Medical records can be powerful tools in helping to manage healthcare. But people seeking out medical information about themselves or friends and family members often run into a roadblock with a formidable-sounding name: The Health Insurance Portability and Accountability Act of 1996, or HIPAA. Originally intended to protect the privacy of patients’ personal and medical information, in practice, HIPAA can be a double-edged sword.

Of prime importance to consumers is the portion of the law known as the Privacy Rule. Its broad provisions prevent healthcare providers and some others from disclosing information about:

• an individual’s past, present or future physical or mental health or condition;
• the type of healthcare an individual has received, and
• payments an individual has made for healthcare.

Its protection also extends to information that can be used to identify an individual, such as name, address, birth date, Social Security number, and even weight.

While that all sounds both well and good, HIPAA has increasingly been a source of frustration for consumers. Healthcare providers — including doctors, hospitals, pharmacies, laboratories, and health insurance plans — will sometimes hide behind HIPAA as a shield, claiming that the law prevents them from disclosing any information at all. Many of these providers are simply uninformed or misinformed about how HIPAA was meant to work. And some claim the law’s protections simply to simplify their own lives; as one doctor said recently: “I just don’t have time to deal with a lot of questions from family members. I have to get on to the next patient.”

 When HIPAA Doesn’t Apply

Because HIPAA is a law, and a complicated one, there are also many exceptions to it — meaning that some people cannot be blocked from getting medical information about others despite it. That includes a person who is:

• a healthcare agent named in a durable power of attorney for healthcare or advance directive, where the document has taken effect — usually because the person for whom it is written lacks mental capacity;
• a healthcare surrogate appointed by a doctor for a person who is unable to express his or her own preferences for medical care;
• a legal guardian or conservator authorized by a court to make medical decisions for another person, or
• a person the patient has authorized to have access to personal health information under the terms of a HIPAA Authorization Form, as discussed below.

A little known and seldom invoked provision in the HIPAA law also gives healthcare providers the discretion to divulge at least cursory information about a patient’s condition and care in a few situations, including where the patient:

• indicates that he or she consents,
• is present, and does not object, or
• is either incapacitated or not present — but the provider determines it’s in the patient’s best interest for the other person to know.

Knowing about this discretionary disclosure option can be powerful information for those who have not been authorized by a court, document, or doctor but may want to appeal to a medical provider for the information they seek.

Importantly, HIPAA also applies to medical payment information. And in a twist on following the money, the law specifically provides that providers cannot deny a person access to medical information simply because a bill hasn’t been paid — though some unscrupulous souls have tried this tactic to force a payment or two.

Also, individuals may not be denied access to personal health information based on the alleged concern that an individual may not understand it or will be upset by it — though again, some have tried to advance this claim.

Those seeking the medical information may request it face to face, over the phone or by email or regular mail. While the laws in most states provide that “reasonable” fees may be charged for labor and copying costs, entities are encouraged to provide the information free.

There is a very narrow range of information that can never be disclosed, including psychotherapy notes and information compiled specifically in preparation of litigation.

A Powerful Piece of Paper

There are a number of documents such as advance directives that conscientious consumers can complete to help ensure they get the medical care they want. But the one that’s most often overlooked — and in many cases, most important — is the one that can help overcome the obstacles described here: a HIPAA Authorization Form.

It comes as a surprise to most that many doctors even require this written release before they will disclose information even to a spouse or other close family member.

The HIPAA Release acts as written permission slip for providers to give healthcare information to someone other than the patient being treated. It is simple to fill out, and does not need to be witnessed or notarized to be effective, but must state when the authorization is to take effect — immediately or at a future date — and the type of information that can be disclosed. Some people, for example, prefer not to give others access to their records related to mental health, treatment for alcohol or drug abuse, or care for communicable diseases.

Helpful Resources

A number of resources help explain the intricacies and exceptions of the HIPAA laws to consumers.

• The Office for Civil Rights (OCR) within the U.S. Department of Health and Human Services (HHS), the federal agency charged with enforcing HIPAA, answers common consumer questions in a publication accessible online: A Patient’s Guide to the HIPAA Privacy Rule,
• OCR has launched a consumer education campaign, with the right to access health information described in its brochure, “Get it. Check it. Use it”.
• OCR has also teamed up with the Office of the National Coordinator for Health IT to created a series of three informational videos explaining the right under HIPAA to access health information, as well as the associated fees and timing and procedures for giving other people access to private health information.