HIPAA Privacy Checker

HIPAA’s privacy rules apply to health plans, to health care providers that send health information electronically for a standard transaction such as a claim to a health plan, and to health care clearinghouses, which convert billing data between formats; the rules call these “covered entities.” 45 CFR 160.103

This checker asks up to four questions, about who has the information and who would get it, and links each rule it uses to the regulation it comes from.

How This Checker Decides

• HIPAA’s privacy rules apply to health plans, to health care providers that send health information electronically for a standard transaction such as a claim to a health plan, and to health care clearinghouses, which convert billing data between formats; the rules call these “covered entities.” 45 CFR 160.103
• HIPAA doesn’t protect health information in records an employer keeps as an employer, such as a doctor’s note in a personnel file, even when the employer is a hospital. 45 CFR 160.103
• A consumer app, device or website that a person picks on their own and that doesn’t treat patients or bill insurance, such as a fitness tracker, isn’t a covered entity; HIPAA reaches it only when it works on behalf of a provider or health plan as a business associate, such as a personal health record offered by the provider. 45 CFR 160.103
• A covered entity or business associate may use or share protected health information only as the Privacy Rule permits or requires. 45 CFR 164.502(a)
• The rule requires a covered entity to disclose information in only two cases: to the patient who asks for it, and to the U.S. Department of Health and Human Services when it investigates compliance. 45 CFR 164.502(a)(2)
• A covered entity may share information without the patient’s permission for its own treatment, payment and health care operations, for another provider’s treatment of the patient, and for another provider’s or plan’s payment activities. 45 CFR 164.506(c)
• A covered entity may share with a family member, other relative, close friend or anyone else the patient names the information directly relevant to that person’s involvement in the patient’s care or in paying for it. When the patient is present and able to make health care decisions, the provider may share only if the patient agrees, doesn’t object when given the chance, or clearly wouldn’t object given the circumstances. 45 CFR 164.510(b)(1)(i)45 CFR 164.510(b)(2)
• Outside the uses the rule permits or requires, a covered entity needs the patient’s valid authorization: a signed, dated form. 45 CFR 164.508(a)(1)
• A covered entity must get the patient’s authorization for almost any use or disclosure of psychotherapy notes; only the therapist who wrote them may use them for treatment without one. The other exceptions are narrow: the provider’s own supervised training programs, defending itself against the patient’s legal claim, an HHS compliance investigation, disclosures a law requires, oversight of the therapist, a coroner or medical examiner, and preventing a serious and imminent threat to someone’s health or safety. 45 CFR 164.508(a)(2)

Who HIPAA Covers, and Who It Doesn’t

• A health care provider is any person or organization that furnishes, bills or is paid for health care in the normal course of business. 45 CFR 160.103
• Health plans include health insurers, HMOs, employer group health plans, Medicare, Medicaid and the VA health care program. 45 CFR 160.103
• Companies that handle health information for a covered entity, such as a billing service or a company running a patient portal for a provider, are “business associates” and must follow the rules too. 45 CFR 160.103
• HIPAA doesn’t cover a provider that never sends health information electronically for a standard transaction, such as a therapist who takes only cash and never bills insurance, or an employer’s group health plan with fewer than 50 participants that the employer runs itself. 45 CFR 160.103
• HIPAA doesn’t protect health information in records an employer keeps as an employer, such as a doctor’s note in a personnel file, even when the employer is a hospital. 45 CFR 160.103
• Employers, life insurers and schools can hold health information, but none of them is on the list of covered entities. 45 CFR 160.103
• A consumer app, device or website that a person picks on their own and that doesn’t treat patients or bill insurance, such as a fitness tracker, isn’t a covered entity; HIPAA reaches it only when it works on behalf of a provider or health plan as a business associate, such as a personal health record offered by the provider. 45 CFR 160.103
• Health information in school records covered by the Family Educational Rights and Privacy Act, or FERPA, isn’t protected health information under HIPAA, and neither are the treatment records FERPA describes for students 18 or older or in college. 45 CFR 160.103

What Can Be Shared Without Permission

• A covered entity may share information without the patient’s permission for its own treatment, payment and health care operations, for another provider’s treatment of the patient, and for another provider’s or plan’s payment activities. 45 CFR 164.506(c)
• A covered entity may share with a family member, other relative, close friend or anyone else the patient names the information directly relevant to that person’s involvement in the patient’s care or in paying for it. When the patient is present and able to make health care decisions, the provider may share only if the patient agrees, doesn’t object when given the chance, or clearly wouldn’t object given the circumstances. 45 CFR 164.510(b)(1)(i)45 CFR 164.510(b)(2)
• A covered entity may share information with a public health authority that is authorized by law to collect it to prevent or control disease, injury or disability, such as reports of disease, births and deaths. 45 CFR 164.512(b)(1)(i)
• A covered entity may share information when another law requires it, limited to what that law requires. 45 CFR 164.512(a)(1)
• For police, a provider may share what a court order, a court-ordered warrant, a subpoena or summons issued by a judge, or a grand jury subpoena requires, within that document’s limits. An administrative request, such as an administrative subpoena or investigative demand, also counts if the information is relevant to a real investigation, the request is specific and limited, and information that doesn’t identify anyone wouldn’t do. 45 CFR 164.512(f)(1)
• A covered entity may share information when it believes in good faith that doing so is necessary to prevent or lessen a serious and imminent threat to someone’s health or safety, with someone able to prevent it. 45 CFR 164.512(j)(1)

The Right to Your Own Records

• A patient has the right to inspect and get a copy of the health information a provider or plan keeps about them, except psychotherapy notes and information gathered for a lawsuit or other legal proceeding. 45 CFR 164.524(a)(1)
• It must act on the request within 30 days, and it can extend that once, by up to 30 more days, with a written reason and a new date. 45 CFR 164.524(b)(2)
• When the records are kept electronically and the patient asks for an electronic copy, the patient must get one, in the form requested if it can readily be produced. 45 CFR 164.524(c)(2)(ii)
• A fee for a copy the patient requests must be reasonable and cost-based, covering only copying labor, supplies, postage and any summary the patient agreed to. 45 CFR 164.524(c)(4)

When Written Authorization Is Required

• Outside the uses the rule permits or requires, a covered entity needs the patient’s valid authorization: a signed, dated form. 45 CFR 164.508(a)(1)
• A valid authorization describes the information, names who may share it and who may receive it, states the purpose and gives an expiration date or event. 45 CFR 164.508(c)(1)
• The patient can revoke an authorization in writing at any time, except for what the covered entity already did in reliance on it, or when the authorization was a condition of getting insurance and another law lets the insurer contest a claim. 45 CFR 164.508(b)(5)
• A covered entity must get the patient’s authorization for almost any use or disclosure of psychotherapy notes; only the therapist who wrote them may use them for treatment without one. The other exceptions are narrow: the provider’s own supervised training programs, defending itself against the patient’s legal claim, an HHS compliance investigation, disclosures a law requires, oversight of the therapist, a coroner or medical examiner, and preventing a serious and imminent threat to someone’s health or safety. 45 CFR 164.508(a)(2)
• Using health information for marketing, or selling it, needs the patient’s authorization. 45 CFR 164.508(a)(3)

Complaints

• Anyone who believes a covered entity or business associate is breaking the rules can file a written complaint with the U.S. Department of Health and Human Services within 180 days of when they knew or should have known of it; HHS can waive that deadline for good cause. 45 CFR 160.306(a)
• A covered entity may not threaten or retaliate against a person for using these rights or filing a complaint. 45 CFR 164.530(g)(1)

Related GovFacts Articles

• Who Can See Your Medical Records: A Guide to HIPAA Privacy Rights
• Your Medical Rights: Healthcare Consent, Privacy, and Refusal
• Medical Rights for Teens and Kids: When Parents Decide and When They Don’t