HIPAA privacy protections for HIV and AIDS patients

HIPAA and Confidentiality

HIPAA, Confidentiality, and HIV / AIDS Patients

The Health Portability and Accountability Act (HIPAA) was enacted by Congress in 1996 to improve health-care access for Americans. While HIPAA contained provisions about health insurance and administrative simplification of those programs, it has become most widely known as a patient privacy bill. The Privacy Rule established in HIPAA gives the patient certain rights over his own health information and sets strict rules and limits on who has access to patient health information. These privacy concerns are especially important if a patient has a disease to which stigma is attached, such as HIV / AIDS. Despite almost two decades of intensive public-health efforts aimed at increasing awareness and knowledge of HIV / AIDS and how it is transmitted, as well as treatment regimes that dramatically alter how a patient experiences the disease, many patients with HIV / AIDS are still subject to discrimination. Therefore, to those patients, privacy concerns are extremely important. However, unlike most diseases, HIV / AIDS is a fatal disease, which can be transmitted even if a person is taking universal health precautions or engaging in safer sexual activity. In order to protect public health, it may seem that HIV / AIDS patients should have different privacy standards than patients suffering from either non-fatal or non-contagious diseases. Because public health issues and patient privacy issues are opposed, one must carefully consider how HIPAA impacts the privacy of health information as it relates to HIV / AIDS patients.

Protections provided by HIPAA

HIPAA prevents covered providers from sharing health information about a patient, except for in a designated set of circumstances. Health information can be shared to treat a patient and to coordinate patient treatment. It can also be shared for billing purposes and to pay doctors and health care providers for their services. Health information can be shared to help in the administration of health care facilities. Health information can be shared to ensure that doctors, health care providers, and nursing home facilities are complying with patient care standards. Health care information can be shared with a patient's family, friends, or designated representatives, especially those involved in patient care, unless the patient objects to the sharing of that information. Health care information can be shared with law enforcement, for example to enforce gunshot reporting laws. Finally, health care information can be shared to protect public health. Unless authorized by one of the above rules, a health care provider cannot share patient health information, unless specifically authorized to do so by the patient. (U.S. Department of Health and Human Services, 2009).

HIPAA's Applicability

While HIPAA seemingly offers broad privacy protections for patients, it is important to understand that HIPAA's applicability is limited.

Entities that must follow the Privacy Rule are known as covered entities and include: health plans, most health care providers, and health care clearinghouses. (U.S. Department of Health and Human Services, 2009). However, the law's protections are basically limited to health care providers. Many other entities with access to health care information are not limited by HIPAA's privacy provisions. These entities include life insurers, employers, workers compensation carriers, schools and school districts, state agencies like child protective agencies, law enforcement agencies, and municipal offices. (U.S. Department of Health and Human Services, 2009). Therefore, while a patient receiving care may be entitled to privacy protections, the existence of a health problem can generally be shared by an entity that comes by that knowledge outside of a patient-doctor relationship.

Protection offered by HIPAA

HIPAA protects information contained in a patient's official health record. However, HIPAA protections are not limited to the official record. For example, conversations that a patient's caregivers have about that patient's care are also protected by HIPAA. Furthermore, information that a patient's health insurance carrier has about the patient is protected by HIPAA. Even seemingly innocuous information, such as billing information, is covered by HIPAA. (U.S. Department of Health and Human Services, 2009). Covered entities must put reasonable safeguards in action to protect health information, including contracting with third-party service providers to ensure patient safety. Furthermore, they must limit transmission of health information to that which is necessary to accomplish the patient's treatment, including prohibiting office staff from viewing patient information outside of a treatment context. (U.S. Department of Health and Human Services, 2009). All of these protections give patients certain rights over their health information. These rights include the right to receive a copy of one's health record, the right to have errors in a health record corrected, the right to notice of how patient information may be used and shared, and a report on when health information is shared for certain purposes. (U.S. Department of Health and Human Services, 2009).

Ramifications of Improper Information Disclosure

Because health information is protected by HIPAA, the improper disclosure of that information immediately makes one think of legal consequences. There are substantial legal consequences for the violation of HIPAA. Depending on how the individual violation occurred, these consequences include civil fines as well as criminal sanctions. Those criminal sanctions include a fine of up to $50,000 and/or a 1 year prison term. Furthermore, if the offense is committed under false pretenses, the offender faces a fine of up to $100,000 and/or a 5-year prison term. If the offense is committed with the intent to use confidential health information for commercial purposes or malicious harm, then the offender faces a fine of up to $250,000 and/or a 10-year prison term. (University of Miami, 2005). While these penalties may punish the offender, they do little to remedy the social and ethical consequences of an unethical disclosure.

From a utilitarian perspective, the improper disclosure of confidential health information related to HIV / AIDS is an absolute wrong. While such improper disclosure may actually be beneficial to the at-risk people in the patient's life, such as unprotected sex partners, when viewed from a societal point-of-view, such disclosure would be improper. Most people who know that they have a contagious fatal disease will take steps to limit other's exposure to that disease. Therefore, it is in society's best interest to encourage testing. The fact that some people will continue to knowingly expose others to the disease is not a compelling reason to break confidentiality, because many people would forego testing if they believed that their results would be made public. The number of people put at risk in each scenario is unequal; therefore the ethical consequences of a breach of confidentiality are worse than the ethical consequences of maintaining confidentiality in the face of suspected dangerous behavior.

From a social perspective, the ramifications of an improper disclosure can be absolutely disastrous. HIV / AIDS still has a stigma attached, and people assume that patients either engaged in unsafe sexual behavior or drug abuse habits. Publication of the fact that someone has HIV / AIDS will almost certainly result in that person being treated differently by some members of society. These differences can be minor, such as the loss of a friendly acquaintance, or major, such as the denial of health care or social services because of one's HIV / AIDS status. Moreover, because HIV / AIDS can be successfully managed, though not cured, a person may live a long and relatively healthy life with no indicators of the disease. Therefore, a breach of confidentiality could have a long-lasting impact on quality of life, which, in turn, may impact patient health.