What is HIPAA
Answers to Frequently Asked Questions
Most of us believe that our medical and other health information is private and should be protected, and we want to know who has this information. In a world that in continuously becoming more connected, the exchange of such information is simplified, and there was an increasing risk that it could end up in places we may not want. With that in mind, in 1996, Congress passed a set of statutes known as the Health Insurance Portability and Accountability Act of 1996, or in more common lingo, HIPAA.
While most have heard the term HIPAA used in some context before, many still don’t know exactly what it means to them.
Basically, HIPAA contains two major parts that are applicable to each of us as consumers of health insurance and medical services. Those are the Privacy Rule and the Security Rule.
The Privacy Rule gives consumers rights over their health information and sets rules and limits on who can look at and receive that information. For example, medical conditions, history or past treatments are protected information under HIPAA. It applies to any form of medical information- whether written, oral or electronic which a “covered entity” (i.e. health care providers; insurance companies) has on you.
The Security Rule sets standards which must be followed by those entities to ensure that your health information in electronic form remains secure.
Who is subject to HIPAA?
Entities that are subject to HIPAA are known as “covered entities”. They include:
Health Plans: including health insurance companies, health maintenance organizations (HMOs), employer health plans, Medicare and Medicaid.
Most Health Care Providers: including most doctors, clinics, hospitals, psychologists, chiropractors, nursing homes, pharmacies and dentists.
Health Care Clearinghouses: including any entities that process health information into some form.
Who is NOT subject to HIPAA?
A number of organizations which possess your individual healthcare information are not bound by the protections of HIPAA, such as: life insurers, employers, worker’s compensation carriers, most schools, a number of state agencies, many law enforcement agencies and municipalities.
What information is protected?
* Information your doctors, nurses, and other health care providers put in your medical record
* Conversations your doctor has about your care or treatment with nurses and others
* Information about you in your health insurer’s computer system
* Billing information about you at your clinic
* Most other health information about you held by those who must follow these laws
How is information protected?
* Covered entities must put in place safeguards to protect your health information.
* Covered entities must reasonably limit uses and disclosures to the minimum necessary to accomplish their intended purpose.
* Covered entities must have contracts in place with their contractors and others ensuring that they use and disclose your health information properly and safeguard it appropriately.
* Covered entities must have procedures in place to limit who can view and access your health information as well as implement training programs for employees about how to protect your health information.
What rights do I have over my protected health information?
You have the right to:
* Ask to see and get a copy of your health records
* Have corrections added to your health information
* Receive a notice that tells you how your health information may be used and shared
* Decide if you want to give your permission before your health information can be used or shared for certain purposes, such as for marketing
* Get a report on when and why your health information was shared for certain purposes
If you believe your rights are being denied or your health information isn’t being protected, you can file a complaint with your provider or health insurer, or even file a complaint with the U.S. Government
Who is permitted to look at and receive my health information?
The Privacy Rule sets rules and limits on who can look at and receive your health information. To make sure that your health information is protected in a way that does not interfere with your health care, your information can be used and shared:
* For your treatment and care coordination
* To pay doctors and hospitals for your health care and to help run their businesses
* With your family, relatives, friends, or others you identify who are involved with your health care or your health care bills, unless you object
* To make sure doctors give good care and nursing homes are clean and safe
* To protect the public's health, such as by reporting when the flu is in your area
* To make required reports to the police, such as reporting gunshot wounds
Your health information CANNOT be used or shared without your written permission unless this law allows it. For example, without your authorization, your provider generally cannot:
* Give your information to your employer
* Use or share your information for marketing or advertising purposes
* Share private notes about your health care
If I do not object, can my health care provider share or discuss my health information with my family, friends, or others involved in my care or payment for my care?
Yes. As long as you do not object, your health care provider is allowed to share or discuss your health information with your family, friends, or others involved in your care or payment for your care. Your provider may ask your permission, may tell you he or she plans to discuss the information and give you an opportunity to object, or may decide, using his or her professional judgment, that you do not object. In any of these cases, your health care provider may discuss only the information that the person involved needs to know about your care or payment for your care.
Here are some examples:
* An emergency room doctor may discuss your treatment in front of your friend when you ask that your friend come into the treatment room.
* Your hospital may discuss your bill with your daughter who is with you at the hospital and has questions about the charges.
* Your doctor may talk to your sister who is driving you home from the hospital about your keeping your foot raised during the ride home.
* Your doctor may discuss the drugs you need to take with your health aide who has come with you to your appointment.
* Your nurse may tell you that she is going to tell your brother how you are doing, and then she may discuss your health status with your brother if you did not say that she should not.
BUT:
Your nurse may not discuss your condition with your brother if you tell her not to.
If I am unconscious or not around, can my health care provider still share or discuss my health information with my family, friends, or others involved in my care or payment for my care?
Yes. If you are not around or cannot give permission, your health care provider may share or discuss your health information with family, friends, or others involved in your care or payment for your care if he or she believes, in his or her professional judgment, that it is in your best interest. When someone other than a friend or family member is asking about you, your healthcare provider must be reasonably sure that you asked the person to be involved in your care or payment for your care. Your health care provider may share your information face to face, over the phone, or in writing, but may only share the information that the family member, friend, or other person needs to know about your care or payment for your care.
Do I have to give my health care provider written permission to share or discuss my health information with my family members, friends, or others involved in my care or payment for my care?
HIPAA does not require that you give your health care provider written permission. However, your provider may prefer or require that you give written permission. Due to varying policies it is safe to have a HIPAA release and authorization handy to give to any healthcare provider.
If my family or friends call my health care provider to ask about my condition, will they have to give my provider proof of who they are?
HIPAA does not require proof of identity in these cases. However, your health care provider may have his or her own rules for verifying who is on the phone.
How can I help make sure my health care providers share my health information with my family, friends, or others involved in my care or payment for my care when I want them to?
Execute a HIPAA Release and Authorization indicating who may have access to your protected information. Working with an attorney is the best way to ensure that your form is sufficiently detailed and covers all applicable situations. However, there are forms online if you do a little searching.
Where can I find more information on HIPAA or have my specific questions answers?
For additional information, you can check out http://www.hhs.gov/ocr/privacy/ or contact an attorney to discuss any specific issues.
Michael F. Brennan runs a virtual law office helping clients in Illinois, Wisconsin, and Minnesota with estate planning. He can be reached at michael.brennan@mfblegal.com with questions or comments, or check out his website at www.thevirtualattorney.com.
The information contained herein is intended for informational purposes only and is not legal advice, nor is it intended to create an attorney-client relationship. For specific legal advice regarding a specific legal issue please contact me or another attorney for assistance.
