HIPAA does not allow HHS to preempt state privacy laws that are more protective of health information privacy. Privacy Regulation Establishes New Rights and Responsibilities

The new regulation establishes a minimum level of privacy protection for individually identifiable health information that is applicable nationwide. Patients’ Rights

The regulation protecting personal health information provides patients with a common set of rights regarding access to and use of their medical records. Specifically, the regulation provides patients the following:
Access to their medical records. At the same time, many groups voiced concerns about the merit, clarity, and practicality of certain requirements. Second, plans could include language in their contracts with physicians that would ensure access to patients’ medical record information. The American Health Information Management Association (AHIMA) similarly noted the timing issue for hospitals with respect to getting background medical information from a patient prior to admission. Conclusion

by stakeholder groups reflects the recent issuance of the regulation. With time, everyone will have greater opportunity to examine its provisions in detail and assess their implications for the ongoing operations of all those affected. In addition, on a more fundamental level, the uncertainty stems from HHS’ approach of allowing entities flexibility in complying with its requirements. Although organizations generally applaud this approach, they acknowledge that greater specificity would likely allay some of their compliance concerns.
What GAO Found

Advances in information technology, along with an increasing number of parties with access to identifiable health information, have created new challenges to maintaining the privacy of medical records. Patients and providers alike have expressed concern that broad access to medical records by insurers, employers, and others may result in inappropriate use of the information. Congress sought to protect the privacy of individuals' medical information as part of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). HIPAA included a timetable for developing comprehensive privacy standards that would establish rights for patients with respect to their medical records and define the conditions for using and disclosing identifiable health information. The final privacy regulation offers all Americans the opportunity to know and, to some extent, control how physicians, hospitals, and health plans use their personal information. At the same time, these entities will face a complex set of privacy requirements that are not well understood at this time. Some of the uncertainty expressed by stakeholder groups reflects the recent issuance of the regulation. With time, everyone will have greater opportunity to examine its provisions and assess their implications for the ongoing operations of everyone affected. In addition, on a more fundamental level, the uncertainty stems from HHS' approach of allowing entities flexibility in complying with its requirements. Although organizations generally applaud this approach, they acknowledge that greater specificity would likely allay some of their compliance concerns.