RS20500 -- Medical Records Privacy: Questions and Answers on the HIPAA Rule Updated February 4, 2005 Health plans and health care providers and their business associates are subject to the federal health information privacy regulation (45 CFR Parts 160, 164). The privacy rule gives patients the right of access totheir medical information and prohibits health plans and health care providers from using or disclosingindividually identifiable information without a patient's written authorization except as expressly permitted orrequired by the rule. For routine health care operations, including treatment and payment, plans and providersmay use and disclose health information without the individual's authorization. In certain other circumstances(e.g., disclosures to family members and friends), the rule requires plans and providers to give the individualthe opportunity to object to the disclosure. The rule also permits the use and disclosure of health informationwithout the individual's permission for various specified activities (e.g., public health oversight, lawenforcement) that are not directly connected to the treatment of the individual. For uses and disclosures that arenot permitted by the rule, plans and providers must obtain a patient's written authorization. They must alsohave in place reasonable administrative, technical, and physical safeguards to protect patient information fromintentional or unintentional uses or disclosures that are in violation of the rule. The health privacy rule is one of several new standards mandated by the 1996 Health Insurance Portability and Accountability Act (HIPAA) to support the growth of electronic record keeping and claims processing in thenation's health care system. Under HIPAA, the Secretary of Health and Human Services (HHS) has issuedelectronic format and data standards for several routine administrative transactions between plans and providers(e.g., claims for payment). The Secretary has also issued security standards to safeguard electronic patientinformation against unauthorized access, use, and disclosure. Most plans and providers have until April 21,2005, to comply with the security standards. The HIPAA privacy and security standards have helped lay the groundwork for the adoption of information technology (IT) systems in health care to support the electronic collection and exchange of patient information. Developing a secure platform to protect confidential health information is central to the growth of a nationalhealth information infrastructure that allows health care providers to share patient information. A small butgrowing number of communities and health care systems around the country have developed electronic medicalrecords and established secure networks for the exchange of health data among providers, patients, and otherauthorized users. The creation of regional networks is seen as a critical step toward the goal of interconnectingthe health care system nationwide. The handling of electronic patient information by these networks hasimportant and, as yet, not fully understood implications for the privacy rule, which was developed with thetraditional paper-based system of medical records in mind. Who Is Covered? As specified under HIPAA, the privacy regulation applies to three groups of entities: (i) individual and group health plans that provide or pay formedical care; (ii) health care clearinghouses (i.e., entities that facilitate and process the flow of informationbetween health care providers and payers); and (iii) health care providers who transmit health informationelectronically in a standard format in connection with one of the HIPAA-specified transactions, or who rely onthird-party billing services to conduct such transactions. The rule, therefore, does not apply directly to otherentities that collect and maintain health information such as life insurers, researchers, employers (unless theyare acting as providers or plans), and public health officials. However, business associates with whom coveredentities share health information are covered. Business associates include persons who provide legal, actuarial,accounting, data aggregation, management, administrative, accreditation, or financial services to or for acovered entity. The rule permits a covered entity to disclose health information to a business associate or toallow the business associate to create or receive health information on its behalf, provided both parties sign awritten contract that essentially binds the business associate to the covered entity's privacy practices. What Types of Health Information Are Covered? The rule covers all individually identifiable health information that is created or received by a covered entity, includinggenetic tests and information about an individual's family history. It applies to both paper and electronicrecords, as well as oral communications. Health information from which all personal identifiers have beenremoved is not subject to the rule. Can Patients Access and Amend Their Health Information? Yes, covered entities must allow patients to inspect or obtain a copy of their health information, except incertain limited circumstances. Covered entities may charge a reasonable, cost-based copying fee. Patients mayalso request amendment or correction of information that is incorrect or incomplete. Finally, patients have theright to receive a detailed accounting of certain types of disclosures of their health information made bycovered entities during the past six years. Disclosures for routine health care operations and those madepursuant to an authorization (see below) are exempt from the accounting requirement. How May Plans and Providers Use and Disclose Patient Information? The privacy rule places certain limitations on when and how health plans andhealth care providers may use and disclose medical information. Generally, plans and providers may use anddisclose health information for their own treatment, payment, and health care operations (TPO) without theindividual's authorization and with few restrictions. A covered entity may also disclose information for: thetreatment and payment activities of another provider; the payment activities of another health plan; and forcertain health care operations of another covered entity, if each entity has a relationship with the patient. Forexample, a physician can mail or fax medical test results or a patient's medical record to a specialist whointends to treat the patient, provided that "reasonable safeguards" are used. Patients may request that coveredentities restrict the use and disclosure of their information for TPO, but covered entities are not required toagree to such a request. The privacy rule also permits the disclosure of health information without a patient's authorization for the following specified national priority activities, consistent with other applicable laws and regulations. First,disclosures may be made for public health purposes (e.g., reporting diseases, collecting vitalstatistics), asrequired by state and federal law. Second, health information may be disclosed to public agencies to conduct health oversight activities such as audits; inspections; civil, criminal, or administrativeproceedings; and otheractivities necessary for oversight of the health care system. Third, disclosures may be made to lawenforcement officials pursuant to a warrant, subpoena, or order issued by a judicial officer, or pursuantto agrand jury subpoena. Disclosures for law enforcement purposes are also permitted pursuant to anadministrative subpoena or summons where a three-part test is met (i.e., the information is relevant, the requestis specific, and non-identifiable information could not reasonably be used). Fourth, health information may bedisclosed in judicial and administrative proceedings if the request for the information is madethrough orpursuant to a court order. Fifth, covered entities may disclose health information to researchers without apatient's authorization, provided an Institutional Review Board (IRB) or an equivalent, newly formed "privacyboard" reviews the research protocol and waives the authorization requirement. (1) Additionally, health information may be disclosed without authorization: (i) to coroners, medical examiners, and funeral directors; (ii) to workers' compensation programs; (iii) to a government authority authorized toreceive reports of abuse, neglect, or domestic violence; (iv) to organizations in order to facilitate organ, eye,and tissue donation and transplantation; (v) to government agencies for various specialized functions (e.g.,national security and intelligence activities); (vi) to avert a serious threat to health or safety; (vii) and in othersituations as required by law. For the most part, the privacy rule addresses permissible uses and disclosures. HHS expects covered entities torely on their professional judgement in deciding whether to permit the use or disclosure of health information. Covered entities are required to disclose information only to the individual who is the subject of theinformation and to HHS for enforcement of the rule. For all uses and disclosures of health information that arenot otherwise required or permitted by the rule, covered entities must obtain a patient's written authorization(e.g., releasing information to financial institutions that offer mortgages and other types of loans, or sellingmailing lists to marketing companies). Authorization forms must contain certain specified core elements including a description of the health information to be used or disclosed and the identity of the recipient of the information. In general, a coveredhealth care provider may not condition treatment on receiving a patient's authorization. Health plans maycondition enrollment or eligibility for benefits on the provision of an authorization prior to an individual'senrollment in the plan. Patients may in writing revoke their authorization at any time. Can Medical Information Be Shared with a Patient's Family or Friends? Yes, the rule permits covered entities to disclose information to a family member,relative, close friend, or other person identified by the individual. Only information that is directly relevant tosuch person's involvement with the individual's care may be shared. If the individual is present and able tomake health care decisions, the covered entity may disclose information provided (1) the patient has beengiven, in advance, the opportunity to object to any disclosures, or (2) the covered entity, using professionaljudgment, reasonably infers that the patient does not object. In an emergency situation or if the patient is notpresent, the covered entity may use its professional judgment and experience with common practice in decidingwhether a disclosure is appropriate. HHS has repeatedly stated that it is not the intent of the rule to impedecommon health care practices (e.g., hospitals discussing treatment options with spouses and relatives, andfamily members picking up a prescription). Does the Rule Restrict Parental Involvement and Notification?