What is HIPAA and how does it affect patients?

Simply put, HIPAA stands for the Health Insurance Portability and Accountability Act of 1996. It was introduced to help employees move healthcare plans between employers when they were changing job, but also served to increase protections on patient data and privacy.

However, that simple definition doesn’t do justice to the scope of HIPAA privacy regulations. HIPAA was established for the benefit of patients, putting their rights to the fore. HIPAA puts the onus on healthcare providers and associated partners such as health insurance companies or healthcare clearinghouses to protect patient data by all means possible.

How does HIPAA protect patients?

One of the most important ways by which HIPAA protects patients is by ensuring all employees are trained in HIPAA compliance. This may seem simple, but human error is one of the biggest causes of HIPAA breaches. These breaches leave patient information vulnerable to attack from cybercriminals, who may target healthcare workers via phishing scams, or from people who steal patient data by picking up files from unclear desks.

HIPAA is enforced by the Office for Civil Rights, part of the Department of Health and Human Safety. The OCR is very strict about its role in protecting patients: in the last few years, multi-million dollar fines have issued against those violating HIPAA. These fines have an important dual role: as well as ensuring that those who put patient privacy at risk are punished, they also act as a deterrent to those considering violating HIPAA, or who are simply too lazy to properly enforce it. In some extreme cases, negligent parties may be given a jail sentence if it is believed they violated HIPAA through wilful neglect. In most cases, the OCR will issue a corrective action plan to prevent any further breaches or violations occurring.

What about the right to access?

As well as protecting the patient’s right to privacy, HIPAA awards patients’ specific rights relating to their own access to data. Under HIPAA, all patients have the right to access their own medical records and can do so at any time by submitting a request to their healthcare provider. The healthcare provider then must fulfill this obligation in a way suited to the patient, either by providing physical copies of healthcare records or by sending them electronic copies. Importantly, patients retain this right to access irrespective of whether or not they have any outstanding bills.

However, even though all patients are protected by HIPAA and have the right to access their medical information, three in ten people are unaware of this right. A further four in ten people have never accessed their health information. Though it is difficult to know why this is, it is likely to do with the fact that most believe it is too much effort to do so – even though it can be as simple as filling out a form. Of the minority that have accessed their records, over 80% of people believed it was a beneficial exercise. This shows that those who are aware of their rights under HIPAA can get more out of their healthcare.