The biggest legal/medical news of the summer brought the Supreme Court decision upholding national health care.
But, that’s not the only news in this area. The Supreme Court decision overshadowed the federal government’s efforts to explain previous health-care legislation.
On June 4, the Office of Civil Rights issued a press release highlighting patients’ right of access to medical information under HIPAA.
HIPAA stands for Health Insurance Portability and Accountability Act. Passed in 1996, that law’s goals were to “improve the portability and continuity of health insurance” as people switched jobs. Other purposes included promoting health savings accounts and simplifying administration of health insurance. A major HIPAA component is the privacy rule.
Sixteen years after enactment, HIPAA brings enough confusion to warrant a federal press release.
HIPAA’s privacy rule attempted to establish national standards for protecting medical records and health information. One goal was balancing protection of the information against the need to disclose. So, health-care providers and other entities covered by the law must enact protective safeguards.
One such protection requires that any outsourcers have contracts requiring proper safeguards. Covered entities must also have procedures to limit who can view and access health information. Employees must take training programs on health information protection.
Attorneys often get questions along the lines of a medical provider’s alleged release of medical information without permission: “Can I sue for a HIPAA violation?” No, HIPAA creates no private right of action for violation.
Penalties of $100 to $250,000 are in HIPAA for wrongful disclosure. But, they were to be administered by the Secretary of Health and Human Services. Enforcement in the civil courts is not in HIPAA and would depend on state privacy laws.
Many organizations are exempt from and do not have to follow HIPAA rules. Exempt groups include life insurers, employers, workers compensation carriers, many schools and state agencies, including child protective service agencies.