Maybe you’ve had this experience: As you are evaluated and/or treated for a new health condition, at every juncture, you are asked for the same information over and over again. In addition, you are asked to sign forms about privacy protection and/or release of protected information, most of which you don’t fully read or understand before signing.
It’s a common situation, in part due to the HIPAA (Health Insurance Portability and Accountability Act) Privacy Rule enacted in 1996.
What is The HIPAA Privacy Rule?
The HIPAA Privacy Rule provides federal protections for your health information. It gives patients an array of rights with respect to that information and, at the same time, permits the sharing of health information needed for patient care and other important purposes, such as billing and payment.
(Click here to read more than you’ll ever want to know about HIPAA!)
An unintended consequence of these protections, however, is that they can become an administrative barrier when one person tries to partner with another in the management of their own health care. If you’ve ever called a physician’s office on behalf of a parent, a child over the age of 18, or a friend, you know what I mean. You’ve probably been told, “We cannot speak to you about this person because of HIPAA requirements.”
As a parent who is concerned about a child, or a child worried about a parent, this statement can make you frustrated and angry. And while one would hope that the professionals on the other end of the line would have an accurate understanding of the rules and constructive suggestions for managing them, this is not what the average person generally encounters.
In my case, as a professional who needs to discuss protected health information regarding my clients,I take steps at the beginning of the client relationship to obtain formal, written permission to access and discuss their records. I make lots of copies and present them as needed to every healthcare provider and insurer along the way.
For example, when I call an emergency room because a client has just been admitted, I say:
“My name is Dianne Savastano and I’m a private healthcare advisor to __________. I have written permission for you to share information with me and to access his/her medical information. Please provide a fax number and I’ll fax the HIPAA Release Form and call back in a few minutes.”
95% of the time, and thanks to my understanding and respect of the HIPAA rules as written, my request is taken care of.
What you can do to manage HIPAA’s privacy rules
As is typical in much of healthcare, there are no standard practices for how healthcare entities manage the HIPAA Privacy Rule.
Some physician practices present you with a form, up front, allowing the practice to share private healthcare information with parties you designate. Other practices have a form but don’t offer it unless asked. Still others have no formal document of their own and instead ask that you provide the written permission.
Interestingly, and if you read the rule, you’ll see that the provisions don’t state a need for permission. Rather, they allow your health care provider to discuss your health information with others if you don’t object. (Note that in all cases, your health care provider may discuss only the information that the person involved needs to know about your care or payment for your care.)
In practice, this means that your provider may ask your permission; may tell you he or she plans to discuss the information and give you an opportunity to object; or may decide, using his or her professional judgment, that you do not object. Here as well, the possibilities are all over the map.
What I recommend, therefore, is this. Be proactive and obtain written permission ahead of time – before you need it. Then make copies, keep them in a safe place and have them ready as necessary.
Who among your loved ones does this pertain to? Anyone who may need your assistance in an emergency or unanticipated situation: a parent, family member, adult child or close friend.
As you attend physician appointments, provide it to the physician practice and ask that it be placed in the medical record so that if you need to call, you can explain that permission to speak to you is already on file. If a loved one enters an emergency room or a hospital, call, identify the appropriate contact person such as the case manager, fax or hand carry the form and have it placed in the medical record there. If your loved one lives a distance away, ask him/her to provide the form to providers so that if you need to call in the future, permission has been granted.
Click for a sample of a document you could use.
Remember, while the HIPAA Privacy Rules were created with the best of intentions, in practice, they can hinder the smooth interaction between you and those you care for. Take steps now, before the crisis occurs, to get the necessary permissions in place!