HIPAA developments, dilemmas

Recent reports from Pro Publica, the independent investigative news organization, reveal widespread violations of HIPAA (the Health Insurance Portability and Accountability Act) by large organizations, from Walmart to CVS, United Health Care to the Veterans Administration. Ironically, this sad state of affairs regarding patient's privacy rights does not mean you can ignore HIPAA in your own estate plan. The behemoths may be playing fast and loose with patient data, but your own doctors and health care providers are likely more judicious. To ensure they do release information to the people you want to get it, you have to lay the legal groundwork. For example, if you're hospitalized, your attending doctor probably won't want to (and definitely shouldn't) discuss your condition with your adult son unless you have so authorized it. Don't count on the college infirmary telling you why your 19-year-old has been admitted for care - unless your child has given you legal authority to get that information.  You should always discuss with your estate planning/elder law attorney who you want to access your privileged medical information, and your preferences should be put into the appropriate written documents.

Which brings me to another HIPAA-related irony: Patients can face obstacles getting access to their own medical records, even though the law guarantees them that right. In fact, difficulty obtaining records is among the top complaints handled by the Office for Civil Rights at the Department of Health and Human Services. 

Perhaps some health providers don't understand their obligations under HIPAA. Or perhaps they feel that the information will be misunderstood by the patient. No matter. Today, with so much health information available from authoritative sources, people want to be in control of their care and want to be able to get at their own medical records. And the law entitles them to do so.

To get the message across to health care professionals, the Obama Administration recently updated the guidelines governing patient access to medical records. Under the revised rules, you are not required to furnish your provider with the reason you're requesting your records. Also, records cannot be withheld on the basis of an unpaid bill. Providers may not charge you to retrieve and locate your records, but they can charge you for duplicating them. Your records must be provided to you within 30 days of the request, although extensions are possible under certain circumstances.  

There are a few exceptions to the rule. For example, a medical provider can refuse to provide copies of a patient's medical record if the provider believes doing so may endanger the life or physical safety of the patient. Psychotherapy notes also get special treatment.

You can read the Obama Administration's guidelines for releasing medical records to patients here.