Nursing home residents’ spouses and attorneys-in-fact do not necessarily meet the definition of “personal representatives” under the Health Insurance Portability and Accountability Act, so providers should not automatically make residents’ personal health information available to these parties, a federal appeals court recently ruled.

Florida skilled nursing facilities filed the case against the Florida Agency for Health Care Administration in May 2012. The SNFs had been penalized for refusing to provide medical records to deceased residents’ spouses or attorneys-in-fact. An attorney-in-fact is someone authorized by a written power-of-attorney document to act on behalf of a resident.

The plaintiffs argued if they followed the Florida law requiring them to provide medical records to these parties, they would violate HIPAA. Under that federal law, nursing homes can only provide personal health information to officially designated “personal representatives” of a deceased resident, such as an executor of the resident’s estate. Providers also may furnish medical records to deceased residents’ family members who helped pay for the resident’s care, but only if the records are pertinent to the requestor’s financial involvement.

The U.S. Court of Appeals for the Eleventh Circuit ruled in favor of the nursing homes on Tuesday, affirming a district court decision. The Florida law’s “fatal flaw” is that it does not meet the stricter HIPAA definition of personal representative, but “authorizes sweeping disclosures, making a deceased resident’s protected health information available to a spouse or other enumerated party upon request, without any need for authorization, for any conceivable reason, and without regard to the authority of the individual making the request to act in a deceased resident’s stead,” Judge Susan H. Black wrote.

Because HIPAA preempts any contradictory state laws, the Florida legislature must revise the statute at issue or it will not be enforceable, Black said.