a guardianship proceeding may do so on the basis of first hand observations without relying on protected health information. However, in other instances, a potential petitioner may need to obtain protected health information as part of the decision to file a petition and seek a guardianship. The certificates that are submitted to the court with a guardianship petition will inevitably contain medical information about the person in need of a guardian. Any hearing concerning the merits of the petition will likely involve further evidence of the individual’s 85 Prior to HIPAA federal law made medical records confidential in 5 only limited circumstances. See 42 U.S.C. §290dd-2 (confidentiality of drug and alcohol treatment records). medical condition. In addition, once a guardianship is established, the proceeding may involve other disclosures by health care providers of medical information concerning that individual. For example, a guardian may be required to provide the court with an annual report containing certain information about the individual, including health status. ET §13-708(b)(7). A guardian may be required to obtain court approval to consent to certain medical procedures for a person; the application for approval will inevitably discuss the medical condition of the individual. ET §13-708(c). III Analysis The medical certifications required by State law to commence a guardianship proceeding must be provided to at least the petitioner and the court, as well as any other parties to the proceeding. You have asked whether this medical information contained in the certifications can be disclosed without violating the HIPAA regulations. A. Disclosure of Medical Information under the State Medical Records Law Prior to the adoption of the HIPAA regulations, the confidentiality of medical records involved in guardianship proceedings was largely governed by Maryland law. The Maryland 5 Confidentiality of Medical Records Act sets forth various restrictions on disclosure of individually identifiable information related to the health care of a patient. Annotated Code of Maryland, Health-General Article (“HG”), §4-301 et seq.; see 88 Opinions of the Attorney General 205, 213-15. However, that law permits disclosure of medical information “as otherwise provided by law.” HG §4-302(a)(2)(ii). Because the guardianship statute and rules contemplate the disclosure of medical information in certificates and 86 Disclosure may also be justified under other portions of the State 6 medical records law. See, e.g., HG §4-305(b)(3) (authorizing disclosure to a government agency performing duties under State or federal law); HG §4-305(b)(6) (disclosure permitted when necessary to serve emergency health care needs of the patient). The term “covered entity” includes health care providers who 7 transmit health information electronically. 45 CFR §160.103. The HIPAA regulations consider a person who has authority 8 “under applicable law” to make decisions related to health care for another person as a “personal representative” with respect to health care information related to that authority. 45 CFR §164.502(g)(2). A “personal representative” may provide a “valid authorization” under HIPAA for disclosure of health care information. 45 CFR §164.508(b)(1)(i), §164.508(c)(1)(vi). (continued...) elsewhere, those disclosures do not contravene the State medical records law.6 B. Application of HIPAA to Information Provided for Medical Certificates Clearly, the type of information that a physician would provide to a potential petitioner and that would be submitted to the court in a guardianship certificate involves, in the parlance of HIPAA, “individually identifiable health information,” since the information is created by a health care provider and relates to the past, present, and future physical or mental health of a specified individual. 45 CFR §160.103. The information is thus regulated as “protected health information” under the HIPAA regulations, if the entity that developed the information is a “covered entity.” 45 CFR §164.501. In most instances, a physician or psychologist providing the information and the certificate will be a covered entity. 45 CFR §160.103.7 In some instances, disclosure of medical information can be authorized by a health care agent or other person recognized by the HIPAA regulations as the “personal representative” of the individual in need of a guardian. However, in many cases, there may be no 8 87 (...continued) 8 Under the Maryland Health Care Decisions Act, an individual may use an advance directive to designate another person as his or her health care agent. HG §5-602(b)(1). The authority of the health care agent becomes effective as specified in the advance directive. HG §§5- 602(e)(1) and 5-603 (model form). Once the health care agent may exercise this authority, the agent is a “personal representative” under the HIPAA regulations. In addition, if a patient has not designated a health care agent and has been certified as incapacitated, an available surrogate decision maker, usually a family member, may make decisions about the patient’s health care. HG §§5-605(a)(2) and 5-606(a). Likewise, once a surrogate decision maker is authorized by the Act to serve as such, the surrogate is a “personal representative” under the HIPAA regulations. Finally, the Health Care Decisions Act left intact whatever common law authority exists in Maryland for family members to make decisions concerning the health care of a relative. HG §5-616. To the extent that a family member is lawfully making such decisions, the family member too is a “personal representative” under the HIPAA regulations. health care agent or surrogate decision maker available to authorize disclosure of protected health information concerning the individual in need of a guardian. This is likely to be true in situations involving the appointment of a public guardian. Thus, in some circumstances there may be no person clearly authorized under the HIPAA regulations to approve the disclosure of medical information about the person in need of a guardian. This raises the question whether the use of medical information without such an authorization, as currently permitted under Maryland law for initiation of guardianship proceedings, is preempted by the HIPAA regulations. To assess whether the HIPAA regulations override Maryland law, we must first determine whether the State law allowing disclosure of medical information to initiate a guardianship proceeding is “contrary” to HIPAA. 42 U.S.C. §1320d-7(a)(1) (providing that HIPAA supersedes “contrary” provisions of state law). In other words, is it impossible to comply with both the HIPAA confidentiality regulations and State law on guardianships or would compliance with State law be inconsistent with the objectives of HIPAA? See 45 CFR §160.202; 88 Opinions of the Attorney General 205, 220-21. 88 In our opinion, there are many circumstances in which the requisite medical information may be provided, consistently with HIPAA, to initiate a guardianship proceeding, even if there is no personal representative available to authorize the disclosure to the petitioner or the court. Amendment of the guardianship statute and related court rules could eliminate any question as to a conflict with HIPAA. Alternatively, the State could seek a “necessity” determination from the Secretary of the federal Department of Health and Human Services to except guardianship proceedings from the HIPAA regulations. If such a determination were issued, it would insure that the requisite medical information could be provided in guardianship cases regardless of HIPAA. C. Disclosures Permitted Without Authorization of Patient or Personal Representative While the thrust of the HIPAA regulations is to require patient authorization for disclosures of protected health information, there are exceptions to that requirement. Depending on the facts of the particular situation, one or more of these exceptions may permit a physician or psychologist to provide a medical certification for a guardianship proceeding. 1. Disclosures in Connection with Treatment and Payment No authorization is required for disclosures within the ambit of treatment, payment, and health care operations concerning the individual. 45 CFR §§164.502(a), 164.506. “Treatment” is defined to include the “provision, coordination, or management of health care and related services by one or more health care providers, including the coordination or management of health care by a health care provider with a third party....” 45 CFR §164.501 (emphasis added). “Payment” includes activities designed “to obtain or provide reimbursement for the provision of health care.” Id. When a guardianship is sought so that a guardian may consent to medical treatment for an allegedly disabled individual or pay for the individual’s medical treatment, there is a reasonable argument that the determination of the legal authority of another person to make those decisions is an essential prerequisite for providing health care to the patient. In that case, a provider who is treating the individual may disclose medical information for the purpose of 89 establishing a guardianship under the treatment or payment exceptions. 2. Disclosures for Public or Legal Purposes The HIPAA regulations also allow for the use and disclosure of protected health information without patient authorization for a variety of public or “legal” purposes. See 45 CFR §164.512. In particular, in specified circumstances, medical information may be disclosed if a use or disclosure of health information is required by law, and the disclosure is limited to the relevant requirements of the law. The regulations state: (1) A covered entity may use or disclose protected health information to the extent that such use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of such law. (2) A covered entity must meet the requirements described in paragraph (c), (e), or (f) of this section for the uses or disclosures required by law. 45 CFR §164.512(a). Paragraph (f) concerns disclosures for law enforcement purposes and thus would not ordinarily relate to the initiation of a guardianship proceeding. Paragraphs (c) and (e) may authorize disclosures to initiate a guardianship proceeding in certain circumstances. a. Exception for Cases of Abuse, Neglect, and Domestic Violence Paragraph (c) concerns disclosures about victims of abuse, neglect, or domestic violence. It provides, in relevant part, that: (1) Permitted disclosures. ... a covered entity may disclose protected health information about an individual whom the covered entity reasonably believes to be a victim of abuse, neglect, or domestic violence to a government authority, including a social service or 90 For purposes of the Adult Protective Services Law, “neglect” is 9 “the willful deprivation of a vulnerable adult of adequate food, clothing, essential medical treatment or habilitative therapy, shelter, or supervision.” FL §14-101(l). “Self-neglect” is “the inability of a vulnerable adult to provide the vulnerable adult with the services: (1) that (continued...) protective services agency, authorized by law to receive reports of such abuse, neglect, or domestic violence: ... (iii) To the extent the disclosure is expressly authorized by statute or regulation and: ... (A) The covered entity, in the exercise of professional judgment, believes the disclosure is necessary to prevent serious harm to the individual or other potential victims; ... 45 CFR §164.512(c)(1)(iii)(A). This exception would address most situations in which a local director of social services determines that a guardianship is necessary for an individual under the Adult Protective Services Program. That law requires that health care practitioners, police officers, and human services workers report cases in which a vulnerable adult has been subject to abuse, neglect, self-neglect, or exploitation. FL §14-302(a). Thus, if a physician believes that the individual (1) is a victim of abuse, neglect, or domestic violence and (2) needs a guardian in order to avoid “serious harm,” the physician may provide the certification necessary to commence a guardianship proceeding. Under the Adult Protective Services Program, the local department of social services is an agency “authorized by law to receive reports of ... abuse [or] neglect.” The court is also a government “authority” expressly authorized by the guardianship law to receive such information in connection with a proceeding. We note that many cases in the Adult Protective Services Program involve “self-neglect.” While Maryland law distinguishes between self-neglect and neglect by others, the HIPAA regulations 9 91 (...continued) 9 are necessary for the vulnerable adult’s physical and mental health; and (2) the absence of which impairs or threatens the vulnerable adult’s well- being.” FL §14-101(p). The remainder of the regulation delineates the conditions that 10 must be met for disclosures in response to subpoenas and similar lawful process. do not appear to recognize this distinction. In our opinion, the exception in 45 CFR §164.512(c) for reports of “neglect” also encompasses instances of “self-neglect.” b. Judicial Proceedings Exception Paragraph (e) of 45 CFR §164.512 concerns disclosures in connection with judicial proceedings. It states, in part: (1) Permitted disclosures. A covered entity may disclose protected health information in the course of any judicial or administrative proceeding: (i) In response to an order of a court or administrative tribunal, provided that the covered entity discloses only the protected health information expressly authorized by such order; or (ii) In response to a subpoena, discovery request, or other lawful process, that is not accompanied by an order of a court or administrative tribunal, if ....10 45 CFR §164.512(e)(1). By its own terms, this authorization is limited. First, paragraph (e) uses the limiting phrase “in the course of any judicial proceeding” in authorizing disclosures of protected health care information. Second, it provides that a covered entity may disclose protected health information required by a court or administrative order; disclosure may also be made in response to a subpoena, discovery request, or “other lawful process.” 92 The rule currently contemplates the delayed filing of certificates 11 only when the individual who is the subject of the proceeding is under the control of another person who refuses to permit an examination, and the court, after a hearing, appoints two physicians or a physician and a psychologist to examine the individual. Rule 10-202(b). Under the Maryland guardianship statute, medical certificates are required to initiate a proceeding. Thus, at the time the certificates are prepared, there is no pending judicial proceeding, and none exists until the petition and certificates are filed. It may be possible to construe the phrase “in the course of any judicial proceeding” in the HIPAA regulation to encompass the initiation of the proceeding. However, a second hurdle – a Catch 22 – remains. The regulation authorizes disclosures only in response to orders, subpoenas, discovery requests, or other lawful process. Unless the Maryland procedures were altered, the certificates would not be issued in response to lawful process, because there would be no proceeding for which process could be issued before the filing of the petition and certificates. Examples given in the HHS commentary all relate to process issued as part of a pending proceeding. See 65 Fed. Reg. at 82529-30. This discrepancy might be remedied if Maryland guardianship procedures were altered to allow the submission of a petition with a request for court order authorizing filing of the certificates. Of course, any modification of the rules 11 concerning medical certifications in guardianship proceedings should be carefully examined, given the significant public policy concerns underlying that requirement. 3. Disclosure in Connection with Health Oversight Activities HIPAA permits disclosures to a “health oversight agency for oversight activities authorized by law ... including ... civil ... proceedings ....” 45 CFR §164.512(d). The regulation limits these disclosures by requiring that they be related to “activities necessary for appropriate oversight of”: (i) The health care system; (ii) Government benefit programs for which health information is relevant to beneficiary eligibility; 93 This exception has been applied to permit disclosures to state 12 health planning agencies and a state department of public health. See Ala. Op. Atty. Gen. No. 2003-104, 2003 WL 1606033 (March 20, 2003). (iii) Entities subject to government regulatory programs for which health information is necessary for determining compliance with program standards; or (iv) Entities subject to civil rights laws for which health information is necessary for determining compliance. 45 CFR §164.512(d)(1)(i)-(iv). The regulations contain the following proviso: a health oversight activity does not include an investigation or other activity in which the individual is the subject of the investigation or activity and such investigation or other activity does not arise out of and is not directly related to: (i) The receipt of health care; (ii) A claim for public benefits related to health; or (iii) Qualification for, or receipt of, public benefits or services when a patient’s health is integral to the claim for public benefits or services. 45 CFR §164.512(d)(2). The HIPAA regulations define “health oversight agency” as “an agency or authority of ... a State ... that is authorized by law to oversee the health care system (whether public or private) or government programs in which health information is necessary to determine eligibility or compliance ....” 45 CFR §164.501.12 94 In contrast to the exception for judicial proceedings, this part of the HIPAA regulations is not premised on the prior existence of a legal proceeding or the service of some form of process on the provider. The HHS commentary notes that this provision permits providers to initiate disclosures – as opposed to simply respond to requests or demands for disclosure. See 65 Fed. Reg. at 82529 (“In some instances, a disclosure by a covered entity under this section will initiate [a] proceeding, but it will not be ongoing at the time the disclosure is made”). As noted above, the State Adult Protective Services law anticipates, and sometimes compels, that health care practitioners report to public officials about situations warranting the initiation of adult guardianship proceedings – e.g., abuse, neglect, self-neglect, or exploitation. See FL §14-302. The General Assembly has clearly adopted a policy in favor of intervention when a disabled adult person is at risk. FL §14-102(a) (“It is the policy of the State that adults who lack the physical or mental capacity to care for their basic daily living needs shall have access to and be provided with needed professional services sufficient to protect their health, safety, and welfare”). Guardianship proceedings are an exercise of the equity powers of the court to protect those who, because of illness or other disability, are unable to care for themselves. The guardianship statute provides that “[t]he court may superintend and direct the care of a disabled person....” ET §13-704 (emphasis added). In reality, the court is the guardian and the appointed guardian is merely an agent of the court who assists the court in carrying out this responsibility. Kicherer v. Kicherer, 285 Md. 114, 118, 400 A.2d 1097 (1979). In a sense, a guardianship is a “public benefit or service” for which the health of the individual in need of a guardian is an important factor. Health information is necessary to determine eligibility for this service under the State guardianship law. The court obviously has a significant role in the provision and oversight of this service and functions as a “health oversight agency” for a person in need of a guardian. Thus, it is not unreasonable to conclude that disclosure of the medical certificates and other protected health information to a court in connection with a 95 Maryland law does allow a court to conduct a guardianship 13 proceeding at a closed hearing without a jury if the person alleged to be disabled so requests. The hearings thereafter are confidential and sealed unless otherwise ordered by the court. ET §13-705(e). guardianship proceeding falls within disclosures permitted under §164.512(d) of the HIPAA regulations. D. Procedural and Administrative Measures This opinion has outlined some arguments why Maryland’s current procedure for initiating guardianships is in most instances consistent with HIPAA. However, any doubt could be eliminated through certain changes in procedure. 1. Modification of Procedures To the extent that the State relies upon the judicial proceedings exception in HIPAA, some modification of the procedures governing guardianship proceedings is likely necessary to comply fully with the conditions of that exception. The regulations urge that disclosures under that exception be limited to those necessary to achieve the public purpose and be made in response to a court order. See 45 CFR §164.512(a)(2), (e)(1). To accommodate guardianship procedures to this rule, the process could be modified to provide for a court order requiring filing of the certificates upon the submission of a petition. Procedures could also be modified to preserve the confidentiality of health information after the initiation of the proceeding. A court rule recently adopted by the Court of Appeals that will become effective on October 1, 2004, provides that medical or psychological reports or records found in court records are not available for public inspection. Rule 16-1006(h); see <http://www.courts.state.md.us/access/index.html>. However, Maryland law does not otherwise limit public disclosure of protected health information found in pleadings filed in court. As a matter 13 of practice, a petitioner in a guardianship proceeding could submit with the petition a motion for a protective order to minimize disclosures of confidential medical information concerning the individual. A change in the guardianship statute or the court rules governing guardianships to minimize the public disclosure of 96 medical information concerning the individual could accomplish the same end while eliminating the need to file motions in every case. Cf. ET §13-705(e) (permitting closing of hearings); Rule 9-112 (providing for sealing of pleadings in guardianship proceedings for minors under the Family Law Article). 2. “Necessity” Exception Under HIPAA, a State law that would otherwise be preempted by the HIPAA regulations survives federal preemption if the Secretary of HHS determines that the law is “necessary” in the sense of serving a “compelling need related to public health, safety, or welfare.” See 42 U.S.C. §1320d-7(a)(2)(A)(i); 45 CFR §160.203(a)(1)(iv). The Governor or the Governor’s designee must request this determination from the Secretary under procedures set forth in HIPAA. See 45 CFR §160.204. This opinion has suggested a number of circumstances under which HIPAA would allow a physician or psychologist to make the disclosures required for a medical certification for a guardianship. However, there may be situations where a physician believes that an individual’s medical condition warrants a guardianship, but there is no clear authorization under HIPAA for disclosure of the information in the certification. In light of the uncertainty about whether HIPAA preempts the permissive disclosure of medical information under Maryland law to initiate a guardianship proceeding, the State could request a necessity determination from the Secretary of HHS. The request could be based on the fact that the provision of such information to a court is a reasonable prerequisite to the appointment of a guardian. There seems little room for debate that the protection of such vulnerable individuals serves a “compelling need related to the public health, safety, and welfare.” IV Conclusion In our opinion, the HIPAA regulations and the requirements of the State guardianship law are not necessarily incompatible. Depending on the facts of the particular case, a physician or psychologist may well be able to disclose protected health information to a petitioner and a court in connection with a 97 guardianship proceeding. However, the General Assembly and the Court of Appeals may wish to consider amending the statutes and rules governing guardianships to address directly the confidentiality of medical information submitted to a court as part of a guardianship proceeding. In addition, the Governor could request that the Secretary of Health and Human Services grant an exception from any applicable HIPAA regulation for guardianship proceedings. J. Joseph Curran, Jr. Attorney General C. Frederick Ryland Assistant Attorney General Robert N. McDonald Chief Counsel Opinions and Advice