HIPAA and the Privacy of your Medical Information

Remember that the Rule was written as part of a statute designed to make the administration of health care easier! 

The Privacy Rule is written to balance privacy rights with the flow of information to make treatment and public health possible.  Generally your individually identifiable health information cannot be shared without your consent, but there are broad exceptions.  It is important to actually read the HIPAA notices at the doctor's offices, because they are written to protect the medical offices as well as to protect you.  Each office has some leeway in designing its privacy practices, and they will not be identical at each office. 

Some of the more common exceptions to the Rule are if two physicians are both treating you, or a pharmacy is providing you prescriptions and a physician is treating you, they may share information with each other if the information is deemed necessary for your treatment, even without your knowledge or consent.  If there is a public health or public policy interest at stake, as in preventing the spread of communicable disease, information may be disclosed without consent.  When your health information is disclosed under the Rule, the health care provider must disclose the minimum information necessary, and it is up to the provider to come up with policies to determine what is the minimum necessary. 

The Rule permits disclosure of your health information:

1. to you;
2. to the health care provider's own operations, or other health care providers who have a relationship with you, for treatment, payment or health care operations purposes;
3. where there is informal permission or you have an opportunity to agree or object, as in an emergency, where you are being treated in a large facility like a hospital and the information would be kept in a central directory, or for notification of family members or friends with your informal permission of your health status.;
4. where the use or disclosure is "incidental," or a result of a permitted disclosure under the Rule;
5. for twelve national priority (Public Interest and Public Health) purposes -
   1. when required by law;
   2. to public health authorities to control the spread of disease, or limit injuries from emergencies;
   3. regarding victims of abuse, neglect or domestic violence;
   4. to agencies that oversee the health care and government benefits systems;
   5. in judicial and administrative proceedings by court order or subpoena;
   6. for law enforcement purposes;
   7. to funeral directors, medical examiners and coroners to identify a deceased person or determine cause of death;
   8. for research in limited circumstances;
   9. when the health care provider believes the information is necessary to prevent or lessen a serious threat to the health of another or the public;
   10. essential government functions; and
   11. in compliance with workers' compensation laws; and
6. in a "limited data set" - protected health information which has individual identifiers removed from it.