Patient’s Guide to HIPAA Part I: Learning About HIPAA (FAQ 4 – 12)
You are reading the Patient’s Guide to HIPAA Part I, FAQ 4-12 .
HIPAA Guide Quick Links:
This page includes all of Part I (Learning About HIPAA) FAQs. This section covers the basics of HIPAA.
FAQ 4: What is HIPAA and Why Should You Care?
You can’t get very far into health privacy without running across the acronym HIPAA, which stands for the Health Insurance Portability and Accountability Act, a 1996 US federal statute. Although many people associate HIPAA just with health privacy, the Act actually covers many topics unrelated to privacy. The part of the Act relevant to privacy directed the Department of Health and Human Services to write a health privacy rule. The rule originally took effect on April 14, 2003. Some refer to it as the health privacy rule, the HIPAA rule, or just plain HIPAA. Other HIPAA rules also exist, but they don’t relate to health privacy. When we say HIPAA in this document, it means the HIPAA health privacy rule unless we state otherwise.
Another important part of HIPAA relevant here is the provision that requires the health care world to comply with security standards for medical information. This is the HIPAA security rule. HHS issued security standards under the authority granted by HIPAA. Responsibility for the security rule had been assigned to the Centers for Medicare & Medicaid Services (CMS), but it now belongs to the Office of Civil Rights at HHS. There’s a summary of the security rule at http://www.hhs.gov/ocr/privacy/hipaa/understanding/srsummary.html.
We won’t cover the security rule in detail here because it is of interest primarily to health care providers and insurers who have to implement it. More at http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/index.html.
FAQ 5: Who is a Patient?
Interestingly, HIPAA does not use the term patient. Not everyone who is the subject of a health record is a patient. For example, you may be the beneficiary of a health insurance policy. The insurer has information about you, but you are not the insurer’s patient. Even if that information is only your name, address, and plan number, it is protected health information (PHI) under HIPAA. The HIPAA rule addresses this problem by using the term individual, but we find that term a bit jarring. We use the more familiar term patient here because just about everyone is a patient eventually. HIPAA’s individual and our patient are identical. (For more about what we mean by the term protected health information, see FAQ 8.)
FAQ 6: Do Children Have Privacy Rights?
Yes, but it is complicated. The basic answer is that if a child has a right to make a health care decision about himself or herself, then the child has the right to control information associated with that decision. Otherwise, a parent or guardian or person acting in loco parentis can exercise privacy rights on behalf of a child.
To state the rule more specifically, a child can exclusively exercise his or her own privacy rights with respect to a health care service if:
1) the child is emancipated;
2) the child consents to the health care service and no other consent is needed;
3) the child may lawfully obtain the service without a parent’s consent; or
4) the parent or guardian has consented to an agreement of confidentiality between the child and the health care provider. Legal technicalities can make a big difference here.
In addition, a special rule addresses cases where a covered entity has a reasonable belief that the child is a victim of domestic violence, abuse, or neglect. (A covered entity here is generally a hospital or other health care provider, or possibly a health plan that is required to comply with HIPAA. For more on what is a “covered entity,” see FAQ 9.) The covered entity may decide that it is not in the best interest of the abused child to allow the parent to act on behalf of the child.
It gets even more complicated for minors because the HIPAA rule recognizes that States may have other policies governing privacy, health, and children. When state law specifically addresses disclosure of health information about a minor to a parent or guardian, that law preempts (supersedes) HIPAA whether it prohibits, mandates, or allows discretion about a disclosure.
Rule of Thumb
Normally, HIPAA defers to a stronger state law. However, for minors, HIPAA defers to all state law, whether stronger or weaker.
When does a child become an adult? That depends entirely on state law.
FAQ 7: Do Privacy Rights Survive Death?
Not in the way that they did before. Until the rule changed in 2013, a patient’s privacy rights survived death and lasted forever. The 2013 change means that privacy protections remain in place for fifty years after the date of death. However, if a State has a law that provides for additional privacy protection, that law remains in force. Further, the professional responsibilities of health care providers may require that patient records receive longer protection.
After a patient dies, that patient’s legally authorized executor or administrator, or a person who is otherwise legally authorized to act on the behalf of the deceased patient or patient’s estate, can exercise the deceased patient’s privacy rights.
It is important to know that disclosures for treatment do not require consent or authorization of the patient or the patient’s representative. (For more on authorizations, see FAQs 62-64 ). That means, for example, if information about the deceased patient is relevant to the care of the surviving spouse, the information can be disclosed by a health care provider to the health care provider for the surviving spouse.
Privacy for the dead can be especially messy when questions arise in the period after death and before anyone is formally authorized to act for the patient or the patient’s estate. For many individuals, there may be no formal legal process following death. Another 2013 change helps here. It clarifies that a covered entity may disclose a decedent’s information to family members and others who were involved in the care or payment for care of the decedent prior to death, unless doing so is inconsistent with any prior expressed preference of the individual that is known to the covered entity. This gives health care providers and health plans the discretion to do what they consider to be the right thing for families of recently deceased patients.
FAQ 8: What’s a Health Record?
HIPAA introduces the term protected health information or PHI. The actual definition is a conglomeration of nested and complex terms with even longer exceptions. It is too messy to bother with here. Instead, we offer a rule of thumb that will work just fine most of the time.
Rule of Thumb
Any information that a covered entity (e.g., health care provider or insurer) has about you is PHI. It doesn’t matter if the information is medical, financial, or otherwise. We tend to use the more traditional term – health record or medical record – here, but we mean PHI.
A 2009 change in the statute made it clear that genetic information is PHI. That really didn’t change anything because genetic information is no different than any other information in a health record. Genetic information was already PHI.
FAQ 9: Which Health Care Entities Must Comply With HIPAA?
HIPAA doesn’t apply to every health record keeper or to every health record. Only covered entities must comply with HIPAA. Get used to the term covered entity because it comes up a lot. HIPAA recognizes and regulates three types of covered entities.
This is a complicated area, and this is one of the longest FAQs in this guide. There are lots of types of entities, some covered by HIPAA, some partly covered, and some not at all.
HIPAA generally covers medical information maintained by or for a covered entity. HIPAA generally does NOT cover medical information held by those who are not covered entities. This is an especially important point that many people in the health care world do not understand clearly. Health information that is protected when held by a covered entity (like a medical record held by a hospital) may have no privacy protections when the information is held by a someone who is not a covered entity. In other words, health privacy protections depend on who has the information and not on the nature of the information.
The covered entity concept is complicated. We will explain related terms – business associates and hybrid entities – later in this FAQ.
Covered entities under HIPAA are:
1) Health care clearinghouses
Health care clearinghouses transmit information (typically claims and billing information) between other players in the health care system. For example, a hospital may send the bill for your treatment to a health care clearinghouse that will reformat and submit the information to your insurance company. Clearinghouses are of no interest to the average patient because their function is usually invisible. Patients rarely, if ever, come into contact with them. But clearinghouses have the same obligations as other covered entities, and that is important if you do have an issue with a clearinghouse. Otherwise, don’t worry about clearinghouses. We won’t mention them again.
2) Health plans
Health plans are covered entities. Health insurers, health maintenance organizations (HMOs), and Medicare are examples of health plans subject to HIPAA. So are plans for uniformed service members. Nearly all health plans are covered entities, but some small group health plans (fewer than 50 participants) may not be covered entities. We use health plan and insurer interchangeably here.
3) Health care providers
Health care providers are covered entities, at least most are. Generally, a health care provider is a doctor, hospital, dentist, podiatrist, pharmacist, laboratory, optometrist, and just about anyone else licensed to provide health care. The formal legal definition of health care provider is so complex that it makes lawyers wince.
It is important to understand that HIPAA does not automatically cover all health care providers. It generally depends on whether a provider bills (directly or indirectly) for services electronically. The reason for this odd, even silly, standard has to do with the structure of the health care system and the Department of Health and Human Service’s authority to regulate. Unless you are a policy wonk, you probably don’t want to know more.
Rule of Thumb
School health records
Most school health records are not subject to HIPAA. Instead, school records (private schools are a major exception) are usually covered by another federal privacy law, the Family Educational Rights and Privacy Act (FERPA). The federal Department of Education administers FERPA. A school nurse is likely to be subject only to FERPA. A university hospital that runs a student clinic on behalf of the university is also subject to FERPA. However, other university hospital records about students could also be subject to HIPAA, depending on the circumstances. The relationship between HIPAA and FERPA is very complicated. For more, see http://www2.ed.gov/policy/gen/guid/fpco/doc/ferpa-hipaa-guidance.pdf. Which law is better for privacy? The short answer is that privacy rights under FERPA can be better in some ways than under HIPAA and worse in other ways.
Also, please note that some states or even counties may have specific laws or guidelines regarding making school vaccination records publicly available. See, for example the Texas Immunization Registry: http://www.dshs.state.tx.us/immunize/immtrac/default.shtm#parents.
Business associates and subcontractors
If a covered entity hires another organization to perform a function that requires access to health information, that other company may be a business associate of the covered entity. This happens routinely, for example, when a hospital hires an accounting firm to audit its records. Many covered entities have dozens of business associates. Under a recent change, a business associate of a covered entity is now directly covered by HIPAA. That means that a business associate of a covered entity can be penalized for violations in the same way as a covered entity. This is a good thing, as the possibility of penalties may result in better compliance with the law.
A covered entity must have a contract with each business associate. The contract must require the business associate to comply with all relevant HIPAA provisions. The basic idea is that a covered entity cannot avoid the privacy rule by hiring someone else to process health records.
If a business associate hires another entity to help process PHI, then that entity (called a “subcontractor”) is also subject to HIPAA. If a subcontractor hires another subcontractor, all are covered by HIPAA. Covered entities, business associates, and subcontractors must all process your health records according to HIPAA rules. There’s a lot of complexity here, but it is not the patient’s problem.
Other health record holders
Who else has health records but isn’t subject to HIPAA? Many organizations have health information about you but are neither the organizations nor the records are subject to HIPAA. The list of unregulated health record keepers is shockingly long. These include gyms, medical and fitness apps and devices not offered by covered entities, health websites not offered by covered entities, Internet search engines, life and casualty insurers, Medical Information Bureau, employers (but this one is complicated), worker’s compensation insurers, banks, credit bureaus, credit card companies. many health researchers, National Institutes of Health, cosmetic medicine services, transit companies, hunting and fishing license agencies, occupational health clinics, fitness clubs, home testing laboratories, massage therapists, nutritional counselors, alternative medicine practitioners, disease advocacy groups, marketers of non-prescription health products and foods, and some urgent care facilities. Commercial providers of Personal Health Records have health records but are not covered entities. However, PHRs maintained by or on behalf of your health care provider or insurer are covered by HIPAA.
A health record covered by HIPAA can lose its privacy protection if transferred to a third person who is not a HIPAA covered entity. This is a very important aspect of HIPAA. Some would call it a loophole. We offer four examples of how you may see it in daily life. However, each of our examples has a weasel word (“probably”) because the rule is complicated. If we stopped to explain this kind of thing further, this document would quadruple in size.
• You tell your doctor to give part of your health records to your employer to explain your absence from work. The record will probably not be subject to HIPAA in the hands of your employer.
• A health researcher obtains your health records for use in a properly authorized research project. The records probably have no HIPAA protection in the hands of the researcher. However, if the researcher is treating you as part of the research (as in a clinical trial), then HIPAA may apply.
• You apply for life insurance, and the insurance company obtains your health records with your consent. The records are not subject to HIPAA in the hands of the insurance company, but they may be subject to a state insurance privacy law. Some of the information you authorize the insurer to have may also end up at the Medical Information Bureau (MIB), another organization not subject to HIPAA. If you read the fine print in your application/authorization, you will learn that you authorized disclosure to MIB as well. MIB is subject to the Fair Credit Reporting Act, a different privacy law that provides you with some rights and some protections. (To assert your Fair Credit Reporting Act rights, you would, for example, request a copy of your consumer file from MIB. See http://www.mib.com.)
• Your doctor tells you that you have a communicable disease (e.g., tuberculosis). The doctor must report your illness to the state public health department. The part of the health department that received your record is probably not subject to HIPAA.
We could list additional examples, but we offer a rule of thumb instead.
Rule of Thumb
If a covered entity discloses a health record to anyone who isn’t a covered entity, the record is generally outside the scope of HIPAA in the hands of the recipient. This is a major way that health records escape from privacy protections. This is true online and offline.
If you share health information with your family, a neighbor, or co-worker, the information that you share is not protected under HIPAA in the hands of the recipient. If you share your health information with a website that isn’t a covered entity under HIPAA, then the information you disclose is not protected under HIPAA in the hands of the website. This is a complex area that has created a lot of confusion among some consumers. Web sites that are medical web sites may very well not be covered under HIPAA, even if they say they are “HIPAA-compliant.” See Rule of Thumb, HIPAA Compliant, or HIPAA Covered?
Rule of Thumb
HIPAA Compliant, or HIPAA Covered?
If a company is not covered by HIPAA, it may still say that it is “HIPAA compliant.” HIPAA compliant does not mean the same thing as being a HIPAA covered entity. If you see the words HIPAA compliant, find out if the company is a HIPAA covered entity. This is a yes or no question; there is no “maybe” answer here. If a company is HIPAA compliant but not a HIPAA covered entity, we urge caution. The use of the term HIPAA compliant can be deceptive in that circumstance.
FAQ 10: What are Fair Information Practices and How Do They Relate to HIPAA?
If you read the HIPAA privacy rule – and stayed awake while doing it – the rule would appear to be a welter of detailed and uncoordinated provisions. It actually has a structure, but that structure is difficult to appreciate unless you know about Fair Information Practices, or unless you read the original preamble to the rule from 2000.
The rule implements Fair Information Practices (FIPs), an established set of principles for addressing concerns about information privacy. FIPs are especially significant because they form the basis of many privacy laws in the United States and, to a much greater extent, around the world. Understanding FIPs makes it easier to make sense of the HIPAA privacy rules.
The eight FIPs generally recognized are:
2) Use Limitation;
3) Purpose Specification;
4) Collection Limitation;
5) Data Quality;
7) Access and Correction; and
We could discuss FIPs here in more detail, but it would be a distraction.
Different versions of FIPs exist, and the actual application of FIPs to any set of personal records can be complex, variable, and controversial. We just want you to know that there are basic principles of information privacy that HIPAA mostly implements. You can read a short introduction to FIPS here: http://www.www.worldprivacyforum.org/fairinformationpractices.html. Understanding FIPs is not essential to understanding HIPAA, but it may help some people. But if you are interested, you can find a short history of FIPs at http://bobgellman.com/rg-docs/rg-FIPshistory.pdf.
FAQ 11: Does HIPAA Protect Privacy?
This is a tough question to answer. Health care providers generally care about patient privacy, but health care providers have only some control over the records of their patients. Our complicated health care treatment and payment system places patient health information in the hands of many different providers, insurers, agencies, and others. Before HIPAA, we believe that the health care system mostly paid lip service to privacy. How many hospitals offered you a notice or privacy practices before HIPAA? How many trained their staff in privacy? How many told you that you had a right to see and copy your own records? Before HIPAA, active privacy policies were a rarity in health care. By this measure, HIPAA made some definite improvements.
Our health care system – with third-party payors and lots of government involvement (e.g., Medicare and public health) – places many demands on health records. Everyone wants low-cost, high-quality health care for all. Achieving these objectives often affects privacy in negative ways. The trade-offs can be sharp. HIPAA is decidedly a mixed bag for privacy. It does some good things and some not-so-good things. It protects privacy rights in some ways and undermines those rights in other ways at the same time.
HIPAA gives each patient some rights. There are seven formal rights, not all of which are new everywhere. (See the heading Basic Patient Rights to learn more about the seven rights HIPAA gives patients). However, some of the new rights are not especially meaningful. HIPAA also permits many uses and disclosures of health records without the patient’s consent. Many will find some of these uses and disclosures objectionable. A patient doesn’t have the opportunity to control most uses or disclosures of his or her records.
If you just look at the disclosure provisions, then you might conclude that HIPAA allows many disclosures that you may not think are appropriate. For good or bad, many of those disclosures were routine before HIPAA. However, if you consider the overall state of privacy protections before HIPAA, you might see a marked improvement in many aspects of privacy today.
So does HIPAA protect privacy? Everyone is entitled to his or her own answer to this question. We prefer to say that HIPAA offers patients Fair Information Practices. (See FAQ 10.) Whether the implementation of Fair Information Practices in HIPAA meets your own standards for privacy is for you to say. Everyone has different privacy needs, preferences, and desires.
FAQ 12: How to Solve Problems Presented by HIPAA
In this guide, we point out some shortcomings with the HIPAA rule. The rule doesn’t require covered entities to do everything that you might want. It may not protect privacy sufficiently or define your rights as expansively as you think it should.
In many instances, deficiencies in the rule can be addressed when covered entities (See FAQ 9) and patients work together in good faith to address problems that arise. The rule generally doesn’t prevent covered entities from treating patients better than the rule requires.
We suggest that when the rule doesn’t give you a formal right that you think is reasonable, ask the covered entity to consider doing what you need anyway. The rule gives a covered entity discretion to take actions that can benefit patients and their privacy. If you ask politely and persistently for help, you may get it. If one person won’t bend the rules or procedures, then ask another person a supervisor, or to the Privacy Officer at the covered entity. Try to work cooperatively with the covered entity.
Roadmap: Patient’s Guide to HIPAA: Part 1: Learning About HIPAA (FAQ 4-12)