Medical Records Privacy: Questions and Answers on the HIPAA Rule
Released: 2005-02-04T00:00:00

RS20500 -- Medical Records Privacy: Questions and Answers on the HIPAA Rule

Updated February 4, 2005

Introduction

Health plans and health care providers and their business associates are subject to the federal health information privacy regulation (45 CFR Parts 160, 164). The privacy rule gives patients the right of access totheir medical information and prohibits health plans and health care providers from using or disclosingindividually identifiable information without a patient's written authorization except as expressly permitted orrequired by the rule. For routine health care operations, including treatment and payment, plans and providersmay use and disclose health information without the individual's authorization. In certain other circumstances(e.g., disclosures to family members and friends), the rule requires plans and providers to give the individualthe opportunity to object to the disclosure. The rule also permits the use and disclosure of health informationwithout the individual's permission for various specified activities (e.g., public health oversight, lawenforcement) that are not directly connected to the treatment of the individual. For uses and disclosures that arenot permitted by the rule, plans and providers must obtain a patient's written authorization. They must alsohave in place reasonable administrative, technical, and physical safeguards to protect patient information fromintentional or unintentional uses or disclosures that are in violation of the rule.

The health privacy rule is one of several new standards mandated by the 1996 Health Insurance Portability and Accountability Act (HIPAA) to support the growth of electronic record keeping and claims processing in thenation's health care system. Under HIPAA, the Secretary of Health and Human Services (HHS) has issuedelectronic format and data standards for several routine administrative transactions between plans and providers(e.g., claims for payment). The Secretary has also issued security standards to safeguard electronic patientinformation against unauthorized access, use, and disclosure. Most plans and providers have until April 21,2005, to comply with the security standards.

The HIPAA privacy and security standards have helped lay the groundwork for the adoption of information technology (IT) systems in health care to support the electronic collection and exchange of patient information. Developing a secure platform to protect confidential health information is central to the growth of a nationalhealth information infrastructure that allows health care providers to share patient information. A small butgrowing number of communities and health care systems around the country have developed electronic medicalrecords and established secure networks for the exchange of health data among providers, patients, and otherauthorized users. The creation of regional networks is seen as a critical step toward the goal of interconnectingthe health care system nationwide. The handling of electronic patient information by these networks hasimportant and, as yet, not fully understood implications for the privacy rule, which was developed with thetraditional paper-based system of medical records in mind.

Questions and Answers about the Health Privacy Rule

Who Is Covered? As specified under HIPAA, the privacy regulation applies to three groups of entities: (i) individual and group health plans that provide or pay formedical care; (ii) health care clearinghouses (i.e., entities that facilitate and process the flow of informationbetween health care providers and payers); and (iii) health care providers who transmit health informationelectronically in a standard format in connection with one of the HIPAA-specified transactions, or who rely onthird-party billing services to conduct such transactions. The rule, therefore, does not apply directly to otherentities that collect and maintain health information such as life insurers, researchers, employers (unless theyare acting as providers or plans), and public health officials. However, business associates with whom coveredentities share health information are covered. Business associates include persons who provide legal, actuarial,accounting, data aggregation, management, administrative, accreditation, or financial services to or for acovered entity. The rule permits a covered entity to disclose health information to a business associate or toallow the business associate to create or receive health information on its behalf, provided both parties sign awritten contract that essentially binds the business associate to the covered entity's privacy practices.

What Types of Health Information Are Covered? The rule covers all individually identifiable health information that is created or received by a covered entity, includinggenetic tests and information about an individual's family history. It applies to both paper and electronicrecords, as well as oral communications. Health information from which all personal identifiers have beenremoved is not subject to the rule.

Can Patients Access and Amend Their Health Information? Yes, covered entities must allow patients to inspect or obtain a copy of their health information, except incertain limited circumstances. Covered entities may charge a reasonable, cost-based copying fee. Patients mayalso request amendment or correction of information that is incorrect or incomplete. Finally, patients have theright to receive a detailed accounting of certain types of disclosures of their health information made bycovered entities during the past six years. Disclosures for routine health care operations and those madepursuant to an authorization (see below) are exempt from the accounting requirement.

How May Plans and Providers Use and Disclose Patient Information? The privacy rule places certain limitations on when and how health plans andhealth care providers may use and disclose medical information. Generally, plans and providers may use anddisclose health information for their own treatment, payment, and health care operations (TPO) without theindividual's authorization and with few restrictions. A covered entity may also disclose information for: thetreatment and payment activities of another provider; the payment activities of another health plan; and forcertain health care operations of another covered entity, if each entity has a relationship with the patient. Forexample, a physician can mail or fax medical test results or a patient's medical record to a specialist whointends to treat the patient, provided that "reasonable safeguards" are used. Patients may request that coveredentities restrict the use and disclosure of their information for TPO, but covered entities are not required toagree to such a request.

The privacy rule also permits the disclosure of health information without a patient's authorization for the following specified national priority activities, consistent with other applicable laws and regulations. First,disclosures may be made for public health purposes (e.g., reporting diseases, collecting vitalstatistics), asrequired by state and federal law. Second, health information may be disclosed to public agencies to conduct health oversight activities such as audits; inspections; civil, criminal, or administrativeproceedings; and otheractivities necessary for oversight of the health care system. Third, disclosures may be made to lawenforcement officials pursuant to a warrant, subpoena, or order issued by a judicial officer, or pursuantto agrand jury subpoena. Disclosures for law enforcement purposes are also permitted pursuant to anadministrative subpoena or summons where a three-part test is met (i.e., the information is relevant, the requestis specific, and non-identifiable information could not reasonably be used). Fourth, health information may bedisclosed in judicial and administrative proceedings if the request for the information is madethrough orpursuant to a court order. Fifth, covered entities may disclose health information to researchers without apatient's authorization, provided an Institutional Review Board (IRB) or an equivalent, newly formed "privacyboard" reviews the research protocol and waives the authorization requirement. (1)

Additionally, health information may be disclosed without authorization: (i) to coroners, medical examiners, and funeral directors; (ii) to workers' compensation programs; (iii) to a government authority authorized toreceive reports of abuse, neglect, or domestic violence; (iv) to organizations in order to facilitate organ, eye,and tissue donation and transplantation; (v) to government agencies for various specialized functions (e.g.,national security and intelligence activities); (vi) to avert a serious threat to health or safety; (vii) and in othersituations as required by law.

For the most part, the privacy rule addresses permissible uses and disclosures. HHS expects covered entities torely on their professional judgement in deciding whether to permit the use or disclosure of health information. Covered entities are required to disclose information only to the individual who is the subject of theinformation and to HHS for enforcement of the rule. For all uses and disclosures of health information that arenot otherwise required or permitted by the rule, covered entities must obtain a patient's written authorization(e.g., releasing information to financial institutions that offer mortgages and other types of loans, or sellingmailing lists to marketing companies).

Authorization forms must contain certain specified core elements including a description of the health information to be used or disclosed and the identity of the recipient of the information. In general, a coveredhealth care provider may not condition treatment on receiving a patient's authorization. Health plans maycondition enrollment or eligibility for benefits on the provision of an authorization prior to an individual'senrollment in the plan. Patients may in writing revoke their authorization at any time.

Can Medical Information Be Shared with a Patient's Family or Friends? Yes, the rule permits covered entities to disclose information to a family member,relative, close friend, or other person identified by the individual. Only information that is directly relevant tosuch person's involvement with the individual's care may be shared. If the individual is present and able tomake health care decisions, the covered entity may disclose information provided (1) the patient has beengiven, in advance, the opportunity to object to any disclosures, or (2) the covered entity, using professionaljudgment, reasonably infers that the patient does not object. In an emergency situation or if the patient is notpresent, the covered entity may use its professional judgment and experience with common practice in decidingwhether a disclosure is appropriate. HHS has repeatedly stated that it is not the intent of the rule to impedecommon health care practices (e.g., hospitals discussing treatment options with spouses and relatives, andfamily members picking up a prescription).

Does the Rule Restrict Parental Involvement and Notification? In general, a parent is deemed to have the rights associated with a minor'shealth information, including the right to authorize disclosure or to request access to the information. But if aminor is authorized by law to consent to treatment and has consented to care (with or without the consent of aparent), or if the parent has assented to an agreement of confidentiality between a provider and a minor, thenthe minor has the exclusive rights associated with that information. The rule, however, defers to state parentalnotification laws. It allows covered entities to disclose a minor's information to a parent (or provide the parentwith access to such information) if such disclosure is permitted or required by state law. Similarly, disclosureto (and access by) a parent is prohibited where prohibited by state law. Where state law is silent or unclearabout parental notification, the rule permits a covered entity to provide or deny access to the parent providedthat action is consistent with state law.

Are There Limits on the Amount of Information Disclosed? The rule requires that whenever a covered entity uses or discloses health information, or requests suchinformation from another covered entity, it must make a reasonable effort to limit the information to theminimum amount necessary to accomplish the intended purpose of the use or disclosure. The minimumnecessary standard does not apply to: disclosures to or requests by a provider for treatment purposes;disclosures made to patients upon their request; disclosures made to the Secretary to enforce compliance;authorized uses or disclosures; and uses or disclosures that are required by law.

What about Incidental Disclosures? Incidental uses and disclosures of health information that occur as a result of a use or disclosure that is otherwise permitted underthe privacy rule are not considered violations of the rule, provided that the covered entity has met thereasonable safeguards and minimum necessary standards. Examples of incidental uses and disclosures includepatient sign-in sheets, bedside charts, and confidential conversations that are inadvertently overheard by others.

Are Covered Entities Required to Explain Their Privacy Practices to Patients? Health plans and health care providers must provide patients with a written notice oftheir privacy practices. Plans are required to give notice at enrollment. Providers that have a direct treatmentrelationship with the patient are required to give notice at the date of first service delivery and, except inemergency situations, make a good faith effort to obtain a written acknowledgment from the patient of receiptof the notice. The notice must include a description of the patient's rights, the legal duties of the coveredentity, and a description of the types of uses and disclosures of information that are permitted, including thosethat do not require an authorization.

Does the Rule Restrict Employers' Access to Health Information? The rule permits a group health plan to disclose individually identifiable healthinformation to an employer that sponsors the plan, provided the information is used only for planadministration purposes. In order for a group health plan to disclose health information to a plan sponsor, theplan documents must be amended so that they limit the uses and disclosures of information by the sponsor tothose consistent with the privacy rule. In addition, an employer must certify to a group health plan that it willnot use the information for employment-related actions (e.g., hiring and promotion decisions). The employermust agree to establish adequate firewalls, so that only those employees that need health information to performfunctions on behalf of the group health plan have access to such information.

Can Health Information Be Used for Marketing? A covered entity may not disclose health information to a third party (e.g., pharmaceutical company), in exchange fordirect or indirect remuneration, for the marketing activities of the third party without first obtaining a patient'sauthorization. Similarly, a covered entity may not use or disclose health information for its own marketingactivities without authorization. However, communications made by a covered entity (or its business associate)to encourage a patient to purchase or use a health care-related product or service are not defined asmarketingunder the rule and, therefore, do not require the patient's authorization, even if the covered entity is paid. Suchcommunications include prescription refill reminders and information about alternative treatments, as well asmore controversial activities paid for by third parties (e.g., communications by pharmacies, paid for by a drugmanufacturer, that recommend patients switch their medication to the company's product).

What Must Covered Entities Do to Ensure Compliance? Covered entities must have reasonable administrative, technical, and physical safeguards in place,commensurate with the size and scope of their business, to protect the privacy of patient information. Theseinclude designating a privacy official, training employees, and developing a system of sanctions for employeeswho violate the entity's policies. Covered entities are not directly liable for the actions of their businessassociates. They may be held liable if they know of a business associate's pattern of activity or practice inviolation of the contract unless they take reasonable steps to correct the problem and, if such steps areunsuccessful, terminate the contract or report the problem to HHS.

Does the Rule Preempt State Health Privacy Laws? As mandated by HIPAA, the rule does not preempt, or override, state laws that are more protective of patientprivacy. Although most states do not have comprehensive health privacy laws, many states have detailed,stringent standards governing the use and disclosure of health information related to certain medical conditions,such as mental illness, genetic testing, and communicable diseases (e.g., HIV/AIDS). These stronger privacyprotections will remain in force. The rule only preempts state laws that are in conflict with its requirements and that provide less stringent privacy protections. Therefore, it serves as a federal "floor" of minimumprivacy protections.

How Will the Rule Be Enforced? Any person who believes a covered entity is not complying with the privacy rule may file a complaint with HHS's Office of Civil Rights(OCR), which is responsible for implementing and enforcing the rule. OCR is working with covered entities toencourage voluntary compliance. It says that enforcement of the rule will be reactive and complaint-driven. Under HIPAA, OCR has the authority to impose civil monetary penalties against covered entities that fail tocomply with the rule, and the Department of Justice may seek criminal penalties for certain wrongfuldisclosures of personal health information. The civil fines are $100 per incident, capped at $25,000 per year foreach provision that is violated. The criminal penalties include fines of up to $250,000 and up to 10 years inprison for disclosing or obtaining health information with the intent to sell, transfer or use it for commercialadvantage, personal gain, or malicious harm. HIPAA did not provide a private right of action for individuals tosue for violations of their health information privacy in federal court. However, nothing in HIPAA prohibitsaggrieved individuals from filing a state law claim against a covered entity for its noncompliance and resultingharm.

Where Can I Obtain More Information? General information on all the HIPAA standards can be found at http://aspe.os.dhhs.gov/admnsimp . Implementationguidance, answers to frequently asked questions, and other details on complying with the privacy rule may befound on the OCR website at http://www.hhs.gov/ocr/hipaa .