CHAPTER 34Code Blue Health Sciences Edition 4

Confidentiality of sensitive information is an important issue in healthcare.

Breaches of confidentiality can occur through idle gossip by employees in cafeterias or elevators, or through inappropriate use of hospital records.

Both can create significant legal liability for the hospital and its employees.

The first federal legislation to protect patient medical information became law on April 14, 2002.

This legislation limits the way that doctors, hospitals, insurance companies, and so on can use private medical information.

The law is named the Health Insurance Portability and Accountability Act (HIPAA).

Patients should be able to see and obtain copies of their medical records and should be able to request corrections if they identify errors and mistakes.

Health plans, doctors, hospitals, clinics, nursing homes and other covered entities should provide access to these records within 30 days, and may charge patients for the cost of copying and mailing the records.

Healthcare providers must notify their patients of how they use personal medical information.

Providers must inform patients of their rights under the new privacy regulation.

Patients must sign or otherwise acknowledge they received the notice.

Patients may ask providers to restrict the disclosure of this information beyond the practices included in the notice.

The privacy rule sets limits on how providers may use personal health information.

The rule does not restrict the ability of doctors, nurses, and other providers to share information with each other and with patients.

In other situations, personal health information may not be used for purposes not related to healthcare.

Providers may use or share the minimum protected information needed for a particular purpose (such as insurance billing).

Pharmacies, health plans and other covered entities must get a patient’s specific authorization before disclosing patient information for marketing.

However, the rule permits doctors and other covered entities to communicate freely with patients about treatment options and other health related information, including disease management programs.

The new federal privacy standards do not affect state laws that provide added privacy protections for patients.

When a state law requires a certain disclosure, such as reporting an infectious disease outbreak to public health authorities, the federal privacy regulations do not preempt state law.

Patients can request that their health care providers take reasonable steps to assure their communications with the patient are confidential.

For example, a patient could ask a doctor to call his or her office rather than home, and the doctor’s office should comply with that request if it can be reasonably accommodated.

Consumers may file a formal complaint about the privacy practices of a covered health plan or provider.

Such complaints can be made directly to the covered provider or to the health plan or to the Health and Human Services Office for Civil Rights, which is charged with investigating complaints and enforcing the privacy regulation.