What is the HIPAA law?

What the law was originally for

The “portability” in the name came first: HIPAA limited pre-existing-condition exclusions for people moving between employer health plans. The privacy and security rules most people now associate with it were adopted later by the Department of Health and Human Services (HHS) under the law's “administrative simplification” section, and strengthened in 2009 by the HITECH Act.

The main rules

• Privacy Rule — governs who may use or disclose protected health information, and for what. Treatment, payment and health-care operations are generally permitted; marketing, sale of data and most other uses need your written authorization.
• Security Rule — requires administrative, physical and technical safeguards for electronic records: access controls, risk assessments, encryption where reasonable, staff training.
• Breach Notification Rule — requires notice to affected individuals, to HHS and, for large breaches, to the media when unsecured records are exposed.

What counts as protected health information

Any information held by a covered entity that relates to your health, care or payment for care and could identify you: your name on a lab result, your diagnosis in a billing file, an appointment date tied to your phone number. Once properly de-identified, data falls outside the rule.

Who HIPAA actually binds

Covered entities — providers who bill electronically, health plans and clearinghouses — and their business associates, such as billing companies, IT vendors and lawyers who handle records for them. It does not bind your employer acting as an employer, a school, a life insurer, a gym, or a fitness or period-tracking app you signed up for yourself. This is the most common misunderstanding: a shop or an employer asking about your vaccination status is not violating HIPAA, because neither is a covered entity. Other laws — the ADA, state privacy laws, the FTC's health breach rule — may apply instead.

Watch

When your information can be shared without your permission

Between your doctors for treatment; with your insurer for payment; with public health authorities; in response to a court order or certain subpoenas; to prevent a serious and imminent threat; and in limited situations with family members involved in your care, unless you object. Providers are expected to share only the minimum necessary outside treatment.

Your rights under it

• Obtain a copy of your records, usually within 30 days and for no more than a reasonable cost-based fee, in electronic form if the records are electronic.
• Ask for corrections to information you believe is wrong.
• Get a list of certain disclosures made in the past six years.
• Ask for confidential communications, such as a different mailing address.
• Restrict sharing with a health plan when you paid out of pocket in full.

Common myths

HIPAA does not stop a hospital from telling your spouse you were admitted unless you object; it does not forbid you from sharing your own records with anyone; and it does not prevent a doctor from speaking with another doctor about your care. Refusing to answer a question because of “HIPAA” is often a misunderstanding of what the law requires.

If it is violated

HIPAA has no private right of action — you cannot sue under HIPAA itself. Complaints go to the Office for Civil Rights at HHS, generally within 180 days of when you learned of the problem. OCR can require corrective action and impose civil penalties, and the Department of Justice can prosecute knowing misuse of health information. Separately, most states allow suits for breach of medical confidentiality, invasion of privacy or negligence under state law, and a HIPAA violation is often used as evidence of the standard of care in such a case. A lawyer who handles health care or privacy law can tell you which route fits.

How to get your records

Send a written request to the provider's medical records or privacy office, name the records and format you want, and keep a copy. If the provider refuses or delays well past 30 days, mention the HHS “right of access” initiative — OCR has fined providers specifically for slow responses.