First Name:

Last Name:

Telephone:

Email:

Address:

City:

State:

Zipcode:

Incident Details:

form base
Home » Consumer Information » Personal Privacy

Medical Privacy

Recently instated privacy law indicates the ushering in of a new era in medical privacy policy. Patients are now protected in terms of how health plans, pharmacies, hospitals, and other related facilities can use their medical information. These parameters protect the way in which information contained in medical records is disseminated in print, online, or by mouth. Some of the terms include:

  • How records are accessed
    If they see fit, patients are given the right to read and request copies of their medical records and report any errors that they may encounter. Health entities should provide access to these records within 30 days at no cost to the patient outside of possible printing and shipping expenses.
  • Privacy practices notice
    Doctors, other healthcare providers, and health plans are obligated to provide their patients with a written notice explaining how they use personal medical information and informing them of their rights under privacy rules. Since, the new privacy terms were initiated on April 14, 2003, patients receive the notice on their first visit to a new healthcare provider, or they can obtain it anytime upon request. Normally, patients must acknowledge receipt of the notice and will be asked for their signature as verification. Health insurance providers will provide new clients with the notice as well, and they will also send updates if any drastic amendments are made to the document. Patients may also request that certain facilities go above and beyond practices found in the notice in regards to the set measures for disclosure of medical information. However, it is at the discretion of that particular entity whether it will compromise with the patient.
  • Restrictions on use of an individual’s medical information
    Privacy law limits how health insurance companies and providers covered under a plan can use a patient’s health history. In the patients’ best interest, the regulations do not confine doctors, nurses, and other medical professionals in terms of being able to share information amongst each other in order to better treat a patient. Generally, personal health information cannot be discussed if it is for a purpose unrelated to healthcare, and medical service providers are only allowed to disclose the least amount of confidential information requested in that matter. Patients would also be required to authorize the public availability of this protected information to a nonmedical organization such as a financial institution, marketing firm, or life insurance company.
  • Limits on marketing of patient information
    The new privacy policy imposes restrictions on an individual’s medical information and how it can be used for marketing purposes. Under no circumstances can insurance companies, pharmacies, and other entities covered under the act release a patient’s records for the purpose of marketing without the consent of that individual. On the other hand, the rule allows doctors and other covered medical personnel to discuss treatment options and other health topics, such as disease-management programs, openly with a patient.
  • Stricter state laws
    New federal privacy statutes have no effect on state laws which implement even further privacy protection for patients; in essence, federal privacy law serves as the groundwork that will protect all Americans’ privacy rights, but privacy laws unique to specific states supersede federal guidelines. For example, if state law requires a contagious disease outbreak to be reported to public health officials, federal privacy regulations would not overpower those dictated by the state.
  • Classified communications
    By law, patients can ask that their doctors, or others with whom they communicate directly within the healthcare industry, take necessary precautions to confirm that all dialog between the two parties remains confidential. For example, a patient may request that a doctor call their home as opposed to the workplace, and the doctor’s office should honor their wishes if it is feasible.
  • Filing complaints.
    If a patient has privacy issues with a health plan or provider, they have the option of filing a formal complaint. Complaints can be submitted directly to the plan or provider or HHS’ Office for Civil Rights (OCR), which examines complaints and assists in the enforcement of privacy regulation. Instructions concerning how to file a complaint can be found in an organization’s privacy practices notice. Further details can be located at www.hhs.gov/ocr/hipaa or by calling (866) 627-7748.

Under the privacy rule, insurance providers, doctors, pharmacies, and other organizations are asked to employ policies that ensure client information stays confidential. These strategic guidelines, as laid out by the privacy law, allow for an entity to be flexible in determining the best fit of standards for their business. Beyond a generic set of parameters, each organization must put an additional set of rules in place:

  • Written privacy practices
    Businesses covered by privacy law must have a written privacy system arrangement. This includes an overview of staff allowed to access protected information, how the information will used, and when it may be divulged. In turn, it is the organization’s responsibility to demand that any businesses that they have partnerships with treat this information with the exact same respect.
  • Workforce training.
    Organizations must make sure their employees are competent when it comes to all privacy procedure and appoint a director accountable for the infliction of said procedure. If it comes to light that an employee violated some aspect of the procedure, appropriate punitive action must be taken.
  • Public liability
    Under certain circumstances, privacy rule allows for the disclosure of medical information as it pertains to public responsibilities. This finite list includes:
    • Emergency situations
    • Identification of a carcass
    • Determining cause of death
    • Public health needs
    • Research with little support or which has independent approval from a review board
    • Healthcare system oversight
    • Judicial and administrative proceedings
    • Limited law enforcement activities, including homeland security

Privacy regulations define new limitations on these disclosures. Since no other law requires disclosure under circumstances like these, covered entities are trusted to make the right choice based on their own moral judgments.

  • Government entities also under jurisdiction

The stipulations of the privacy rule typically have equal reign over the private and public sector. For example, both private and government-run hospitals covered by the rule must abide by the entire series of requirements.