The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a federal law that required the creation of national standards to protect sensitive patient health information from being disclosed without the patient’s consent or knowledge. The US Department of Health and Human Services (HHS) issued the HIPAA Privacy Rule to implement the requirements of HIPAA. The HIPAA Security Rule protects a subset of information covered by the Privacy Rule.

HIPAA Privacy Rule

The Privacy Rule standards address the use and disclosure of individuals’ health information (known as protected health information or PHI) by entities subject to the Privacy Rule. These individuals and organizations are called “covered entities.”

The Privacy Rule also contains standards for individuals’ rights to understand and control how their health information is used. A major goal of the Privacy Rule is to make sure that individuals’ health information is properly protected while allowing the flow of health information needed to provide and promote high-quality healthcare, and to protect the public’s health and well-being. The Privacy Rule permits important uses of information while protecting the privacy of people who seek care and healing.

Covered Entities

The following types of individuals and organizations are subject to the Privacy Rule and considered covered entities:

• Healthcare providers: Every healthcare provider, regardless of size of practice, who electronically transmits health information in connection with certain transactions. These transactions include:

• • Claims
  • Benefit eligibility inquiries
  • Referral authorization requests
  • Other transactions for which HHS has established standards under the HIPAA Transactions Rule.
• Health plans:
  Health plans include:

• • Health, dental, vision, and prescription drug insurers
  • Health maintenance organizations (HMOs)
  • Medicare, Medicaid, Medicare+Choice, and Medicare supplement insurers
  • Long-term care insurers (excluding nursing home fixed-indemnity policies)
  • Employer-sponsored group health plans
  • Government- and church-sponsored health plans
  • Multi-employer health plans

Exception: A group health plan with fewer than 50 participants that is administered solely by the employer that established and maintains the plan is not a covered entity.

• Healthcare clearinghouses: Entities that process nonstandard information they receive from another entity into a standard (i.e., standard format or data content), or vice versa. In most instances, healthcare clearinghouses will receive individually identifiable health information only when they are providing these processing services to a health plan or healthcare provider as a business associate.
• Business associates: A person or organization (other than a member of a covered entity’s workforce) using or disclosing individually identifiable health information to perform or provide functions, activities, or services for a covered entity.These functions, activities, or services include:
• • Claims processing
  • Data analysis
  • Utilization review
  • Billing

Permitted Uses and Disclosures

The law permits, but does not require, a covered entity to use and disclose PHI, without an individual’s authorization, for the following purposes or situations:

• Disclosure to the individual (if the information is required for access or accounting of disclosures, the entity MUST disclose to the individual)
• Treatment, payment, and healthcare operations
• Opportunity to agree or object to the disclosure of PHI
  • An entity can obtain informal permission by asking the individual outright, or by circumstances that clearly give the individual the opportunity to agree, acquiesce, or object
• Incident to an otherwise permitted use and disclosure
• Limited dataset for research, public health, or healthcare operations
• Public interest and benefit activities—The Privacy Rule permits use and disclosure of PHI, without an individual’s authorization or permission, for 12 national priority purposes:

1. When required by law
2. Public health activities
3. Victims of abuse or neglect or domestic violence
4. Health oversight activities
5. Judicial and administrative proceedings
6. Law enforcement
7. Functions (such as identification) concerning deceased persons
8. Cadaveric organ, eye, or tissue donation
9. Research, under certain conditions
10. To prevent or lessen a serious threat to health or safety
11. Essential government functions
12. Workers’ compensation

HIPAA Security Rule

While the HIPAA Privacy Rule safeguards PHI, the Security Rule protects a subset of information covered by the Privacy Rule. This subset is all individually identifiable health information a covered entity creates, receives, maintains, or transmits in electronic form. This information is called electronic protected health information, or e-PHI. The Security Rule does not apply to PHI transmitted orally or in writing.

To comply with the HIPAA Security Rule, all covered entities must:

• Ensure the confidentiality, integrity, and availability of all e-PHI
• Detect and safeguard against anticipated threats to the security of the information
• Protect against anticipated impermissible uses or disclosures that are not allowed by the rule
• Certify compliance by their workforce

Covered entities should rely on professional ethics and best judgment when considering requests for these permissive uses and disclosures. The HHS Office for Civil Rights enforces HIPAA rules, and all complaints should be reported to that office. HIPAA violations may result in civil monetary or criminal penalties.

The HIPAA Privacy Rule for the first time creates national standards to protect individuals’ medical records and other personal health information.

• It gives patients more control over their health information.
• It sets boundaries on the use and release of health records.
• It establishes appropriate safeguards that health care providers and others must achieve to protect the privacy of health information.
• It holds violators accountable, with civil and criminal penalties that can be imposed if they violate patients’ privacy rights.
• And it strikes a balance when public responsibility supports disclosure of some forms of data – for example, to protect public health.

For patients – it means being able to make informed choices when seeking care and reimbursement for care based on how personal health information may be used.

• It enables patients to find out how their information may be used, and about certain disclosures of their information that have been made.
• It generally limits release of information to the minimum reasonably needed for the purpose of the disclosure.
• It generally gives patients the right to examine and obtain a copy of their own health records and request corrections.
• It empowers individuals to control certain uses and disclosures of their health information.

Most of us believe that our medical and other health information is private and should be protected, and we want to know who has this information. The Privacy Rule, a Federal law, gives you rights over your health information and sets rules and limits on who can look at and receive your health information. The Privacy Rule applies to all forms of individuals' protected health information, whether electronic, written, or oral. The Security Rule is a Federal law that requires security for health information in electronic form.

Who Must Follow These Laws

We call the entities that must follow the HIPAA regulations "covered entities."

Covered entities include:

• Health Plans, including health insurance companies, HMOs, company health plans, and certain government programs that pay for health care, such as Medicare and Medicaid.
• Most Health Care Providers—those that conduct certain business electronically, such as electronically billing your health insurance—including most doctors, clinics, hospitals, psychologists, chiropractors, nursing homes, pharmacies, and dentists.
• Health Care Clearinghouses—entities that process nonstandard health information they receive from another entity into a standard (i.e., standard electronic format or data content), or vice versa.

In addition, business associates of covered entities must follow parts of the HIPAA regulations.

Often, contractors, subcontractors, and other outside persons and companies that are not employees of a covered entity will need to have access to your health information when providing services to the covered entity. We call these entities “business associates.” Examples of business associates include:

• Companies that help your doctors get paid for providing health care, including billing companies and companies that process your health care claims
• Companies that help administer health plans
• People like outside lawyers, accountants, and IT specialists
• Companies that store or destroy medical records

Covered entities must have contracts in place with their business associates, ensuring that they use and disclose your health information properly and safeguard it appropriately. Business associates must also have similar contracts with subcontractors. Business associates (including subcontractors) must follow the use and disclosure provisions of their contracts and the Privacy Rule, and the safeguard requirements of the Security Rule.

Who Is Not Required to Follow These Laws

Many organizations that have health information about you do not have to follow these laws.

Examples of organizations that do not have to follow the Privacy and Security Rules include:

• Life insurers
• Employers
• Workers compensation carriers
• Most schools and school districts
• Many state agencies like child protective service agencies
• Most law enforcement agencies
• Many municipal offices

What Information Is Protected

• Information your doctors, nurses, and other health care providers put in your medical record
• Conversations your doctor has about your care or treatment with nurses and others
• Information about you in your health insurer’s computer system
• Billing information about you at your clinic
• Most other health information about you held by those who must follow these laws

How This Information Is Protected

• Covered entities must put in place safeguards to protect your health information and ensure they do not use or disclose your health information improperly.
• Covered entities must reasonably limit uses and disclosures to the minimum necessary to accomplish their intended purpose.
• Covered entities must have procedures in place to limit who can view and access your health information as well as implement training programs for employees about how to protect your health information.
• Business associates also must put in place safeguards to protect your health information and ensure they do not use or disclose your health information improperly.

What Rights Does the Privacy Rule Give Me over My Health Information?

Health insurers and providers who are covered entities must comply with your right to:

• Ask to see and get a copy of your health records
• Have corrections added to your health information
• Receive a notice that tells you how your health information may be used and shared
• Decide if you want to give your permission before your health information can be used or shared for certain purposes, such as for marketing
• Request that a covered entity restrict how it uses or discloses your health information
• Get a report on when and why your health information was shared for certain purposes
• If you believe your rights are being denied or your health information isn’t being protected, you can
  • File a complaint with your provider or health insurer
  • File a complaint with HHS

You should get to know these important rights, which help you protect your health information.

You can ask your provider or health insurer questions about your rights.

Who Can Look at and Receive Your Health Information

The Privacy Rule sets rules and limits on who can look at and receive your health information

To make sure that your health information is protected in a way that does not interfere with your health care, your information can be used and shared:

• For your treatment and care coordination
• To pay doctors and hospitals for your health care and to help run their businesses
• With your family, relatives, friends, or others you identify who are involved with your health care or your health care bills, unless you object
• To make sure doctors give good care and nursing homes are clean and safe
• To protect the public's health, such as by reporting when the flu is in your area
• To make required reports to the police, such as reporting gunshot wounds

Your health information cannot be used or shared without your written permission unless this law allows it. For example, without your authorization, your provider generally cannot:

• Give your information to your employer
• Use or share your information for marketing or advertising purposes or sell your information

The Privacy Rule gives you, with few exceptions, the right to inspect, review, and receive a copy of your medical records and billing records that are held by health plans and health care providers covered by the Privacy Rule.

Access

Only you or your personal representative has the right to access your records.

A health care provider or health plan may send copies of your records to another provider or health plan only as needed for treatment or payment or with your permission.

The Privacy Rule does not require the health care provider or health plan to share information with other providers or plans.

HIPAA gives you important rights to access your medical record and to keep your information private.

Charges

A provider cannot deny you a copy of your records because you have not paid for the services you have received.

However, a provider may charge for the reasonable costs for copying and mailing the records. The provider cannot charge you a fee for searching for or retrieving your records.

Provider’s Psychotherapy Notes

You do not have the right to access a provider’s psychotherapy notes.

Psychotherapy notes are notes that a mental health professional takes during a conversation with a patient. They are kept separate from the patient’s medical and billing records. HIPAA also does not allow the provider to make most disclosures about psychotherapy notes about you without your authorization.

Corrections

If you think the information in your medical or billing record is incorrect, you can request a change, or amendment, to your record. The health care provider or health plan must respond to your request. If it created the information, it must amend inaccurate or incomplete information.

If the provider or plan does not agree to your request, you have the right to submit a statement of disagreement that the provider or plan must add to your record.

The Privacy Rule controls how a health plan or a covered health care provider shares your protected health information with an employer.

Employment Records

The Privacy Rule does not protect your employment records, even if the information in those records is health-related. In most cases, the Privacy Rule does not apply to the actions of an employer.

If you work for a health plan or a covered health care provider:

• The Privacy Rule does not apply to your employment records.
• The Rule does protect your medical or health plan records if you are a patient of the provider or a member of the health plan.

Requests from your employer

Your employer can ask you for a doctor’s note or other health information if they need the information for sick leave, workers’ compensation, wellness programs, or health insurance.

However, if your employer asks your health care provider directly for information about you, your provider cannot give your employer the information without your authorization unless other laws require them to do so.

Generally, the Privacy Rule applies to the disclosures made by your health care provider, not the questions your employer may ask.

Generally, an HIPAA-covered health care provider or health plan must allow your personal representative to inspect and receive a copy of protected health information about you that they maintain.

Naming a Personal Representative

Your personal representative can be named several ways; state law may affect this process.

If a person can make health care decisions for you using a health care power of attorney, the person is your personal representative.

Children

The personal representative of a minor child is usually the child’s parent or legal guardian.  State laws may affect guardianship. 

In cases where a custody decree exists, the personal representative is the parent(s) who can make health care decisions for the child under the custody decree.

Deceased Persons

When an individual dies, the personal representative for the deceased is the executor or administrator of the deceased individual’s estate, or the person who is legally authorized by a court or by state law to act on the behalf of the deceased individual or his or her estate.

Exceptions

A provider or plan may choose not to treat a person as your personal representative if the provider or plan reasonably believes that the person might endanger you in situations of domestic violence, abuse, or neglect.

The Privacy Rule does not require a health care provider or health plan to share information with your family or friends, unless they are your personal representatives.

However, the provider or plan can share your information with family or friends if:

• They are involved in your health care or payment for your health care,

• You tell the provider or plan that it can do so,

• You do not object to sharing of the information, or

• If, using its professional judgment, a provider or plan believes that you do not object.

Examples

• If you do not object, your doctor could talk with the friend who goes with you to the hospital or with a family member who pays your medical bill. 

• If you send your friend to pick up your prescription for you, the pharmacist can assume that you do not object to their being given the medication.  

• When you are not there or when you are injured and cannot give your permission, a provider may share information with these people if it seems like this would be in your best interest.

Court Order

A HIPAA-covered health care provider or health plan may share your protected health information if it has a court order. This includes the order of an administrative tribunal. However, the provider or plan may only disclose the information specifically described in the order.

Subpoena

A subpoena issued by someone other than a judge, such as a court clerk or an attorney in a case, is different from a court order.

A HIPAA-covered provider or plan may disclose information to a party issuing a subpoena only if the notification requirements of the Privacy Rule are met. Before responding to the subpoena, the provider or plan should receive evidence that there were reasonable efforts to:

• Notify the person who is the subject of the information about the request, so the person has a chance to object to the disclosure, or
• Seek a qualified protective order for the information from the court.

What is the HIPAA notice I receive from my doctor and health plan?

Your health care provider and health plan must give you a notice that tells you how they may use and share your health information. It must also include your health privacy rights. In most cases, you should receive the notice on your first visit to a provider or in the mail from your health plan. You can also ask for a copy at any time.

Why do I have to sign a form?

The law requires your doctor, hospital, or other health care provider to ask you to state in writing that you received the notice.

• The law does not require you to sign the “acknowledgement of receipt of the notice.”
• Signing does not mean that you have agreed to any special uses or disclosures (sharing) of your health records.
• Refusing to sign the acknowledgement does not prevent a provider or plan from using or disclosing health information as HIPAA permits.
• If you refuse to sign the acknowledgement, the provider must keep a record of this fact.

What is in the Notice?

The notice must describe:

• How the Privacy Rule allows provider to use and disclose protected health information. It must also explain that your permission (authorization) is necessary before your health records are shared for any other reason
• The organization’s duties to protect health information privacy
• Your privacy rights, including the right to complain to HHS and to the organization if you believe your privacy rights have been violated
• How to contact the organization for more information and to make a complaint

When and how can I receive a Notice of Privacy Practices?

You’ll usually receive notice at your first appointment. In an emergency, you should receive notice as soon as possible after the emergency.

The notice must also be posted in a clear and easy to find location where patients are able to see it, and a copy must be provided to anyone who asks for one.

If an organization has a website, it must post the notice there.

A health plan must give its notice to you at enrollment. It must also send a reminder at least once every three years that you can ask for the notice at any time.

A health plan can give the notice to the “named insured” (subscriber for coverage). It does not also have to give separate notices to spouses and dependents.

Access to your health information is your right.

Having access to your health records is a powerful tool in staying healthy. With access to your health information you can make better decisions with your doctor, better track your progress and do more to be healthy. The Health Insurance Portability and Accountability Act, or HIPAA, for short, gives you the important right to see and get copies of your health information.

Get it.

Ask your doctor. You have the right to see and get copies of your health information. In most cases, you can get a copy the way you want it, such as by e-mail. While your doctor normally has up to 30 days to provide you a copy of your information, your doctor often can provide the information much sooner than that. If your doctor offers a web portal, you may be able to easily view and download your health information whenever you want. There are a few exceptions to getting your information, but you can’t be denied access for not paying your medical bill. Your doctor can, however, charge you a reasonable fee for a copy of your health information. The fee may not be a per page fee if your information is stored electronically.

Check it.

Check to make sure your health information is correct and complete. If you think something is wrong or missing, you can ask your doctor to fix it. Your doctor might not agree, but you always have the right to have your disagreement added to your record.

Use it.

Having access to your health information means better communication between you and your doctors, less paperwork and greater control over your health. You can request that your doctor share your information directly with others, like family members, a caregiver, a mobile application or “app,” or a researcher.

Information is key to making good healthcare decisions.

• Track your lab results and medications
• Understand your health history
• Get x-rays and other medical images
• Ask better questions and make healthier choices
• Share information with those you want, such as a caregiver, or a research program so you can help yourself and help others.

Know your rights.

If you think your health information privacy rights have been violated in any way you have the right to file a complaint with the Office for Civil Rights (OCR).

OCR is also responsible for enforcing civil rights laws that apply to recipients that receive federal financial assistance from the U.S. Department of Health and Human Services. These laws prohibit discrimination on the basis of race, color, national origin, disability or age. Some laws may also protect against discrimination based on gender or religion.

We’re serious about working with you to protect your health information and make sure you have access to it. Know your rights.

Complaint Requirements

Anyone can file a health information privacy or security complaint. Your complaint must:

• Be filed in writing by mail, fax, e-mail, or via the OCR Complaint Portal
• Name the covered entity or business associate involved, and describe the acts or omissions, you believed violated the requirements of the Privacy, Security, or Breach Notification Rules
• Be filed within 180 days of when you knew that the act or omission complained of occurred. OCR may extend the 180-day period if you can show "good cause"

HIPAA Prohibits Retaliation

Under HIPAA an entity cannot retaliate against you for filing a complaint. You should notify OCR immediately in the event of any retaliatory action.

File a Health Information Privacy Complaint Online

Open the OCR Complaint Portal and select the type of complaint you would like to file. Complete as much information as possible, including:

• Information about you, the complainant
• Details of the complaint
• Any additional information that might help OCR when reviewing your complaint

You will then need to electronically sign the complaint and complete the consent form. After completing the consent form you will be able to print out a copy of your complaint to keep for your records

File a Health Information Privacy Complaint in Writing

NOTE: in accordance with the Office for Personnel Management's and CDC's guidelines on COVID 19, HHS personnel are teleworking. OCR is committed to handling your complaint as quickly as possible. However, for faster processing we strongly encourage you to use the OCR online portal to file complaints rather than filing via mail as our personnel on site is limited.

File a Complaint Using the Health Information Privacy Complaint Form Package

Open and fill out the Health Information Privacy Complaint Form Package in PDF format. You will need Adobe Reader software to fill out the complaint and consent forms. You may either:

• Print and mail the completed complaint and consent forms to:
  Centralized Case Management Operations
  U.S. Department of Health and Human Services
  200 Independence Avenue, S.W.
  Room 509F HHH Bldg.
  Washington, D.C. 20201
• Email the completed complaint and consent forms to OCRComplaint@hhs.gov (Please note that communication by unencrypted email presents a risk that personally identifiable information contained in such an email, may be intercepted by unauthorized third parties)

File A Complaint Without Using Our Health Information Privacy Complaint Package

If you prefer, you may submit a written complaint in your own format by either:

• Print and mail the completed complaint and consent forms to:
  Centralized Case Management Operations
  U.S. Department of Health and Human Services
  200 Independence Avenue, S.W.
  Room 509F HHH Bldg.
  Washington, D.C. 20201
• Email to OCRComplaint@hhs.gov

Be sure to include:

• Your name
• Full address
• Telephone numbers (include area code)
• E-mail address (if available)
• Name, full address and telephone number of the person, agency, or organization you believe violated your (or someone else’s) health information privacy rights or committed another violation of the Privacy or Security Rule
• Brief description of what happened. How, why, and when do you believe your (or someone else’s) health information privacy rights were violated, or how the Privacy or Security Rule otherwise was violated
• Any other relevant information
• Your signature and date of complaint

If you are filing a complaint on someone’s behalf, also provide the name of the person on whose behalf you are filing.

You may also include:

• If you need special accommodations for us to communicate with you about this complaint
• Contact information for someone who can help us reach you if we cannot reach you directly
• If you have filed your complaint somewhere else and where you’ve filed

File a Security Rule Complaint

You may file a Security Rule complaint electronically via the OCR Complaint Portal, or using our Health Information Privacy Complaint Package.

If you mail or fax the complaint, be sure to send it to the appropriate OCR regional office based on where the alleged violation took place. OCR has ten regional offices, and each regional office covers specific states. Send your complaint to the attention of the OCR Regional Manager. You do not need to sign the complaint and consent forms when you submit them by e-mail because submission by e-mail represents your signature.

Before You File a Complaint

Don’t waste time filing a complaint we can’t investigate. Review these questions before filing a health information privacy or security complaint with OCR:

Are you filing a complaint against an entity that is required by law to comply with the Privacy and Security Rules?

Not all entities are required to comply with the Privacy and Security Rules. OCR can only investigate the covered entities that must comply with these rules. Covered entities include most:

• Doctors
• Clinics
• Hospitals
• Psychologists
• Chiropractors
• Nursing Homes
• Pharmacies
• Dentists
• Health Insurance Companies
• Company Health Plans
• Medicare, Medicaid, and other government programs that pay for health care

Does your complaint describe an activity that might violate the Privacy or Security Rule?

If you are not sure, go ahead and file your complaint. But, OCR can only investigate complaints that allege an action or omission that fails to comply with the Privacy or Security Rules. For example, a doctor can send your medical test results to another doctor without your permission if the doctor needs the information to treat you; this is not a violation of the Privacy Rule, so we would not investigate a complaint that described this situation.

Did the activity occur after the Privacy and Security Rules took effect?

OCR cannot investigate Privacy Rule complaints that occurred before April 14, 2003 because compliance with the Privacy Rule was not required until that date. Similarly, OCR cannot investigate Security Rule complaints that occurred before April 20, 2005.

Are you willing to give OCR your name and contact information?

OCR does not investigate complaints filed without a name and contact information on the complaint. If you want OCR to keep your name and contact information confidential during the investigation, you may specify that on the consent form.

The Family Educational Rights and Privacy Act (FERPA) is a federal law enacted in 1974 that protects the privacy of student education records. FERPA applies to any public or private elementary, secondary, or post-secondary school. It also applies to any state or local education agency that receives funds under an applicable program of the US Department of Education.

The Act serves two primary purposes:

1. It gives parents or eligible students more control over their educational records, and
2. It prohibits educational institutions from disclosing “personally identifiable information in education records” without the written consent of an eligible student, or if the student is a minor, the student’s parents (20 U.S.C.S. § 1232g(b)).

An eligible student is one who has reached age 18 or attends a school beyond the high school level.

Parents’ or Eligible Students’ Rights

Parents or eligible students have the right to take the following actions:

• Inspect and review the student’s education records maintained by the school. Schools do not have to provide copies of records unless it is impossible for parents or eligible students to review the original records (e.g., they live far away).
• Request that a school correct records they believe to be inaccurate or misleading. If the school decides not to change the record, the parent or eligible student then has the right to a formal hearing. After the hearing, if the school still decides not to change the record, the parent or eligible student has the right to place a statement with the record that explains his or her view about the contested information.
• Stop the release of personally identifiable information.
• Get a copy of the institution’s policy concerning access to educational records.

Schools need written permission from the parent or eligible student to release any information from a student’s education record. Schools that do not comply with FERPA risk losing federal funding. Because parochial and private schools at the elementary and secondary levels generally do not receive funding under any program administered by the US Department of Education, they are not subject to FERPA. Private postsecondary schools, however, generally do receive such funding and are subject to FERPA.

Permitted Disclosures

FERPA allows schools to disclose information from a student’s education record, without consent, to the following parties or under the following conditions:

• School officials with legitimate educational interest
• Other schools to which a student is transferring
• Specified officials for audit or evaluation purposes
• Appropriate parties in connection with financial aid to a student
• Organizations conducting certain studies for, or on behalf of, the school
• Accrediting organizations
• Appropriate officials in cases of health and safety emergencies
• State and local authorities, within a juvenile justice system, pursuant to specific state law
• To comply with a judicial order or lawfully issued subpoena

Living with HIV requires being active in your medical care – making decisions with your doctor, tracking your progress, and doing everything you can to be healthy.

With HIV, you also may have concerns about keeping your status private.

Whether your health information is stored on paper or electronically, you’ve got the right to keep it private. Those rights are protected by a law known as the Health Insurance Portability and Accountability Act, or HIPAA, for short. HIPAA also gives you other important rights, including the right to a copy of your medical record.

It’s Your Information.

Having access to your medical record can help you better manage your health.

What can you do with access to your information?

• Check to make sure it is accurate and complete;
• Keep track of important health information like test results and prescriptions;
• Have your medical history available if you are getting a new doctor, switching to a different clinic, or visiting a specialist;

Keep track of all your medicines and dosages.

Get it.

You’ve got the right to see, or to access, your medical records. Sometimes you might not be able to see the full record, but you’ve always got the right to ask.

You can get a copy of your record electronically if your doctor keeps your information in an electronic health record. You may be charged a small fee for the cost of printing hard copies or for other supplies.

Check it.

Check to make sure your medical information is correct and complete.

If you think something is wrong or missing, you can ask your doctor to fix it. This is called an amendment. Your doctor may not agree with your request, but you always have the right to ask, and to have your disagreement added to your medical record.

Use it.

What does this mean for you?

• Less paperwork;
• Better care coordination between you and your doctors;
• Fewer unnecessary tests and procedures;
• Greater control over your health.

Know Who Has Seen It.

You also have the right to know how your health information is used and shared.

Your doctor is allowed to share your information for certain reasons, such as determining how to best treat you when you’re sick, or reporting a flu outbreak. But your doctors can’t give your information to an employer, for example, without your permission. If you’d like to know how your health information has been shared, you have the right to get a report. That’s called an accounting of disclosures

Share it.

Under HIPAA you can request to share your health information with someone, like a domestic partner, a parent, a sister or rother, or a friend.

Don’t Share It.

HIPAA gives you the right to ask your doctor or pharmacy not to share information with your health plan, if you pay out of pocket for an item or service.

Decide How to be Reached.

HIPAA gives you the right to say which phone number your doctors should call to reach you, so they can leave a message.

Know your Rights.

All these rights are spelled out in the HIPAA Notice of Privacy Practices, which is given to you by your doctor. If you haven’t seen the Notice, be sure to ask for a copy and read it carefully. It lets you know exactly how your rights are being protected.

Lastly, if you think your health information privacy rights have been violated in any way you have the right to file a complaint.

The Office for Civil Rights (OCR) is also responsible for enforcing civil rights laws that apply to recipients that receive federal financial assistance from the U.S. Department of Health and Human Services. These laws prohibit discrimination on the basis of race, color, national origin, disability (including discrimination because of HIV, AIDS, or Related Conditions) or age. Some laws may also protect against discrimination based on gender or religion.

We’re serious about working with you to protect your health information and make sure you have access to it. Know your rights.