Like most people, you probably shop around before you spend your money. And after you buy something, you protect it, right? You keep insurance on your house, get the oil changed regularly on your car, and most important, when you or your family are sick, you get the best healthcare you can.
What about your healthcare information? Are you doing everything you can to make sure that your private health information is protected? Do you know what your healthcare privacy rights are?
Congress passed the Health Insurance Portability & Accountability Act (HIPAA) in 1996. The HIPAA Privacy Rules, which were created by the Department of Health & Human Services, became effective in April 2003.
You now have the rights you need in order to make sure that your healthcare information is safe. If you have any concerns that it isn’t, then you can complain to your provider or complain directly to Health & Human Services.
Rest assured, should you complain to Health & Human Services, your complaint will be investigated. Since April 2003, more than 15,000 complaints have been received and addressed.
So, what are your healthcare privacy rights?
First, all healthcare providers such as doctors, dentists, optometrists, etc., are required to give you a copy of their Notice of Privacy Practices. Has yours?
Each time you visit a new provider for the first time, their office should give you a copy of their Notice of Privacy Practices. If they don’t — insist that they do.
The copy of the Notice must be one that you can take with you, or, your providers may arrange to mail it to you. But, they do not get to just show it to you, and then keep it themselves.
HIPAA requires the Notice to explain to you, in plain language, what your rights are, what your provider’s responsibilities are to protect your privacy, and it must tell you how your healthcare information can be used and shared. If the Notice doesn’t tell you your rights, insist on getting one that does.
Next, you have the right to look at and get a copy of your entire health record that is maintained by each of your providers. Why would you want a copy of your health records?
Because unscrupulous employees at doctors’ offices can — and do — steal health information and use it to steal identities, or sell it to others who will.
Example: in 2004, an employee of a cancer center in Seattle stole the identity of a patient, and used the information to spend over $9000 on fake charge cards. That person was sentenced to 16 months in federal prison.
Example: just last year, a disgruntled former employee in Providence stole the health information of 200,000 patients. He was caught before he could do any damage, and was recently indicted. There are many more examples of stolen health information.
What if your information is stolen from your provider? If this should happen, your provider must notify you so that you can take the necessary steps to protect yourself, such as run a credit report, check for fraudulent use of your credit cards and bank accounts, etc.
So, you should request a copy of your health records from all your providers. They are required to give you the copy within 30 days of your request.
If your providers cannot give the copy to you within 30 days, they must notify you of their reasons in writing, and then give you a copy within another 30 days.
If your providers do not give you a copy of your health records within a total of 60 days, you can complain to them, or you can file a complaint directly with Health & Human Services.
You may ask for and receive as many copies of your health records as you like, as often as you like. Your rights do not limit the number of copies you may have.
Your providers are allowed to charge you a reasonable, cost-based fee for the copying and postage.
Some providers will give you the first copy of your records at no charge, but charge you for additional copies. Other providers will charge you for every copy.
What if you get a copy of your health record and notice that something is not correct? You now have the right to ask your healthcare providers to change the information in your health record if you think that it is incomplete or is not accurate. They can refuse your request to change the information, but if they do, they must furnish the reason for the denial to you in writing.
If you are given a written denial, then you have the right to submit your reasons for disagreeing with the denial, and your reasons must be added to your health record.
Your healthcare providers are allowed to share your health information with other providers. For example, when your primary physician refers you to a specialist, only the appropriate parts of your health record are given to the specialist so that you can be given the best treatment possible.
In the same way, your providers are allowed to share your health information with your insurance companies, so they can be reimbursed for your care.
Your providers are not required to ask for your authorization in order to share your health information with your other providers or your insurance companies, though it is very common for them to do so.
However, there are a number of other situations in which your provider is legally allowed to share your health information — without your authorization. Do you know what they are?
For example, all states require your providers to disclose information about certain communicable diseases to your local health department. Your providers may disclose this information without your authorization, but they must also track, or otherwise account for, the disclosure.
Other examples include disclosures to law enforcement officials when requested with a court order, court-issued warrant, or subpoena. Your providers may disclose the requested information without your authorization, but again, they must also track or otherwise account to you for the disclosure.
There are several other kinds of disclosures your providers must track, and the Notice of Privacy Practices that your providers give to you should tell you specifically what they are. If the Notice doesn’t give you this information — then ask that it be provided to you.
The most important thing you need to know about the disclosures that can legally be made without your authorization is that your providers must track those disclosures, and they must tell you about them whenever you ask.
Remember, your providers do not have to keep track when they share your health information with other providers who are also caring for you, and they do not have to keep track when they share your health information with your insurance company for reimbursement, or payment, reasons.
But any other kind of disclosure that is made without your authorization must be tracked, and you have the right to know what those disclosures have been.
And don’t forget — if your health information is stolen or otherwise disclosed illegally, your providers must notify you.
Next, you have the right to restrict with whom your providers may share your health information. But, your providers are not necessarily required to agree to your restrictions.
For instance, you can ask that your providers not share your information with certain members of your family. Most providers will agree to this kind of restriction.
However, they will not usually agree to a request to restrict disclosures they need to make to other providers for your treatment, nor will they agree to restrict disclosures to your insurance company. And, your providers always have the right to share your health information in case of an emergency.
Last, you have the right to ask your healthcare providers to communicate with you through a particular address or phone number. For example, if you don’t want them to call you at home with test results, you may ask them to call you at work instead.
Or, you may not want to receive test results on a postcard, but instead want them mailed to you in a sealed envelope. As long as your request is reasonable, your providers must communicate with you in the way that you ask.
Congress and Health & Human Services have given you some significant rights with respect to your healthcare information. These rights are important tools that you can use to help protect your health and personal information. No one is a better watchdog for your information than you. Know your rights, and use them to make sure your healthcare providers are doing everything required by law to protect you and your precious information.
© Lane R. Hatcher, 2006
In addition to more than 15 years experience in healthcare systems and management, Lane R. Hatcher has been the HIPAA Compliance Officer for the largest military hospital in the U.S. for more than three years. Feel free to contact her with any questions about your healthcare privacy rights, or information on how to file a privacy complaint, at lanerhatcher@yahoo.com.
