Inside the New Medical Privacy Law

What your doctor can and can not reveal about your medical records to insurance companies

Who hasn’t experienced that sinking feeling during a visit to the pharmacy (“Yoohoo! Your Viagra prescription is ready!”), or the face-reddening trauma of a teenage trip to the dermatologist (“The doctor’s ready for your pimples, now, dear.”)? If a new law is successful, those excruciating moments are a thing of the past. As of April 14th, we’re all protected by the Health Insurance Portability and Accountability Act (HIPAA) — a law designed to shield medical information from the prying eyes of individuals and companies.

It sounds like a good idea — none of us likes to think of our employers finding out about, say, that sensitive little flare-up back in ’87 — but some doctors groups are up in arms over the legislation, saying it keeps them from freely communicating with their patients, and from efficiently partnering with other physicians to maximize patient care. Health care providers who violate the new rules are subject to criminal charges, jail time and up to $250,000 in fines.

Meanwhile, patient advocacy groups are suing in a Philadelphia court to overturn the privacy laws, saying they actually allow all the wrong people (insurance companies, for example), access to medical files. And then there’s the matter of cost: no matter where you come down on the law, it’s an expensive proposition: doctors’ offices around the country have spent thousands on overtime for staff training and compliance courses; and estimates of nation-wide costs of implementation run as high as $22 billion.

Even as the arguments over HIPAA continue, every doctor’s office in the country is changing its policies on what its patients can see, and how much of that information is made public. Here are a few things you should know about the new laws before you make your next doctor’s appointment.

How will my visit to the doctor be changed by HIPAA?
You probably won’t notice a huge difference — you’ll still sign your name when you come in the door, and your name will be called when it’s time for you to see the doctor. But you won’t write down the reason for your appointment, and your chart, which is slipped into a pocket on the outside of the exam room door, will face inward to keep anyone in the hallway from reading it.

Can I still communicate with my doctor via email?
If you are one of the lucky few whose doctor actually returns their emails, fear not. You can still email back and forth with your doc, assuming you are using an encrypted (secure) network.

Who can see my medical records?
You, first and foremost. And you also have the right to ask questions and make corrections to those records as warranted. Outside access to your information is far more guarded under the new law than previously; you can tell hospitals, for example, not to release any information about you to anyone, if you wish. You can also keep your employer from disclosing the fact that you are sick, and if you’d rather your employer not know either, you can restrict the information available about you through your health plan.

If I go to a psychiatrist, who can see the notes on my treatment?
No one but you — unless you specifically permit people to see your records. Before HIPAA, mental health treatments were monitored by health care plans in order to keep control of costs — someone from the health plan would analyze records to ensure treatment was still necessary. Now, that decision will be left up to the patient and the treating physician.

How can I get more information about HIPAA?
Your health care plan and providers are required by law to explain your rights under HIPAA, but if you have more questions, visit the Health and Human Services Offices of Civil Rights’ website at http://www.hhs.gov/ocr/hipaa/