Health Privacy Act Takes Effect April 14
Consumers will receive notices with information
about their rights to keep medical information private.

New federal medical privacy regulations take effect April 14. "The law gives consumers more control of their private medical information," said Attorney General Tom Miller. "It strengthens consumers' rights, responsibilities and choices."

The new privacy standards have been several years in the making. They are part of a law passed by Congress in 1996 called HIPAA (pronounced "hippa") - the Health Insurance Portability and Accountability Act. One of the main purposes of HIPAA was to deal with medical information in the age of electronic records and claims processing. One goal was to standardize coding for electronic records - and another was to strengthen privacy protections for people's personal medical information.

Privacy has been a top concern for many years in the medical world, and now the industry has undertaken a huge effort to implement the new standards of HIPAA. Much of the intensive work has been behind the scenes, and consumers may not notice many big changes. But there are some consequences of HIPAA consumers should know:

• Consumers will receive new privacy notices from most health entities (hospitals, pharmacies, health plans, insurance companies, nursing homes, doctors, and others.) They will be asked to sign to acknowledge receiving the notices, but signing does not waive or give up any rights provided by the law.
• Consumers will have a right to access their private information, learn how it is used, put restrictions on its use, and submit corrections or amendments. People may see copies of their information. They can ask who has received it, restrict how it's used, and direct where health providers contact them. For example, they can direct health providers to contact them only at home and not at work.
• Consumers get stronger protection. In general, unless consumers give permission for other uses, private medical information only can be used in the course of treatment, payment, health care operations, and a few other limited purposes. There can be penalties if private information is sold or transferred for commercial use without permission (such as selling lists of pregnant patients to baby-formula sellers.) The law establishes complaint procedures that are spelled out in the privacy statements.
• Consumers may notice different procedures at hospitals. At admission, patients will receive privacy information - and will have a choice if they want to "opt out" of the hospital's patient directory. If patients don't opt out, the hospital's registry will contain a patient's name, location, and general condition, such as "good," "fair," or "critical." But callers or visitors still must ask for a patient by name. Patients will need to provide names of persons they want to receive more detailed information. If patients choose not to have any information released, callers asking about them will receive no information. In case of a disaster, hospitals could release general information about the number of people injured and the scope of injuries, but they won't be able to discuss specific persons' injuries.

Consumers would be well-advised to study their privacy notices carefully and consider how their medical information is handled by different parts of their health-care delivery systems. And don't be shy about asking questions. Health care providers and insurance companies in Iowa have been working for years to protect the privacy of their patients and customers, and they will help you understand your rights now.

The HIPAA law and regulations give consumers both more control and more responsibility for their personal medical information. Be sure to know your rights, and make the choices that are best for you.

Here are some other sources of information that can be found on the Internet:

www.hhs.gov/ocr/hipaa - "HIPAA" web site of the U.S. Dept. of Health & Human Services.

www.healthprivacy.org - web site of the Health Privacy Project.

www.iowasnip.org - Iowa-specific HIPAA info. (Click on "deliverables.")

This message is from the Consumer Protection Division of the Iowa Attorney General's Office, Hoover Building, Des Moines, Iowa 50319. Call 515-281-5926. Send email to consumer@ag.state.ia.us. On the web: www.IowaAttorneyGeneral.org.

For more information or to file a complaint, contact the Attorney General's Consumer Protection Division, Des Moines, Iowa 50319. Call 515-281-5926. The Attorney General's web site is: www.IowaAttorneyGeneral.org.