HIPAA

The short version

HIPAA protects your medical privacy. It sets rules for how your health information can be used and shared by doctors, hospitals, and other healthcare providers. Understanding HIPAA helps you control who sees your health records and how they are used.

The law this is built on

Every point below comes from the authority named next to it. Verify the current text before relying on it.

42 U.S.C. § 1320d
This section of the U.S. Code establishes the general requirements for protecting health information. It calls for national standards to protect electronic health information.
Why it matters: This is the main federal law that says your health information must be kept private.
45 C.F.R. Part 164, Subpart E (Privacy Rule)
This part of the federal regulations details your rights regarding your protected health information (PHI). It also explains when and how your PHI can be used or shared by covered entities.
Why it matters: This rule gives you specific rights, like seeing your medical records and requesting corrections.
45 C.F.R. Part 164, Subpart C (Security Rule)
This part of the federal regulations requires covered entities to protect your electronic protected health information (ePHI). It sets national standards for ensuring the confidentiality, integrity, and availability of ePHI.
Why it matters: This rule makes sure your electronic medical records are kept safe from hackers or misuse.
45 C.F.R. Part 164, Subpart D (Breach Notification Rule)
This part of the federal regulations requires covered entities and their business associates to notify affected individuals, the Secretary of HHS, and sometimes the media following a breach of unsecured protected health information.
Why it matters: If your health information is improperly accessed or exposed, this rule requires you to be told about it.

Words you need to know

Protected Health Information (PHI): This is any health information that can identify you. It includes your medical records, health conditions, treatments, and payment information related to your healthcare.
Covered Entity: These are the organizations that must follow HIPAA. They include health plans (like insurance companies), healthcare providers (like doctors and hospitals), and healthcare clearinghouses.
Business Associate: This is a person or company that performs certain functions or activities that involve the use or disclosure of PHI on behalf of a covered entity. Examples include billing companies or IT providers.
Notice of Privacy Practices: This is a document that covered entities must give you. It explains how they can use and share your PHI, and it describes your rights regarding your PHI.
Authorization: This is your written permission that allows a covered entity to use or share your PHI for a specific purpose, beyond what is permitted by law. It must include specific details about what information can be shared and with whom.
Minimum Necessary Rule: Under 45 C.F.R. § 164.502(b), covered entities must make reasonable efforts to limit the use, disclosure, and requests for PHI to the minimum necessary amount to accomplish the intended purpose.

Your rights

✓You have the right to get a copy of your health records.
✓You have the right to ask for changes or corrections to your health records.
✓You have the right to get a list of who your PHI has been shared with.
✓You have the right to ask for limits on how your PHI is used or shared.
✓You have the right to choose how you get information from your healthcare provider.
✓You have the right to file a complaint if you believe your privacy rights have been violated.

How the process actually works

1
Information Collection
When you receive healthcare services
When you visit a doctor or hospital, they collect your health information to provide care. This information becomes your Protected Health Information (PHI).
2
Privacy Notice
Usually at your first visit or when you enroll in a health plan
Your healthcare provider must give you a "Notice of Privacy Practices." This document explains how they use and share your PHI and what your rights are under HIPAA.
3
Use and Disclosure Rules
Ongoing
Your provider can use and share your PHI for treatment, payment, and healthcare operations without your direct permission. For other reasons, like marketing or research, they usually need your written authorization (45 C.F.R. § 164.506).
4
Your Requests
When you make a request
You can ask for a copy of your records, request corrections, or ask for limits on how your PHI is used. The provider must generally respond to these requests.
5
Breach Notification
Promptly after a breach is discovered
If your unsecured PHI is improperly accessed, used, or disclosed, the covered entity must tell you. They must also report the breach to the government (45 C.F.R. Part 164, Subpart D).
6
Complaint Process
When you believe a violation has occurred
If you think your HIPAA rights have been violated, you can file a complaint with the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS).

Deadlines that can end your case

Access to Records
30 days (may be extended to 60 days if the information is stored offsite)
A covered entity must generally respond to your request for access to your PHI within 30 days. If they fail to meet this, it may be a violation of your rights under 45 C.F.R. § 164.524(b)(2).
Amending Records
60 days (may be extended to 90 days)
A covered entity must generally act on your request to amend your PHI within 60 days. If they don't, you can file a statement of disagreement (45 C.F.R. § 164.526(b)(2)).
HIPAA Complaint Filing
180 days from when you knew or should have known of the violation
If you file a complaint with the Office for Civil Rights (OCR) after this time, they may still investigate if they find good cause to waive the deadline (45 C.F.R. § 160.306(a)(2)).

Costly mistakes

✕Not reading your healthcare provider's "Notice of Privacy Practices" to understand how your information is used.
✕Not asking for a copy of your medical records to ensure accuracy.
✕Failing to review the "accounting of disclosures" to see who your information has been shared with.
✕Not requesting an amendment to incorrect health information, which could impact your treatment.
✕Giving blanket authorization for your PHI to be shared without understanding the specific reasons or limits.
✕Waiting too long to file a complaint with the Office for Civil Rights (OCR) if you suspect a violation.

Your checklist

Ask your healthcare provider for their "Notice of Privacy Practices" if you haven't received it.
Read the Notice of Privacy Practices to understand how your information is used.
Ask for a copy of your medical records, especially if you think there might be errors.
Review your medical records for accuracy and ask for corrections if needed.
Understand any authorization forms you are asked to sign before agreeing to share your PHI.
Keep track of any communications or requests you make regarding your privacy rights.
If you suspect a HIPAA violation, gather details and consider filing a complaint with the OCR.

Common questions

Can my doctor share my medical information with my family?

Generally, no, unless you give permission or if the doctor believes it's in your best interest and you are not able to make decisions. For example, if you are unconscious, they might share information relevant to your care with family present (45 C.F.R. § 164.510(b)).

Do I have to sign the Notice of Privacy Practices?

You are usually asked to acknowledge receipt of the Notice of Privacy Practices, but you don't have to sign it. If you refuse to sign, your provider can still treat you, but they must document that they offered it to you (45 C.F.R. § 164.520(c)(2)(ii)).

What happens if my medical information is hacked or exposed?

If your unsecured protected health information is compromised, the organization responsible (covered entity or business associate) must notify you, often by mail or email, without unreasonable delay and no later than 60 days (45 C.F.R. § 164.404).

Can my employer ask for my medical records?

Generally, no. HIPAA does not apply to most employers. Your employer cannot demand your medical records from your doctor without your specific authorization. However, there are exceptions, such as for worker's compensation claims or if your job involves certain health monitoring requirements.

How this changes by state

While HIPAA is a federal law, some states have their own laws that provide even stronger privacy protections for health information. These state laws might cover types of information not fully addressed by HIPAA, like mental health records, or they might offer more stringent rules on who can access your data. When state laws are more protective than HIPAA, the state law takes precedence. To find your state's specific rules, you can often look up your state's Department of Health or Attorney General's office websites, or consult with a local legal aid organization or attorney who specializes in healthcare law.

When you need a lawyer

You should consider contacting a lawyer if your attempts to get your medical records are denied without a valid reason, if you suspect your medical information has been shared inappropriately and caused you harm, or if you believe a HIPAA violation has severely impacted you and you're not getting a satisfactory response from the Office for Civil Rights (OCR). A lawyer can help you understand your options and whether you have a claim under state or federal law.

Do this today

→Review the "Notice of Privacy Practices" from your healthcare providers.
→Request a copy of your medical records to ensure they are accurate and complete.
→Be mindful of any forms you sign that authorize the sharing of your health information.
→If you have concerns about your medical privacy, contact your healthcare provider's privacy officer first.

This lesson is legal information for educational purposes only, based on 42 U.S.C. § 1320d; 45 C.F.R. Part 164. It is not legal advice and does not create an attorney-client relationship.