Healthcare Information Privacy Under HIPAA: Key Rules

Introduction to HIPAA and Patient Access to Medical Records

The Privacy Rule of the Health Insurance Portability and Accountability Act (HIPAA) of 1996 took effect in April 2001, with compliance required as of April 2003 on the part of all covered healthcare entities. The HIPAA privacy requirements pertain to most forms of patient medical information, designating it as protected health information (PHI). Pursuant to HIPAA rules, healthcare entities may not disclose PHI except for certain limited purposes without the written consent and authorization of the patient to whom that information pertains (DHHSOCR, 2003).

Healthcare entities may disclose PHI to the patient him- or herself following a formal written request from the patient identifying the specific information requested. Patient requests for a few specific types of PHI may be refused by the healthcare entity — such as psychotherapy notes, as well as information considered potentially harmful to the patient or to other individuals. In such cases, the patient has the right to have the denied request reviewed for a second opinion from a licensed healthcare professional (Thacker, 2003).

Patients also have the right to be represented by authorized third parties designated as "personal representatives" for the purpose of making medical decisions on behalf of the individual, or to act in other ways on behalf of a decedent or the decedent's estate (DHHSOCR, 2003). Generally, parents of minor children are automatically designated as personal representatives for HIPAA privacy compliance purposes. The right of access to PHI by personal representatives is subject to refusal by the healthcare entity only in cases where there is reasonable belief that the personal representative is abusing, neglecting, or otherwise endangering the welfare of the patient (Thacker, 2003).

Non-Healthcare Uses of Medical Information

Certain types of PHI disclosures for reasons unrelated to a patient's immediate medical care are not subject to the general HIPAA rules of nondisclosure without patient authorization. The disclosure of PHI is permitted where required by federal, state, local, or tribal laws; to public health officials for public health purposes; for certain types of permitted research; to report abuse, neglect, or domestic violence; to law enforcement entities for criminal investigation or pursuant to a court order or subpoena; and in connection with certain formal judicial or administrative proceedings (Thacker, 2003).

Also exempt from the general HIPAA privacy rules requiring patient authorization are PHI disclosures furnished to organ procurement entities for tissue donation or to facilitate transplants; for certain authorized oversight purposes; in conjunction with workers' compensation program administration or claims; for the administration of a deceased patient's funeral and estate; in connection with the investigation and mitigation of serious threats against the patient, other individuals, or public safety; and as necessary for certain elements of essential government functions and administration. The last category includes determining employment suitability within the U.S. State Department, protecting the President, accomplishing or protecting the security of military operations, protecting inmates and employees of correctional facilities, and making determinations of federal program eligibility (Thacker, 2003).