Health Information Portability and Accountability Act
 Passed in 1996
Intends to protect private health information
from being shared without consent Includes genetic information
Minimum penalty for individual: $100
Maximum penalty for individual: $1.5 million
2009 HIPAA violations for over 500 patients at a time: 108 violations, 4,089,670 people, $834.3 million

HIPAA: great intent with poor execution
The primary complaint with HIPAA is of the policy’s ambiguity◦ Ambiguity leaves both the agency/practitioner and consumer at risk
HIPAA does not apply to everyone who has access to health information

For example:
◦ “The rule generally prohibits a covered entity from using or disclosing [private health information] unless authorized by patients, except where this prohibition would result in unnecessary interference with access to quality healthcare or with certain other important public benefits or national priorities,“
Results:
◦ Court decisions on HIPAA can disagree with oneanother from jurisdiction to jurisdiction
◦ Agencies and individual practitioners are vulnerable to lawsuits due to not understanding the complexities of HIPAA policy and court decisions

More Results of HIPAA
◦ Many agencies are reluctant to share informationand foster relationships with other providers
◦ Less collaboration and continuity of care
◦ When collaboration does occur, it is less timely
◦ Practitioners from different fields are even less likely to share health information due to fear of different standards (e.g. medicine and social work)
Can lead to bloated agencies due to the need to define every action related to health information and how it is intended to be in agreement with HIPAA guidelines
◦ Money is spent on HIPAA compliance and not on services to clients/patients/consumers/employee benefits
Paper shredding services
Frequent HIPAA trainings
Clinicians may keep two sets of notes
Sophisticated security technology takes money and time to implementgreater sophistication leads to greater failure ratewasted time

◦ Adoption of technology for Electronic Medical Records [EMR] has been slow due to fears of the safety of technology
◦ Lack of EMR makes healthcare process much slower than necessary
Longer to get treatment worse problems, lost productivity
Healthcare costs are much higher due to inefficiency: massive and slow paper filing systems, transcription services, fax vs. email, longer consult fees while records are found, duplication of tests and services due to lack of proof they already occurred, etc.

HIPAA only applies to:
◦ Healthcare providers◦ Health plans / insurance
◦ Companies which act as a middleman between healthcare providers and insurance companies

HIPAA does NOT apply to:
◦ Life insurance companies◦ Workers compensation
◦ Social security and welfare benefit agencies
◦ Automobile insurance that includes health benefits (which is nearly all of them)
◦ Researchers obtaining information health data from healthcare providers (which is surprisingly legal under HIPAA)
◦ Law enforcement
◦ Internet self-help sites
◦ Information you give voluntarily on surveys or research projects
◦ Any part of a health organization which does not process claims or make payments
◦ Workers conducting screenings at fairs, malls, pharmacies, etc
◦ Credit reporting agencies


Everyone in the United States has health information
◦ Everyone is vulnerable to the lack of HIPAA coverage Most social workers deal with private health information
◦ Social workers can never be too careful with health information, lest they get sued
 Private health information can be given away to people or companies in foreign countries
Law enforcement can access private health information, but are not covered by HIPAA
In many cases, employers can obtain private health information if they employer provides health insurance benefits
 Parents can release a child’s private health information, but they can not have access to it
Business associates of HIPAA providers can be given protected information without the patient’s consent
You lose the right to sue under HIPAA – only the federal government can take action

You never know how many people see your private health information
Any disclosure required by federal, state, or local regulation, regardless of the scope of the disclosure or the purpose of the disclosure. Public health authorities.
A person subject to the jurisdiction of the federal Food and Drug Administration.
A person who may have been exposed to a communicable disease.
An employer to (1) conduct workplace medical surveillance or (2) to evaluate whether you have a work-related illness or injury.
Victims of abuse, neglect or domestic violence.
A health oversight agency for audits and investigations.
Court or administrative proceedings in response to a court order, subpoena, or discovery request.
A collection agency for unpaid medical bills.
Coroners and medical examiners.
Funeral directors.
Organ procurement organizations.
A medical researcher with institutional review board approval.
A threat to public safety or public health.
U.S. and foreign military commanders.
U.S. Department of Veterans Affairs to determine eligibility for benefits.
Federal government national security and intelligence officials.
U.S. Department of State to verify health fitness of employees and their families for foreign duty.
Correctional institutions involved in health care of inmates.
Workers compensation uses authorized by state law. http://www.privacyrights.org/fs/fs8a-hipaa.htm

References
 http://www.privacyrights.org/fs/fs8a-hipaa.htm http://www.hcpro.com/HIM-228826-865/Healthcare-operations-How-to-
approach-HIPAA-privacy-rule-ambiguity.html
http://www.privacyrights.org/fs/fs8a-hipaa.htm
http://en.wikipedia.org/wiki/Health_Insurance_Portability_and_Accountabilit y_Act
http://www.ama-assn.org/ama/pub/physician-resources/solutions- managing-your-practice/coding-billing-insurance/hipaahealth-insurance- portability-accountability-act/hipaa-violations-enforcement.shtml
http://blogs.hcpro.com/hipaa/wp-content/uploads/2010/08/Analysis-of- HHS-Breaches_Update_August2010.pdf
http://www.kevinmd.com/blog/2006/12/how-hipaa-harms-patients.html
http://zoo.cs.yale.edu/classes/cs457/2003/Adam_Cushner.ppt
http://www.emrandhipaa.com/emr-and-hipaa/2010/04/19/emr- technology-exacerbates-problems/
http://www.medscape.com/viewarticle/497977_2
http://epic.org/privacy/medical/

