How Well Do You Know HIPAA?

Posted on February 23, 2023

Recent questions from those inquiring about patient advocacy services have served to remind me that too many healthcare experiences are like visiting a foreign country where you don’t understand the language. In fact, one prospective client recently exclaimed, “I had no idea that didn’t know what I needed to know.” She was talking about HIPAA (Health Insurance Portability and Accountability Act of 1996).

According to the HIPPA Journal, “Prior to HIPAA, the theft of healthcare information was often used for committing identity theft. This not only had financial implications for patients whose data was stolen, by also enabled criminals to obtain healthcare under false pretenses or sell the data on the black market to uninsured persons who could receive expensive healthcare treatment.”[i]

Since it went into effect in 2003, HIPAA helps to ensure that any information disclosed to healthcare providers and health plans, or information that is created, transmitted or stored by them is subject to strict security controls.[ii] Health care providers and others must assure that health information that is created by them, transmitted or stored is subject to strict security controls -achieve to the protect the privacy of health information.

HIPAA sets boundaries on the use and release of health records. Hospitals, physicians, and other providers are allowed to share patient information for treatment, payment and healthcare operations.

Each of us has control over who and how our health information is used, who it is released to and who it is to be shared with. Do not be shy about exercising your rights.

Patient Perspective: The Basics

You decide who sees your medical information, not the healthcare provider. Whenever you go to a new provider or are in the hospital, you are asked to designate who, if anyone, is authorized to obtain and disclose information and ask questions about your care and condition.

By signing an authorization form, you are designating someone to act as your representative. The form gives a provider permission to treat your representative the same as they would treat you in terms of sharing health information.

Under rules from the U.S. Department of Health and Human Services, your representative can only represent you in the matter of your care and treatment. Whoever you list as your representative - your spouse, son, daughter or other, a provider has no right to withhold the requested information.

In the event you are unable to communicate, the person who holds your power of attorney for healthcare becomes your designated representative.

You can also give HIPAA authorization verbally. While written authorization is always preferred, during an emergency or other instant when doing so is impractical, you can say to a doctor, “This is my neighbor, and I want her to remain here. You can discuss my diagnosis and treatment in front of her.”

With your permission, a provider can give updates by phone to family members. If and when you consent to your information being shared, there is no reason that a family member who lives far away can’t get an update from your provider.

Also, to Know

While you have a right to your medical records, there are exceptions. Under HIPAA, healthcare organizations must provide medical records, doctor’s notes, billing information and medical images to patients who request them. Notes about psychotherapy can be withheld if the provider believes their release could cause harm to the patient.

You have the right to make corrections to your medical record. Despite all efforts to the contrary, healthcare organizations, providers and others can make mistakes when recording health information. Miscommunication is the leading cause of medical error, so it is incumbent on each of us as patients to review our medical information.

If/when you find errors or omissions in your health record, such as missing procedures or incorrect medications, you can correct your file or ask the provider to amend it. A future provider may rely on these notes when formulating treatment, which makes this very important.

Obtaining copies of your health information helps when you see new healthcare providers. The information that is passed on is invaluable, saving time and money as each new provider, often a specialist, has your entire health history. That helps in decision making. It also saves time and money when tests do not need to be repeated.

As of April 2021, under the CARES Act, healthcare providers must give patients access without charge to all the health information in their electronic medical records “without delay.” Doctors and other healthcare professionals are permitted to send emails to patients, including health records, but they must be encrypted. If encryption is not available, the provider must advise the patient of the risks. If you consent, the records may be sent.

Hoping this information is helpful. Comments are always welcomed.

[i] Why is HIPPA Important? HIPAA Journal, 01/01/2023. http://bit.ly/3SfaN9k/
[ii] Ibid.