The privacy rule gives patients the right of access totheir medical information and prohibits health plans and health care providers from using or disclosingindividually identifiable information without a patient's written authorization except as expressly permitted orrequired by the rule. The rule also permits the use and disclosure of health informationwithout the individual's permission for various specified activities (e.g., public health oversight, lawenforcement) that are not directly connected to the treatment of the individual. How May Plans and Providers Use and Disclose Patient Information? Generally, plans and providers may use anddisclose health information for their own treatment, payment, and health care operations (TPO) without theindividual's authorization and with few restrictions. The rule requires that whenever a covered entity uses or discloses health information, or requests suchinformation from another covered entity, it must make a reasonable effort to limit the information to theminimum amount necessary to accomplish the intended purpose of the use or disclosure. Are Covered Entities Required to Explain Their Privacy Practices to Patients? Covered entities must have reasonable administrative, technical, and physical safeguards in place,commensurate with the size and scope of their business, to protect the privacy of patient information. As mandated by HIPAA, the rule does not preempt, or override, state laws that are more protective of patientprivacy.
The HIPAA privacy rule gives patients the right of access to theirmedical information and prohibits health plans and health care providers from using or disclosing individuallyidentifiable health information without a patient's written authorization except as expressly permitted orrequired by the rule. Plans and providers are permitted to use and disclose health information for treatment,payment, and other routine health care operations and for various specified national priority activities (e.g., lawenforcement, public health, research). Providers may also share certain information with family members andothers, as long as the patient is given the opportunity to object. Health plans and providers must give enrolleesand patients a notice explaining their privacy rights and how their information will be used. They are alsorequired to have in place reasonable safeguards to protect the privacy of patient information and, in general,must limit the information used or disclosed to the minimum amount necessary to accomplish the intendedpurpose of the use or disclosure. Entities that fail to comply with the rule are subject to civil and criminalpenalties, but patients do not have the right to sue in federal court for violations of the rule. The privacy ruledoes not preempt, or override, state laws that are more protective of medical records privacy.