The regulations reflect five basic principles outlined by Secretary Shalala. With few exceptions, an individual's health-care information should be used for health purposes only, such as treatment and payment. Three specific boundaries are outlined. Employers who sponsor health plans may not obtain information for non-health purposes, such as hiring, firing or determining promotions, without permission from the individual. Insurers may not use information to underwrite other products, such as life insurance.
Disclosures are to be kept to the minimum information needed for the purpose of the disclosure.
Specific penalties are provided for the first time. The standards attempt to balance privacy protection with public responsibilities, such as protecting public health, conducting medical research, improving quality of care, and fighting fraud and abuse. Organizations entrusted with information are responsible to protect it against deliberate or inadvertent misuse or disclosure. The standards apply to individuals whether they are privately insured, uninsured, or part of public programs such as Medicare or Medicaid. No private right of action is provided to enable citizens to hold health plans or providers directly accountable for inappropriate and harmful disclosures.