Protecting Your Medical Privacy

If you’ve been to the doctor, dentist, or a hospital lately, you were probably presented with a form in the waiting room, and asked to sign before treatment. Maybe you just glanced at the form and signed on the dotted line. But it’s worth a second look. The form concerns something important to all of us—a new rule designed to preserve medical privacy—and this article will explain it and answer some important questions.

Your medical records contain personal information, including:

• your name, address, and phone number,
• your age, sex, and marital status,
• names and ages of your children,
• your occupation and Social Security number,
• results of lab tests and physical examinations, and
• your family medical history, including risk factors (such as smoking, obesity or high blood pressure), allergies, immunizations, and any medications prescribed.

None of us would like this kind of private information to be shared with people not involved with our health care, like direct marketers or employers, but until recently doctors and insurance firms were allowed to share this sensitive information with a wide range of people.

The new privacy rule, issued as part of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), gives you more control over how your personal health information is used and disclosed.

Q. Who has to comply with the privacy rule?

A. The rule applies to most health plans, doctors, hospitals, clinics, pharmacies, and nursing homes.

Q. How does the privacy rule protect my medical privacy?

A. Under the rule, you have significant rights to help you understand and control how your health information is used, including the following:

Access to medical records

The rule gives you the right to see and obtain copies of your medical records and request corrections if you identify errors and mistakes. Doctors, hospitals, health plans, and other organizations covered by the rule should generally provide access to your records within 30 days and may charge you for the cost of copying and sending the records.

Notice of privacy practices

Doctors, hospitals, and health plans must provide you with a notice containing information on how they may use your personal medical information. This is the form you were probably given when you visited your doctor or hospital.

Limits on use of personal medical information

The rule sets limits on how doctors, hospitals, health plans, and other organizations to which the rule applies may use individually identifiable health information. The rule does not restrict the ability of doctors, nurses and other providers to share the information needed to treat you. However, your personal health information may not be used for purposes not related to health care.

In addition, you have to sign a specific authorization before a doctor, health plan, or hospital can release your medical information to a life insurer, a bank, a marketing firm, or another outside business for purposes not related to your health care.

Prohibition on marketing

The rule sets new restrictions and limits on the use of your information for marketing purposes. Doctors, hospitals, health plans, and pharmacies must obtain your specific authorization before disclosing your health information for marketing purposes.

Confidential communications

Under the privacy rule, you can request that your doctor or health plan take reasonable steps to ensure that their communications with you are confidential. For example, you could ask a doctor to call your office rather than home, and the doctor’s office should comply with your request if it can be reasonably accommodated.

Tips on How to Protect Your Medical Information

• Take your time and read every form you are asked to sign at the doctor’s office or hospital.
• Ask your doctor for the clinic’s or hospital’s policy on discussing patients among the medical staff.
• Think twice before emailing an internet discussion group and providing information about your medical history. This information can be traced back to you, compiled by the discussion group “host,” and sold to marketing companies.
• If you believe medical staff members are not treating your medical information confidentially, discuss your concerns with your doctor. If you feel your doctor is violating your confidentiality or privacy, report the situation to a managing partner in the clinic or to the chief of staff—even doctors have bosses. You can also report the problem to your state’s medical licensing board and the local medical professional association. Both numbers are in your phone book.

Q. What can I do if I believe my rights to privacy have been violated?

A. If you think your private information has been disclosed, you may file a formal complaint regarding the privacy practices of a covered health plan or provider within 180 days of when you knew the act occurred. You can complain directly to the covered provider or health plan, or to the Office for Civil Rights (OCR), which is charged with investigating complaints and enforcing the privacy regulation. You can find more information about filing a complaint at http://www.hhs.gov/ocr/hipaa or by calling 866-627-7748. If you need help in filing a claim or have questions, please call Burns & Associates at (732) 596-1999.