The HIPAA (Health Insurance Portability and Accountability Act) Privacy Rule is a Federal law that gives you rights over your health information and sets guidelines about who can look at and receive your health information. This applies to all forms of health information — written, oral and electronic (computerized).
Your health information cannot be used or shared without your written permission unless this law allows it. For example, without your okay, your provider cannot share your information with your employer, nor for marketing/advertising purposes. Your information only can be used and shared: for coordination of your care and treatment; With any family, relatives, friends or others you name; To protect the public’s health (such as reporting when the flu is in your area); To pay doctors, clinics and hospitals for your care; and to make required reports to the police (such as gunshot wounds).
Who must follow this law?
Most doctors, nurses, pharmacies, clinics, hospitals, nursing homes and many other healthcare providers as well as health insurance companies, HMOs, most employer group plans, and certain government programs that pay for health care, such as Medicare and Medicaid.
What information is protected?
- Information your health care providers put into your medical record;
- Conversations your doctor has with nurses and others about your care;
- Information about you in your health insurer’s computer system;
- Billing information about you at your clinic; and
- Most other health information about you held by those who must follow this law.
Under this law, you have the right to …
- Ask to see and get a copy of your health records;
- Have corrections added to your health information;
- Receive a notice that tells you how your health information may be used and shared;
- Decide if you want to give your permission before your health information can be used or shared for certain purposes (such as marketing); and
- Get a report on when and why your health information was shared.
Click to learn more about our privacy practices in English or Español.