The Health Insurance Portability and Accountability Act (HIPAA) of 1996 is a federal law designed to protect your privacy whenever your health care providers have to discuss your case or send information about you to different offices. I have to keep a file to record our consult, but I promise that your private, protected health information (PHI) will be kept confidential.
I can freely share all the details of your PHI for purposes of “treatment, payment and health care operations.” That means I can talk to you about your situation and discuss it with your other health care providers. If you are referred to other specialists, I can send the information on to them. I can also share your PHI with your health insurance company if they need it.
The law also requires me to share your PHI under other very precise situations: for example, to turn over medical records if a subpoena has been served on us or a federal agency is investigating a complaint that we have not been protecting your privacy.
Any other time I share your PHI, it has to be with your specific authorization: you have to okay it first in writing. For example, you may want me to send PHI about your consultation to the Human Resources Department where you work so they can reimburse you under their workplace lactation support program. When you do give me permission to turn over your PHI, I can give out only the minimum amount of information needed to get the job done.
Under HIPAA, I can call or write you to remind you to come back for an appointment, or to tell you how you can get a product or service that might interest you and your family.
You have four rights under HIPAA:
My duty under to HIPAA is to give you this notice so you understand I have promised to keep your PHI confidential.
You can complain if you think your privacy hasn’t been protected. I can’t penalize you for making a complaint. If I don’t address your complaint adequately, you can contact the Office of Civil Rights of the Federal Health and Human Services (HHS) Department to ask that a formal investigation be made. You can’t go to court and sue over a HIPAA violation, but you can ask HHS to investigate. You can get all the details from them by calling (toll free) at 800-368-1019 or see their website athhs.gov/ocr/privacyhowtofile.htm.