HIPAA (45 CFR Part 164)·§ 164.502(g)·medium·Component: Privacy Rule

What this control requires

Standard: Personal representatives. As specified in this paragraph, a covered entity must, except as provided in paragraphs (g)(3) and (g)(5) of this section, treat a personal representative as the individual for purposes of this subchapter. 164.502(g)(2) Implementation specification: adults and emancipated minors: If under applicable law a person has authority to act on behalf of an individual who is an adult or an emancipated minor in making decisions related to health care, a covered entity must treat such person as a personal representative under this subchapter, with respect to protected health information relevant to such personal representation. 164.502(g)(3)(i) Implementation specification: unemancipated minors: If under applicable law a parent, guardian, or other person acting in loco parentis has authority to act on behalf of an individual who is an unemancipated minor in making decisions related to health care, a covered entity must treat such person as a personal representative under this subchapter, with respect to protected health information relevant to such personal representation, except that such person may not be a personal representative of an unemancipated minor, and the minor has the authority to act as an individual, with respect to protected health information pertaining to a health care service, if: (A) The minor consents to such health care service; no other consent to such health care service is required by law, regardless of whether the consent of another person has also been obtained; and the minor has not requested that such person be treated as the personal representative; (B) The minor may lawfully obtain such health care service without the consent of a parent, guardian, or other person acting in loco parentis, and the minor, a court, or another person authorized by law consents to such health care service; or (C) A parent, guardian, or other person acting in loco parentis assents to an agreement of confidentiality between a covered health care provider and the minor with respect to such health care service. 164.502(g)(3)(ii) - Notwithstanding the provisions of paragraph (g)(3)(i) of this section: (A) If, and to the extent permitted or required by an applicable provision of State or other law, including applicable case law, a covered entity may disclose, or in accordance with 164.524 provide access to, protected health information about an unemancipated minor to a parent, guardian, or other person acting in loco parentis; (B) If, and to the extent prohibited by an applicable provision of State or other law, including applicable case law, a covered entity may not disclose, or in accordance with 164.524 provide access to, protected health information about an unemancipated minor to a parent, guardian, or other person acting in loco parentis; and (C) Where the parent, guardian, or other person acting in loco parentis, is not the personal representative under paragraphs (g)(3)(i)(A), (B), or (C) of this section and where there is no applicable access provision under State or other law, including case law, a covered entity may provide or deny access under 164.524 to a parent, guardian, or other person acting in loco parentis, if such action is consistent with State or other applicable law, provided that such decision must be made by a licensed health care professional, in the exercise of professional judgment. 164.502(g)(4) Implementation specification: Deceased individuals. If under applicable law an executor, administrator, or other person has authority to act on behalf of a deceased individual or of the individual's estate, a covered entity must treat such person as a personal representative under this subchapter, with respect to protected health information relevant to such personal representation. 164.502(g) (5) Implementation specification: Abuse, neglect, endangerment situations. Notwithstanding a State law or any requirement of this paragraph to the contrary, a covered entity may elect not to treat a person as the personal representative of an individual if: (i) The covered entity has a reasonable belief that: (A) The individual has been or may be subjected to domestic violence, abuse, or neglect by such person; or (B) Treating such person as the personal representative could endanger the individual; and (ii) The covered entity, in the exercise of professional judgment, decides that it is not in the best interest of the individual to treat the person as the individual's personal representative.
— HIPAA (45 CFR Part 164), § 164.502(g)

In plain English

Standard: Personal representatives. In practice, this means you can prove you information management-level controls on a defined cadence.

Why it matters

HIPAA non-compliance is a strict-liability matter: OCR civil monetary penalties are assessed per-record per-violation (up to USD 1.9 million per identical-violation calendar year as of 2024), and willful neglect can trigger criminal referral.

What an auditor looks for

HHS OCR investigators and SOC-2+HIPAA auditors look for the specific 45 CFR § citation, whether the safeguard is required vs addressable (and if addressable, the documented decision), the implementation specification, the workforce member responsible, and the records that show it runs.

Within Privacy Rule, the assessor will trace your implementation back to the catalogue reference (§ 164.502(g)) and look for objective evidence on the latest two assessment cycles.

How to implement

Policy Management

Docs. Keep each policy in version-controlled Markdown alongside the code that implements it; ship a signed PDF snapshot at each annual review and link the SHA into the SoA.

Operational checklist

  • Information. Document the trigger, the owner and the cadence.
  • Person. Document the trigger, the owner and the cadence.
  • Other. Document the trigger, the owner and the cadence.
  • Policy. Document the trigger, the owner and the cadence.
  • Law. Document the trigger, the owner and the cadence.
  • Scope: management, individuals, policy, i, obtain, representatives, applicable case law, accordance.

Evidence to collect

  • Policy Document. A signed and version-controlled policy / standard / procedure document.

Signed policy or standard documents the safeguard. Focus: Personal representatives.

Common pitfalls

  • Policies that no engineer has read; the version in Confluence drifts from the version that's actually being enforced.

Related controls in HIPAA (45 CFR Part 164)

References

Topics: governance riskpolicy management