The Daughter With a Health Care POA and a Chart Note Saying No

A valid health care POA ordinarily makes the agent a personal representative, who is treated as the individual for access purposes. But that is not the end of the analysis here, for three reasons:

1. The patient has capacity and has expressed a contrary wish in writing. HIPAA permits a covered entity to decline to treat a personal representative as the individual, and to deny access, when the individual has capacity and has previously expressed a wish that the representative not receive the information. The handwritten chart note is exactly that evidence. This is a may deny, not a must deny - it is a judgment call.
2. Verify the POA's scope and current status. A health care POA is not a general or financial power of attorney, and it can be revoked. Confirm with the patient, not with the family, that the document is still in force.
3. Do not stall silently. The 30-day right-of-access clock still runs. If you invoke the contrary-wish provision, document the basis, notify the requester in writing with the reason, and route the decision to the privacy officer rather than leaving it to the ROI clerk.

The clean path: go to the patient, confirm capacity, confirm the standing instruction, and offer him the option to authorize release to the daughter directly. That converts a contested denial into a documented patient choice.

Psychotherapy notes are excluded from the right of access. They are not part of the designated record set for access purposes, so the patient - and therefore an agent acting for the patient - has no access right to them. That is a firm exclusion, not a discretionary denial, and it applies even when the patient asks personally.

Practical handling:

• Separate them from the rest of the request. Do not release the psychologist's process notes with the behavioral health record.
• The medical record proper - medication lists, orders, progress notes by the treating providers, discharge summary, treatment plan - is not psychotherapy notes and remains accessible on a proper authorization or by the patient directly.
• If the patient himself signs a valid authorization specifically covering psychotherapy notes, they may be released, but that requires the patient's own authorization, not the daughter's POA.
• Watch for state law that may be stricter on mental health records than HIPAA; where state law is more protective, it controls.

The common error is treating the whole behavioral health chart as psychotherapy notes and denying everything, or treating the notes as ordinary records and releasing them. Both are wrong in opposite directions.

A subpoena is a legal process document, not an authorization. HIPAA permits disclosure in response to a subpoena only when the requesting party provides satisfactory assurances: either

• a written statement and accompanying documentation that the party has notified the individual (or made a good-faith attempt), that the notice included sufficient information to object, and that the time to object has passed, or
• a qualified protective order from a court.

So the steps in order:

1. Do not release on day 10 because day 10 arrived. A subpoena deadline does not override the required assurances.
2. Confirm the subpoena was issued by a court or attorney of record and identifies the correct patient and date range.
3. Send the requester a written request for satisfactory assurances; log it.
4. Release only the specific records named - subpoenas are frequently overbroad, and "the entire chart" is not a valid scope.
5. Log the disclosure for accounting purposes and note the legal review in the chart.

A subpoena without assurances is one of the most common and most avoidable privacy breaches in a hospital ROI office. When in doubt, escalate to counsel before release.