HIPAA Explained in Simple Terms

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is composed of two main rules. The HIPAA privacy rule provides for the privacy of an individual's personally identifiable health information. The HIPAA Security Rule establishes standards for the privacy of electronic health information. HIPAA protects consumers from having their health information unnecessarily disclosed. The Department of Health & Human Services' Office for Civil Rights enforces HIPAA rules.

What is Protected

• HIPAA protects information in your medical records, including conversations between your doctor and nurses about your treatment. HIPAA also protects your billing information and any medical information in your health insurance company's computer system. Medical information which identifies you cannot be unnecessarily shared.

Who Must Follow HIPAA Laws

• HIPAA requires compliance by health care providers (doctors, hospitals, clinics and nursing homes), health plans (insurance companies, HMOs, company health plans, Medicare and Medicaid), and health care clearing houses. These are referred to as "covered entities" under HIPAA regulations, meaning they are covered by the law.

Who Need Not Follow HIPAA

• HIPAA protects your medical records with your doctors and health care providers; it does not cover all organizations which may have some of your medical information. HIPAA does not protect your information held by life insurance companies, employers, schools, or workers compensation carriers. HIPAA also exempts state agencies, municipal offices and law enforcement agencies.

Patient Rights

• You have a right to see your health records, and the right to copies of your health records. There may be a charge for copies of your records. You are required to be given a notice of how your information will be protected, used or shared. You also have the right to file a complaint with your insurance company, doctor, or with the U.S. Government.

Who can See Your Information

• HIPAA allows your information to be shared as necessary for your care, for billing, and for other limited purposes. These include protection of the public's health and for police to make reports of gunshot wounds. Your doctors cannot share your health information with your employer. Your information cannot be shared for advertising or marketing purposes without your written consent. Your health care providers may share your information with your family or others directly involved in or responsible for your care. You can prevent this sharing by making a written request.