What is HIPAA? How is it different from UMC’s Notice of Privacy Practices? What does HIPAA mean for you as a patient? When filling out medical paperwork, do you know exactly what access you are giving to the contacts you choose?

Medical terms and acronyms are hard to understand when working in the medical field, much less as a patient. Let’s break it down to make it more understandable to you as a patient.

When you become a patient of UMC, you are given a Notice of Privacy Practices to review and to sign an acknowledgement that you have received them. While they are easy to understand how we will disclose your information and for what purpose, HIPAA is a little more in depth. Let us help you to better understand your privacy, security and HIPAA rights and provide you with more information when filling out medical paperwork.

What is HIPAA? HIPAA, the acronym for the Health Insurance Portability and Accountability Act, was passed by Congress in 1996. What this is, is a federal law that protects the privacy rights of individuals in the United States. It establishes a set of standards that protect against the unauthorized disclosure of sensitive and individually identifiable Protected Health Information (PHI). Aside from protecting privacy rights, the act has also helped to modernize the flow of PHI in the U.S. and has reduced national healthcare fraud and abuse.

HIPAA regulations do NOT apply to workplace health records held by an employer that relate to employee benefits such as life insurance, disability, workers compensation, or long-term care insurance.

So with all of this information, what exactly is protected? HIPAA provides federal protection for the following information:

• Diagnosis and treatment information included in medical records by doctors, nurses, and other medical professionals
• Medical test results and other patient information
• Records held by health insurance providers
• Billing information relating to medical treatment
• Prescriptions information
• Any other individually identifiable health information

What are the identifiers for Protected Health Information (PHI)?

1. Full names or last name with initial
2. All geographical identifiers smaller than a state
3. Dates (other than year) directly related to an individual such as birthday or treatment dates
4. Phone numbers including area code
5. Fax number/s
6. Email address/es
7. Social Security number
8. Medical record numbers
9. Health insurance beneficiary numbers
10. Bank account numbers
11. Certificates/drivers license numbers
12. Vehicle identifiers (including VIN and license plate information)
13. Device identifiers and serial numbers
14. Web Uniform Resource Locators (URL’s)
15. Internet Protocol (IP) address numbers
16. Biometric identifiers including fingerprints, retinal, genetic information and voice prints
17. Full face photographs and any comparable images that can identify an individual
18. Any other unique identifying number, characteristic, or code except the unique code assigned by the investigator to code the data

The rule of thumb is that if any of the information is personally recognizable to the patient or if it was utilized or discovered during the course of a healthcare service, it is considered to be PHI. We protect this information and do not disclose it without your authorization or unless we are legally required to or for purposes of billing and to continue your treatment with another provider. Individuals have the right to view all data held by a covered entity and to receive notice when your personal information is used and shared.

Aside from the HIPAA privacy rule, covered entities are also governed by the Privacy Rule which establishes minimum federal standards for protecting the privacy of individually identifiable health information. They set the standards for protecting PHI, and the Security Rule which specifies safeguards for protecting the confidentiality, integrity and availability of electronic Protected Health Information (PHI).

Any breach of personal health data must be notified to the U.S. Department of Health & Human Services (HHS).

What does all of this mean to you as a patient and why are we explaining this? When you fill out any medical paperwork, there is always a form asking you who you would like as a contact and what kind of contact you want them to be, for example emergency contact only. When you select emergency contact only, that person is exactly that, only there in the case of a medical emergency so someone knows where you are. But what if you select a person to have access to everything? What does is mean for them to be HIPAA compliant within your medical chart? Making someone HIPAA compliant means that they are able to have full access to your medical chart and they can make the request for all of this information because you have given them permission. Please make sure you are selecting this option for someone you really intend to have access to all of this information. If you have questions about this, please don’t hesitate to ask someone on the medical staff to help you better understand so you and your private health information is kept safe.