Individual Health Care Information

Your health care information is confidential and protected under federal law from unwarranted disclosure. The Health Insurance Portability and Accountability Act of 1996, also known as HIPAA, was enacted to address, among other things, the security and privacy concerns regarding the exchange of individual health care information. The act provides an array of patient rights to protect the privacy of individual health care information and sets standards for the disclosure of information as needed for patient care.

Health Insurance Portability and Accountability Act

HIPPA was signed into law in 1996, although several of its provisions designed to protect the confidentiality of individual health care information did not take effect until later. The portion of the act known as the HIPPA Privacy Rule took effect in April 2003. This rule sets forth the regulations governing the disclosure and use of individual health care information by a variety health care related organizations, such as medical service providers, health insurers and employer sponsored health plans. In general, the rule protects any information that pertains to health status, health care coverage or payment for health care that can be identified with a specific individual.

Medical Records

The HIPPA Privacy Rule gives you the right to your medical records, including inspecting, reviewing and obtaining copies. This also includes all billing records of your medical service provider and health insurer. The one exception to this right concerns the notes of your psychotherapy provider. Any mental health professional who takes notes of a conversation with a patient that are kept separate from medical and billing records cannot be forced to disclose the notes. The HIPPA Privacy Rule likewise prohibits the mental health professional from disclosing the notes without your authorization.

Disclosure of Health Information in the Workplace

Although the HIPPA Privacy Rule expressly authorizes the U.S. Department of Health and Human Services to regulate health plans, health care clearinghouses and health care providers, the HHS is not authorized to regulate private employers. As such, your employment records--even if they contain health care related information--are not covered by the HIPPA Privacy Rule. However, if your employer contacts your medical service provider directly and asks for your health care information, the provider is prohibited under the privacy rule from disclosing any of your information without your written authorization.

Legally Required Disclosure

Court orders and subpoenas are often used in lawsuits and other legal processes to compel disclosure of an individual's health information. HIPPA authorizes all medical service providers or health plans to disclose such information in response to an order of a court or tribunal, as long as the information disclosed is limited to what is specified in the order. The requirements for responding to a subpoena issued by an attorney or court clerk are different. Before any information can be disclosed, the medical service provider or health plan must receive some evidence that a reasonable effort was made to notify the individual whose information is being request. The individual must be given a chance to object to the disclosure of the information or seek a protective order from the court prohibiting the disclosure.

Office for Civil Rights

Since 2003, the Office of Civil Rights, also known as OCR, is the division of the HHS charged with enforcing the HIPPA Privacy Rule. The OCR is authorized to take action, including filing a lawsuit, against any health care organization covered by the privacy rule to effect changes in the organization's practices that violate any part of HIPPA. Anyone who believes his rights under HIPPA have been violated can file a complaint with the OCR.