The Health Insurance Portability and Accountability Act of 1996 (HIPAA) was signed into law on August 21, 1996. Among this law’s many important protections for millions of working Americans and their families are requirements to protect the privacy of individual’s health information through rules which govern health care providers and entities that pay for health care or process health care information.  The HIPAA Privacy and Security Rules ensure a national floor of privacy and security protections for patients by limiting the ways that health plans, pharmacies, hospitals and other covered entities can use patients' personal medical information.

What Information is Protected?

The Privacy Rule protects all "individually identifiable health information" held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral. The Privacy Rule calls this information "protected health information (PHI)". “Individually identifiable health information” is information, including demographic data, that relates to:

• the individual’s past, present or future physical or mental health or condition,
• the provision of health care to the individual, or
• the past, present, or future payment for the provision of health care to the individual

A major purpose of the Privacy Rule is to define and limit the circumstances in which an individual’s protected heath information may be used or disclosed by covered entities. A covered entity may not use or disclose protected health information, except either: (1) as the Privacy Rule permits or requires; or (2) as the individual who is the subject of the information (or the individual’s personal representative) authorizes in writing.

What Rights Does The Privacy Rule Give Me Over My Health Information?

Health Insurers and Providers who are covered entities must comply with your right to:

• Ask to see and get a copy of your health records
• Have corrections added to your health information
• Receive a notice that tells you how your health information may be used and shared
• Decide if you want to give your permission before your health information can be used or shared for certain purposes, such as for marketing
• Get a report on when and why your health information was shared for certain purposes
• If you believe your rights are being denied or your health information isn’t being protected, you can:

• File a complaint with your provider or health insurer
• File a complaint with the U.S. Government