The Health Insurance Portability and Accountability Act or HIPAA has two purposes. The first, "portability," allows an employee to keep their current health insurance even if they should happen to leave their current place of employment. This is easily done thanks to plans such as COBRA. The second part, "accountability," means that the government can now regulate healthcare providers, health plans, payers, clearinghouses, and anyone else that might coordinate health data, for complete privacy and security. If an employer provides any type of on-site health care, that employer must also comply by HIPAA standards.
It means that if personal information is stored on computer databases, tapes, disks, or transmitted with the assistance of faxes or the Internet, in addition to anything written down or talked about, steps must be taken to ensure a patient's privacy. This also means that, in addition to protecting your privacy, the electronic exchange of financial or administrative information must now be standardized.
Penalties for non-compliance can include fines that range from $100 per person per violation up to $25,000 per year and/or up to ten years imprisonment.
The process is complaint driven and only covers health care providers and health plans. It doesn't mean that a friend or family member can't discuss someone's medical issues with another party. Relatives may talk freely about what they may have discussed with health care providers. Journalists may report on a subject's medical condition, but the information that can be disclosed by a doctor or hospital is limited. These restrictions also don't apply to police, firefighters, coaches, trainers or teachers.
If you feel your privacy has been violated, you can issue a complaint with your healthcare provider or the DHHS. Your health information is privileged and anyone can use this information against you. The HIPAA was designed to combat this. Your health care professional now has to make sure your information stays confidential unless you request otherwise.
