The Health Insurance Portability and Accountability Act of 1996 (HIPAA), was enacted by the US Congress to help workers get insurance coverage and prevent discrimination. A key protection in HIPAA is the Privacy Rule which aims to keep your medical records as private as possible so that only you, your treating physicians, and the insurance companies that pay for your medical treatments know what is in the records. The rule limits who can see your medical records—whether they are kept in print, electronically, or orally.

Each patient who gets medical treatment should receive a HIPAA notice explaining their rights.

To whom does HIPAA apply?

The main aim of the HIPAA privacy rule is to prevent unauthorized transmission of electronic health records (EHRs). Records include medical histories, your diagnosis, your prognosis, the recommended treatments, and payments. Most medical providers now keep your records electronically.

HIPAA applies to many organizations but not to all organizations. The aim of HIPAA is to prevent the initial health providers and those who normally see your records from giving your records to those people or organizations who don't need to know your medical problems.

Covered entities (under the HIPAA law) who must comply with the privacy rule not to disclose your records (without your written consent) include:

• Health Care Providers – Doctors, hospitals, psychiatrists, nursing homes, and other medical providers who keep electronic health-care records
• Health Plans – Insurance companies, employer health plans, Medicare, Medicaid, and HMOs.
• Health Care Clearinghouses and Business Associates – Business associates include people such as lawyers and accountants who help you get your medical bills paid.

Some of the entities that do not need to comply with the HIPAA privacy rules include employers, life insurance companies, schools, child protection agencies, and law enforcement agencies.

Why use a separate HIPAA authorization?

Any person or entity that violates the HIPAA privacy rule can be subject to substantial civil fines for each violation and also criminal penalties including jail time of up to a year for a violation. Intentional violations for commercial gain can result in jail time up to ten years.

These fines make the HIPAA covered entities very cautious about sharing the medical information with anyone outside of the patient. This caution means that even spouses, significant others, children, and caretakers cannot be given the medical information without the written consent of the patient.

A separately drafted HIPAA authorization, signed by you, designating specific people who have the authority to see your records is the best course of action for anyone with serious health issues—common to most seniors who need estate planning. Other common estate planning remedies may not convince the medical provider or covered entity to release the necessary information. For example, even the best drafted medical power of attorney may not be clear and may require the health provider to wait until a treating doctor certifies that you are incompetent.

The signed separate HIPAA authorization can be used by the authorized person to:

• Help you get the right treatment from the right doctors
• Make sure you see the right doctor or hospital if an emergency arises
• Explain to the doctors your prior medical history
• Pay the medical bills that must be paid
• Advise nursing home staff of your full medical needs
• Help you with all the necessary paperwork such as Medicare and Medicaid forms or insurance information

Without the signed HIPAA authorization, you may get the wrong treatment or no treatment. You may not be able to prove the incapacity needed to enforce Do Not Resuscitate orders and living wills.

HIPAA authorizations should generally authorize your spouse and your children to act for you when the need arises.

If you are a senior or anyone who thinks you may need help with your medical issues and planning measures, please contact the Tyra Law Firm and let us help you. We can help you draft appropriate HIPAA authorizations for the loved ones whom you wish to have access to your medical information, and much more.