Medical privacy

HEADNOTE

FINAL: DECEMBER 28, 2000

Under the 1996 Health Insurance Portability and Accountability Act, Congress gave itself until early 1999 to enact legislation to protect the privacy of individually identifiable

medical information. In the event that Congress missed its own deadline, it instructed the Department of Health and Human Services (HHS) to promulgate privacy protections no later than the end of 1999. Congress missed its self-imposed deadline, so HHS has established guidelines that health plans (insurance companies, HMOs, etc.), health care providers (doctors, hospitals, etc.), and payment clearinghouses must follow to "protect the privacy of individually identifiable health information maintained or transmitted in connection with certain [health-related] transactions."

Patients must be given access to and copies of their records, as well as the ability to correct those records. Plans and providers must also ensure that business partners institute and follow required privacy protections. Individually identifiable records may be released if the patient provides "informed consent," or in connection with payment and/or treatment without informed consent. The rule also provides three principal situations where nonconsensual release is permitted: (1) Law enforcement access to private medical records is made available under a probable cause/safe harbor provision; (2) non-profit medical research and development may access individually identifiable records; and (3) transmission of individual medical data to federally maintained databases of medical records is also exempted from individual consent requirements.