HIPAA and Your Hospital Privacy Rights

The Health Insurance Portability and Accountability Act (HIPAA) provides crucial protections for your medical information. Understanding your HIPAA rights helps you control who has access to your health data during and after a hospital stay.

What HIPAA Protects

HIPAA protects your "Protected Health Information" (PHI), which includes:

• Medical records and test results
• Doctor and nurse notes
• Billing and insurance information
• Any information that identifies you and relates to your health condition, treatment, or payment
• Information in any form — electronic, paper, or verbal

Your HIPAA Rights

Right to Access Your Records

• You can request and receive copies of your medical records
• The hospital must respond within 30 days (or 60 days with an extension)
• The hospital can charge a reasonable fee for copies
• You can request records in electronic format

Right to Request Corrections

• If you find errors in your medical records, you can request corrections
• The hospital must respond within 60 days
• If they deny your request, you can submit a statement of disagreement

Right to Know Who Accessed Your Information

• You can request an "accounting of disclosures" — a list of who your information was shared with
• This covers disclosures made in the past six years
• Exceptions include disclosures for treatment, payment, and healthcare operations

Right to Restrict Disclosures

• You can request restrictions on how your information is used or shared
• The hospital doesn't have to agree to all restrictions
• However, if you pay for a service out of pocket in full, you can prevent the hospital from sharing information about that service with your insurer

Right to Confidential Communications

• You can request that the hospital contact you in a specific way (e.g., only by mail, at a specific number)
• The hospital must accommodate reasonable requests

When Hospitals Can Share Your Information Without Consent

• Treatment: Sharing information with other providers involved in your care
• Payment: Submitting claims to your insurance company
• Operations: Quality improvement, training, and accreditation activities
• Public health: Reporting diseases, births, deaths, and suspected abuse
• Law enforcement: When required by court order or specific legal requirements
• Emergencies: To prevent a serious and imminent threat to health or safety

Filing a HIPAA Complaint

If you believe your privacy rights have been violated:

• File a complaint with the hospital's privacy officer
• File a complaint with the U.S. Department of Health and Human Services Office for Civil Rights (OCR)
• Complaints can be filed online, by mail, or by email
• You must file within 180 days of the violation (extensions may be available)

Data sourced from CMS and HHS. Visit Medicare Care Compare or call 1-800-MEDICARE.

Disclaimer: This article is for informational purposes only and does not constitute legal advice.