What is HIPAA?

If you have seen a doctor or filled a prescription since April 14, 2003, you probably were asked to read and sign some new, confusing forms. Your doctor's office staff may have grumbled something about "HIPAA" requirements if you asked for an explanation. You probably also received at least one Notice of Privacy Practices from your health insurance company. If you're still wondering what HIPAA is all about, read on.

Protected Health Information

HIPAA stands for the Health Insurance and Portability and Accountability Act, a federal law that contains important privacy safeguards for personal health information.  Protected health information is defined as any individually identifiable information relating to a person's medical condition, treatment, or payment for that treatment. Health plans, providers and certain other entities such as billing services must comply with these privacy safeguards. Employers must  protect the privacy of enrollment information they collect from employees for health insurance purposes. Unauthorized disclosures of information would be a violation of federal law, punishable by a fine of up to $250,000 and 10 years in jail.

Know Your Rights

HIPAA also gives individuals new rights regarding their health information. For example, a woman who is a victim of domestic abuse can request that a doctor call only at work because she doesn't want her spouse to know she is receiving medical care. Patients generally should be able to obtain copies of their medical records and request corrections if they identify errors. Pharmacies and health plans must obtain a patient's permission before disclosing personal information for marketing purposes. Health plans, providers and other covered entities must inform patients about their privacy practices, and must train their employees to observe these practices.

If you believe someone has violated your privacy rights you may file a complaint with the U.S. Department of Health and Human Service. A fact sheet with instructions explains how to file a complaint.

Authorizing the Release of Health Information

The NYS Department of Civil Service has made a number of changes to protect the privacy of state employees' personal information, and to inform employees about these protections. A Notice of Privacy Practices is posted on the Civil Service web site. A universal Authorization for Release of Health Information is also available for downloading. This form can be signed and submitted to the Empire Plan or any HMO  to give the plan permission to release personal health information. This may be required if you contact PEF Health Benefits staff for assistance with a claim problem, for example.