EXPLAINING HIPPA:
In 1996, President Clinton signed into law the Health Insurance Portability and Accountability Act of 1996 (commonly known as “HIPAA”). In a nutshell, HIPAA provides the patient with health information privacy rights which all patients should understand. As a patient, you have the right to fully exercise the rights provided to you by federal law, ask the provider about your rights and even file a complaint if you believe your rights have been denied or your health information is not being protected.
Under HIPPA, your health information rights include the following:
- A right to have access to your health information;
- A right to have an accounting of disclosures of your health information;
- A right for you to correct or amend your health information;
- A right receive notice of privacy practices by the provider;
- A right, if you believe that HIPAA has been violated, to file a complaint.
WHO MUST FOLLOW HIPPA? In short, HIPPA applies to most doctors, nurses, pharmacies, hospitals, clinics, nursing homes, and many other health care providers, health insurance companies, Health Maintenance Organization (HMOs), and most employer group health plans.
WHAT IS PROTECTED? The “Privacy Rule” set forth in HIPPA protects all “individually identifiable health information” which includes (1) the patient’s past, present or future physical or mental health; (2) the condition/healthcare provided to the patient; (3) the payment for the provision of healthcare to the individual; and, (4) individually identifiable health information such as name, address, birth date, Social Security Number.
RIGHT TO ACCESS: Probably the most common HIPPA question is: “Do I have a right to review and get a copy of my own health/patient care record?” Absolutely! HIPAA provides the specific right to all patients to inspect, review, and receive a copy of your health and billing records within the possession and control by both health plans and health care providers. On a rare occasion, there may be an exception such as your health care provider believes that something in your file could physically endanger you or someone else. In most cases, however, the health care provider must provide copies to you within 30 days. This timeframe may be delayed if your health information is not maintained or accessible on-site. In such cases, your health care provider or health plan is permitted up to 60 days to respond to a request for records. If, for whatever reason, the healthcare provider cannot take action by these deadlines, the provider or plan is permitted to extend the deadline by another 30 days if they provide a reason for the delay in writing and inform the patient as to when to expect copies in the future. Finally, the healthcare provider cannot charge a fee for searching for or retrieving your information, but the patient may be charged a fee to pay for the cost of copying and/or mailing.
RIGHT TO ACCOUNTING: Another common question is: “Does a patient have the right to know when a medical provider has shared health information with people outside of his or her practice?” Again, absolutely! A patient has the right to what is referred to as an “accounting of disclosures.” These disclosures are basically a list of certain instances when your doctor or plan has disclosed/shared your health information with another person or organization. There are, however, some major exceptions to this rule. For example, an accounting of disclosures does not include information about when your health care provider or health plan shares your information with another person or organization for treatment, payment, or health care operations.
RIGHT TO CORRECT: A rarely discussed, but important question is: “Does a patient have to right to correct the information in a health record?” Yes, the patient does have a right to correct the record or note the record. In other words, you may ask your health care provider or your health plan to correct your health record by adding information to it to make it more accurate or complete. This is commonly called the “right to amend.” For example, if a patient and a provider agree that the record wrongly reflects certain information, then the provider has a duty to correct the record. On the other hand, if a patient and a provider disagree that an amendment or correction is necessary, a patient still has the right to have the “disagreement” noted in the record record. In most cases, the record should be changed within 60 days, but the provider can take an extra 30 days if they provide a reason.
RIGHT TO NOTICE: Do I have the right to receive a notice that tells me how my health information is being used and shared? Once again, yes. We have all probably experienced, in one way or another, filling out HIPPA forms when you are a new patient at a health provider. Well, these forms are maintained to comply with this HIPPA requirement. In other words, a patient can learn how health information is used and shared by the health provider. The provider must give notice that informs the patient how they legally may use and share the health information and how you can exercise your rights.
This blog is provided to provide some of the basics on HIPPA, but for more detailed information, please visit the U.S. Department of Health & Human Services website on the subject at https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/