Privacy Act Takes Effect April 14
Consumers will receive notices with information
about their rights to keep medical information private.
New federal medical privacy regulations take effect April 14. "The law gives consumers more control of their
private medical information," said Attorney General Tom Miller. "It strengthens consumers' rights,
responsibilities and choices."
The new privacy standards have been several years in the making. They are part of a law passed by Congress
in 1996 called HIPAA (pronounced "hippa") - the Health Insurance Portability and Accountability Act. One of
the main purposes of HIPAA was to deal with medical information in the age of electronic records and claims
processing. One goal was to standardize coding for electronic records - and another was to strengthen privacy
protections for people's personal medical information.
Privacy has been a top concern for many years in the medical world, and now the industry has undertaken a
huge effort to implement the new standards of HIPAA. Much of the intensive work has been behind the
scenes, and consumers may not notice many big changes. But there are some consequences of HIPAA
consumers should know:
- Consumers will receive new privacy notices from most health entities (hospitals, pharmacies, health
plans, insurance companies, nursing homes, doctors, and others.) They will be asked to sign to
acknowledge receiving the notices, but signing does not waive or give up any rights provided by the law.
- Consumers will have a right to access their private information, learn how it is used, put restrictions
on its use, and submit corrections or amendments. People may see copies of their information. They
can ask who has received it, restrict how it's used, and direct where health providers contact them. For
example, they can direct health providers to contact them only at home and not at work.
- Consumers get stronger protection. In general, unless consumers give permission for other uses, private
medical information only can be used in the course of treatment, payment, health care operations, and a few
other limited purposes. There can be penalties if private information is sold or transferred for commercial use
without permission (such as selling lists of pregnant patients to baby-formula sellers.) The law establishes
complaint procedures that are spelled out in the privacy statements.
- Consumers may notice different procedures at hospitals. At admission, patients will receive privacy
information - and will have a choice if they want to "opt out" of the hospital's patient directory. If patients
don't opt out, the hospital's registry will contain a patient's name, location, and general condition, such as
"good," "fair," or "critical." But callers or visitors still must ask for a patient by name. Patients will need to
provide names of persons they want to receive more detailed information. If patients choose not to have any
information released, callers asking about them will receive no information. In case of a disaster, hospitals
could release general information about the number of people injured and the scope of injuries, but they
won't be able to discuss specific persons' injuries.
Consumers would be well-advised to study their privacy notices carefully and consider how their medical
information is handled by different parts of their health-care delivery systems. And don't be shy about asking
questions. Health care providers and insurance companies in Iowa have been working for years to protect the
privacy of their patients and customers, and they will help you understand your rights now.
The HIPAA law and regulations give consumers both more control and more responsibility for their personal
medical information. Be sure to know your rights, and make the choices that are best for you.
Here are some other sources of information that can be found on the Internet:
www.hhs.gov/ocr/hipaa - "HIPAA" web site of the U.S. Dept. of Health & Human Services.
www.healthprivacy.org - web site of the Health Privacy Project.
www.iowasnip.org - Iowa-specific HIPAA info. (Click on "deliverables.")
This message is from the Consumer Protection Division of the Iowa Attorney General's Office, Hoover
Building, Des Moines, Iowa 50319. Call 515-281-5926. Send email to email@example.com. On the
more information or to file a complaint, contact the Attorney
General's Consumer Protection Division, Des Moines, Iowa
50319. Call 515-281-5926. The Attorney General's
web site is: www.IowaAttorneyGeneral.org.