Loren Jacobson¹
Assistant Professor of Law, UNT Dallas College of Law
SPRING 2019 ISSUE CIVIL REMEDIES AND TORTS
You may have noticed that every time you visit a doctor for the first time, you are asked to sign a form acknowledging that you understand the doctor’s privacy policy. But do you ever actually read the privacy policy? Do you know what your rights are with respect to your health information? The Health Insurance Portability and Accountability Act (“HIPAA”) was passed by Congress in 1996.² The law generally prohibits doctors from sharing your personal health information with third parties without your permission. This article provides you with basic information about HIPAA and explains what rights HIPAA gives you with respect to your personal health information.
HIPAA applies to health plans, like an HMO or insurance company, and any health care provider that transmits health information in electronic form in connection with a transaction.³ This means that the vast majority of health care providers, including doctors, nurses, and hospitals, must abide by HIPAA. HIPAA prohibits disclosure of “protected health information” by these health care providers. “Protected health information” includes any information about an individual’s past, present, or future physical or mental health or condition; any information about what health care an individual has received; and any information about an individual’s past, present, or future payments for health care.⁴ Generally, in order to share this information with any third party, your health care provider must get your permission to do so.
HIPAA requires a health care provider to share your protected health information with you.⁵ This is one of your rights under HIPAA. If you request your health information from a health care provider or you request an accounting of your health information, your provider is required to give it to you. You may request the information be provided in a certain format, and your health care provider must provide it to you in that format if it can be readily produced that way.⁶ You may also request that your health information be provided to a third party, such as your spouse, a specialist, or an attorney.⁷ To do this, you should ask your health care provider for a HIPAA request form. You should clearly identify in that form which records to send, the designated recipient, and where to send the records. You must sign the form and return it to your health care provider.⁸ You may have to pay a small fee to cover the cost of copying the records.⁹ You may also have to make your request in writing, and the health care provider has up to 30 days to provide you with your health information.¹⁰
There are a few exceptions to the general rule that your health care provider must give you your health information when you request it. First, patients do not have the right to access their own psychotherapy notes.¹¹ Second, patients do not have a right to obtain information their health care provider has compiled for legal proceedings.¹²
If a health care provider refuses to provide you with your protected health information, the health care provider must provide you written notice that states the basis for the denial, a statement of your right to get a review of the denial, and a description of how to complain to the health care provider or the government.¹³ You then have the right to have the denial reviewed. In that case, the health care provider must designate a licensed health care professional not involved in the denial to review the decision not to give you access to your health care records.¹⁴
HIPAA not only gives you the right to see and access your protected health information, it also gives you the right to check the accuracy of the information and change it if it is incorrect. Specifically, if you believe that the information in your health care record is wrong, you may make a request to your health care provider to amend your health record.¹⁵ Your health care provider may require you to make such a request in writing.¹⁶ If you do, the health care provider has 60 days to make the requested change or to deny the change.¹⁷A health care provider can deny the request if the record you are asking to change was not created by that health care provider or the record is otherwise accurate or complete.¹⁸ Even if your health care provider denies your request to change your health record, she or he must allow you to submit a written statement that disagrees with the denial that will be placed in your health record.¹⁹ If your health information is ever provided to a third party, your health care provider is required to produce not only your health record, but also your statement explaining your disagreement with the accuracy of the record.²⁰
Besides giving you the right to access, check, and change your health care information, HIPAA also protects the privacy of those records. As stated, HIPAA generally prohibits a health care provider or other covered entity from sharing your health care information with a third party without your permission. There are a few exceptions to this rule, however. First, HIPAA allows a health care provider or other covered entity to share your health care information with you even if you do not request it. It also allows your health care information to be shared during the course of treatment or for the purposes of payment.²¹ A health care entity can also share your health care information in emergency situations. For example, your information can be shared if you are incapacitated and your doctor needs to tell your family.²² The health care entity may also share your health care information with public health authorities in certain situations, including data collection with respect to disease outbreaks, reporting of child abuse or neglect, or in relation to your use of an FDA-regulated drug or device.²³ Finally, a health care entity can share your health care information with law enforcement under certain circumstances, for example, if you are suspected to be the victim of a crime²⁴ or if a court has ordered it to do so.²⁵
Although HIPAA protects the privacy of your health information, unfortunately, it does not provide a way for you to sue your health care provider in court if you believe the health care provider has violated your rights under HIPAA.²⁶ Instead, if you believe that your health care provider has exposed your protected health information to a third party without your permission, your only option is to file a complaint with the Secretary of Health and Human Services via the Office of Civil Rights (“OCR”).²⁷ The Office of Civil Rights has the authority to investigate complaints of HIPAA violations and to impose civil and criminal penalties, depending on the severity of the breach. That being said, the OCR cannot impose penalties if the health care provider’s failure to comply with HIPAA was reasonable and is corrected within 30 days of when the health care provider knew of the failure to comply.²⁸ The standard is even higher for imposing criminal penalties: a health care provider must knowingly or willfully violate HIPAA’s privacy rule to be subject to criminal prosecution and penalties.²⁹ Although the OCR rarely penalizes health care providers for violating HIPAA, it does occasionally do so. In 2010, for example, the OCR fined Cignet Health $4.3 million for denying 41 patients access to their medical records.³⁰
In sum, HIPAA requires health care providers and other health care entities to provide you notice of your privacy rights and keep your health information private. Additionally, subject to the exceptions explained above, it allows them to share your health information only with you and others you have specifically designated. HIPAA also gives you a right to access and review your health information and to change it if you believe anything in your record is inaccurate. If your health care provider has denied you any of the rights HIPAA affords you or has breached the privacy of your health records, you can file a complaint with the Office of Civil Rights. Sources ¹ Assistant Professor, UNT Dallas College of Law. ² The law is codified at 42 U.S.C. § 300gg, 21 U.S.C. § 1181 et seq., and 42 U.S.C. § 1320d et seq.
³ See 45 C.F.R. §§ 164.103; 164.104(a); 164.500(a). ⁴ Id. § 164.103. ⁵ Id. §§ 164.502(a)(2); 164.524(a). ⁶ Id. § 164.524(c)(4). ⁷ Id. § 164.524(3)(ii). ⁸ Id. ⁹ See id. § 164.524(c)(2)(i). ¹⁰ Id. § 164.524(b)(2)(i). ¹¹ Id. § 164.524(a)(1)(i). ¹² Id. § 164.524(a)(1)(ii). ¹³ Id. § 164.524(d)(2). ¹⁴ Id. § 164.524(d)(4). ¹⁵ Id. § 164.526(a). ¹⁶ Id. § 164.526(b)(1). ¹⁷ Id. § 164.526(b)(2). ¹⁸ See id. § 164.526(a)(2). ¹⁹ See id. § 164.526(d)(2). ²⁰ Id. § 164.526(d)(5). ²¹ Id. § 164.506(c)(1)(2) & (3). ²² See id. § 164.510(a)(3). ²³ See id. § 164.512(b) & (c). ²⁴ See, e.g., id. § 164.512(f)(3). ²⁵ See, e.g., id. § 164.512(f)(1)(ii). ²⁶ See Acara v. Banks, 470 F.3d 569, 571 (5th Cir. 2006) (holding that because HIPAA does not contain any language expressly giving individuals private rights to bring a case based on a HIPAA violation, Congress intended to preclude such cases). ²⁷ See 45 C.F.R. § 160.306. To get more information about filing a HIPAA complaint, go to https://www.hhs.gov/hipaa/filing-a-complaint/index.html (last checked Nov. 9, 2018). ²⁸ 45 C.F.R. § 160.410(b)(2). ²⁹ See 42 U.S.C. § 1320d-6. ³⁰ Cignet Health Fined a $4.3 Civil Money Penalty for HIPAA Privacy Violations, at https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/examples/cignet-health/index.html (last checked Nov. 9, 2018).
