What Is HIPAA? Your Medical Privacy Rights Explained

HIPAA is the Health Insurance Portability and Accountability Act of 1996, a federal law that limits how certain health organizations handle your medical information. It covers health plans and health care providers that send patient information electronically, along with the billing clearinghouses and outside vendors that handle that data for them. Despite its reputation, HIPAA does not cover every mention of your health. It does not reach your employer's personnel files or the stranger who overhears you at a pharmacy.

What does HIPAA stand for?

HIPAA stands for the Health Insurance Portability and Accountability Act of 1996. It was enacted as Public Law 104-191 on August 21, 1996. The original goal was narrower than most people assume: letting workers keep health coverage when they changed jobs, and simplifying electronic medical billing. The privacy protections people associate with the name today, known as the Privacy Rule, came later through regulations written under the law's authority. A companion regulation, the Security Rule, sets safeguards for health information stored or sent electronically. Neither rule turns HIPAA into a general privacy law that follows your health information wherever it goes.

Who has to follow HIPAA

HIPAA's privacy rules bind two kinds of organizations. The first is a covered entity, a term the federal regulation defining HIPAA terms limits to three specific categories.

• Health plans, a category that takes in private insurers, HMOs, Medicare, Medicaid, and employer group health plans
• Health care clearinghouses, the companies that convert billing data between formats for providers and insurers
• Health care providers, from hospitals to solo dentists, once they transmit any health information in electronic form for a transaction the rule covers, such as sending a claim or checking your eligibility

A provider is covered because of that electronic transmission, not because it holds a medical license. Almost every clinic that bills insurance meets the test. A cash-only practice that never transmits electronically can sit outside the rule.

The second category is the business associate: a vendor that creates or handles protected health information on a covered entity's behalf. A billing service that processes claims for a medical practice is one. So is a cloud storage company hosting a hospital's records. The covered entity has to get written assurances that the vendor will safeguard the information, documented in a contract. Business associates are bound directly by the rule too.

Who HIPAA does not cover

This is the part most people get wrong. Telling a coworker you have a migraine is not a HIPAA event, because your coworker is not a covered entity. Neither is your employer's human resources office keeping its own personnel files, since federal regulation excludes employment records a covered entity holds in its role as employer. An employer running a self-insured health plan is a partial exception, because the plan itself is a covered entity even though the personnel office is not. A school nurse's records are usually governed by a different federal law, the Family Educational Rights and Privacy Act. Most fitness and period-tracking apps fall outside HIPAA unless the app works for a doctor's office or insurer. Life insurers are generally not covered entities either, since a HIPAA health plan is defined around providing or paying for medical care.

Falling outside HIPAA does not mean nothing applies. Under the ADA rules on medical examinations and inquiries, a covered employer cannot ask an applicant whether they have a disability, and medical information it does collect has to sit in a separate confidential file.

Who or what	Covered by HIPAA?
Doctor's office	Yes, once it transmits health information electronically
Health insurer	Yes, as a health plan
Pharmacy	Yes, as a provider that transmits claims
Employer's HR files	No, employment records are excluded
Most fitness or period-tracking apps	No, unless acting for a covered entity
School nurse records	Usually no, covered by FERPA instead
Life insurer	No, not a HIPAA health plan

Your rights under the HIPAA Privacy Rule

If a doctor's office or a health plan holds records about you, federal regulation gives you specific tools to see and control that file.

• The right to inspect and get a copy of the records kept about you, in the form and format you ask for if that format is readily producible
• A 30 day deadline for the covered entity to act on your request, with one possible 30 day extension if it gives you the reason for the delay in writing
• The right to be charged only a reasonable, cost based fee, limited to the labor of copying, supplies, postage, and preparing a summary you agreed to in advance
• The right to request an amendment to inaccurate or incomplete information, which the covered entity must act on within 60 days
• The right to an accounting of certain disclosures made in the six years before you ask, a list that leaves out routine treatment and billing disclosures
• The right to ask for restrictions on how your information is used, though a provider has to say yes in only one situation: keeping an item or service away from your health plan when you paid for it in full yourself
• The right to receive a Notice of Privacy Practices explaining how the organization uses and shares your information

The access and fee rules come from the federal regulation on individual access to protected health information, with the amendment and notice rights spelled out in the neighboring sections of the same part.

The access right has limits written into that same section, so do not expect the whole file. Psychotherapy notes sit outside it, and so does information the provider compiled in anticipation of a legal proceeding. A correctional institution may refuse an inmate a copy that would create a safety problem, and research records can be withheld while a study you joined is still running. A denial based on likely danger to someone has to come from a licensed health care professional, and you can have that kind of denial reviewed by a second professional.

When your information can be shared without your OK

HIPAA was never meant to stop routine medical care from functioning, so it carves out broad exceptions to the authorization requirement. Covered entities can use and disclose your information for treatment and payment, and for the administrative work the rule calls health care operations, without asking permission each time. The federal regulation on sharing with people involved in your care and the section after it cover the rest.

• To a family member or close friend involved in your care, if you are present, able to make your own health decisions, and do not object when given the chance to say no
• To that same circle when you cannot answer because of incapacity or an emergency, if the provider decides in its professional judgment that sharing is in your best interest and limits it to what is relevant
• For public health purposes, such as reporting a communicable disease to a health authority
• To law enforcement in narrow situations set out in federal regulation, such as a court order or a grand jury subpoena
• When another law requires the disclosure, limited to what that law actually requires

Outside these categories, a covered entity generally needs your written authorization before sharing your health information with someone else.

Who can access your records on your behalf

Federal regulation lets a personal representative stand in your shoes for HIPAA purposes. That is someone with authority under applicable law to make your health care decisions, such as an agent named in a health care power of attorney. When that authority kicks in matters, so it is worth comparing a durable power of attorney against a springing one. A living will works differently; see living will vs. last will for how the two documents divide medical wishes from property.

Parents are usually the personal representative of an unemancipated minor, but not always, and that is where the federal regulation on personal representatives gets specific. A parent is not the representative for a service the minor lawfully consented to alone, or for one the parent agreed to keep confidential between the child and the provider. Even then, state law controls whether the provider may hand the records over, and where state law is silent a licensed health care professional decides. A covered entity can also refuse to recognize a personal representative if it reasonably believes that person has abused, neglected, or endangered the patient and decides recognition would not be in the patient's best interest. For how these access rules play out near the end of life, see hospice and palliative care rights.

Does HIPAA protect you after you die?

Yes. Federal regulation extends HIPAA's protections to a deceased person's health information for 50 years following death. During that period, an executor or other person with authority over the estate under applicable law acts as the personal representative. A covered entity may also disclose relevant information to family members who were involved in the person's care or payment for care before death, unless that would clash with a preference the person expressed while alive that the covered entity knows about.

What a HIPAA violation is, and how to report one

A HIPAA violation happens when a covered entity or business associate uses or discloses protected health information outside what the rule permits, or denies you the rights described above. A neighbor gossiping about your surgery is unkind, but not a HIPAA violation. A hospital employee who looks up a celebrity patient's chart out of curiosity is a different story.

1. Write down what happened while it is fresh: the date, who was involved, and exactly what information got shared or exposed.
2. Contact the covered entity's privacy officer, whose name or title appears on its Notice of Privacy Practices, if you want to try resolving it directly first.
3. File a written complaint with the HHS Office for Civil Rights within 180 days of when you knew or should have known about the problem, a deadline set out in the federal complaint regulation and waivable for good cause.
4. Keep copies of everything you send. An investigation is required only when a preliminary review points to a possible violation caused by willful neglect. Every other complaint is investigated at the agency's discretion.

Federal courts have held that HIPAA gives individuals no private right to sue over a violation, including the Fifth Circuit's 2006 decision in Acara v. Banks. You generally cannot file your own lawsuit citing a HIPAA violation as the legal claim. State law is a separate question that varies from state to state, so ask a local attorney whether a claim like negligence or a state medical privacy law is available where you live. Civil money penalties under the federal penalty regulation are tiered by culpability, from a violation the entity could not have known about through reasonable diligence, up to willful neglect left uncorrected. The regulation says the dollar amounts are inflation adjusted and republished annually at 45 CFR part 102. Whether a provider's mistake also amounts to malpractice is a different question; see informed consent and medical malpractice. If a debt collector is invoking medical privacy at you, see medical debt collections and HIPAA.

This article is general information, not legal advice. Rules change and vary by state, so check the official source or talk with a licensed attorney in your state about your specific situation.