Disability Discussions: Hipaa Law's Scope

The Health Insurance Portability and Accountability Act (HIPAA) is a federal law that governs health information privacy and security. HIPAA's Privacy Rule sets the national standard for protecting individuals' medical records and other personal health information. It is important to note that the Privacy Rule does not permit employers to request or use protected health information without the patient's consent. This includes information related to disability. While HIPAA protects the privacy of health information, federal disability nondiscrimination laws, such as the Americans with Disabilities Act (ADA) and the Rehabilitation Act of 1973, aim to prevent discrimination based on disability and protect the confidentiality of certain medical information. These laws intersect with HIPAA, and it is essential to understand their interplay when discussing disability-related information.

HIPAA and the Social Security Disability Programs

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a federal law that governs health information privacy and security. It affects a wide range of healthcare issues, including the Social Security Disability Programs. The primary goal of HIPAA is to improve access to health insurance, reduce administrative costs, curb fraud and abuse, and protect the privacy of health information.

HIPAA's role in Social Security Disability Programs is significant when healthcare providers are required to submit medical records and other health information to the Social Security Administration (SSA) for disability determinations. While the SSA is not a covered entity and is exempt from specific HIPAA provisions, healthcare providers must adhere to HIPAA regulations when sending such information. This means that providers must use a HIPAA-compliant platform, such as Paubox, to secure patients' Protected Health Information (PHI) during transmission and storage. Additionally, providers can respond to requests for additional information from the SSA using HIPAA-compliant emails, maintaining privacy while fulfilling the SSA's requirements for disability evaluations.

Covered entities under HIPAA have specific obligations. They must protect PHI through encryption, access controls, and regular security audits. Moreover, they must notify individuals about their privacy practices and obtain consent before using or disclosing PHI for purposes other than treatment, payment, or healthcare operations. When seeking authorization from individuals, covered entities must provide them with a copy of the signed authorization form.

The SSA, through the DDS, has its own rules regarding the disclosure of information and access to records. While providers performing work for the SSA must comply with these rules, they must also ensure alignment with the Privacy Act of 1974, as amended, and the Privacy Rule under HIPAA. This includes requirements to provide individuals with a notice of their rights and privacy practices and to obtain written acknowledgment of the receipt of this notice.

HIPAA and the Americans with Disabilities Act (ADA)

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a federal law that governs health information privacy and security. It affects an extensive range of healthcare issues, including better access to health insurance, reducing administrative costs, limiting fraud and abuse, and protecting the privacy of health information. The major intent of HIPAA is to protect sensitive treatment and diagnostic information from public disclosure.

The Americans with Disabilities Act (ADA) is one of the two primary disability nondiscrimination laws, the other being the Rehabilitation Act of 1973. The ADA's confidentiality requirements apply to all disability-related medical information an employer obtains through employment-related examinations or inquiries. This includes medical exams required of new hires, or return-to-work after an injury or illness, and any medical information an employee voluntarily discloses as part of an employee health program.

HIPAA and the ADA both protect the confidentiality of certain medical information. However, they differ in that the ADA does not apply to all health records. The records must be related to a disability and must be obtained through employment-related examinations or inquiries. The ADA also does not specify the precise measures an employer must take to maintain confidentiality, whereas HIPAA provides specific guidelines for protecting health information.

In terms of employment records, the HIPAA Privacy Rule does not protect employment records, even if the information is health-related. Employers may ask healthcare providers for information about their employees, but the provider may not disclose the information without the employee's authorization, unless other laws require them to. The ADA also recognizes an exception for information provided to state workers' compensation offices or insurance carriers.

It is important to note that the relationship between HIPAA and the ADA is complex, and there may be situations where the two laws intersect or conflict. For example, if an employer-sponsored group health plan is closely linked to an employer, it may be subject to both HIPAA and ADA confidentiality restrictions.

HIPAA and Consent to Obtain Medical Information

The Health Insurance Portability and Accountability Act (HIPAA) is a federal law that governs health information privacy and security. The HIPAA Privacy Rule establishes national standards to protect individuals' medical records and other individually identifiable health information. This includes the right to access, examine, and obtain copies of their health records, as well as direct a covered entity to transmit this information to a third party.

The Privacy Rule applies to health plans, health care clearinghouses, and healthcare providers that conduct certain transactions electronically. These covered entities are required to provide individuals with access to their Protected Health Information (PHI) upon request. This includes the right to receive copies of their medical and health records, with some exceptions, such as psychotherapy notes. Individuals also have the right to request corrections to their health information.

To obtain an individual's medical information, covered entities must have the individual's consent. This can be done through an authorization form or another document that provides express consent for the healthcare provider to disclose the individual's private medical information. This consent can be revoked by the individual at any time. In the case of employees, employers may ask for additional clarifying information from a healthcare provider, but they must have the employee's consent before contacting the provider directly.

HIPAA also sets out penalties for criminal violations, with fines and imprisonment for obtaining or disclosing identifiable health information without authorization.

HIPAA and Employment

The Health Insurance Portability and Accountability Act (HIPAA) is a federal law that governs health information privacy and security. It affects an extensive range of healthcare issues, including better access to health insurance, reducing administrative costs, limiting fraud and abuse, and protecting the privacy of health information.

HIPAA applies to "covered entities," which include health plans, healthcare clearinghouses, and healthcare providers that electronically transmit certain health information. If an employer does not fall into one of these categories, HIPAA does not apply to it. However, if an employer-sponsored group health plan is closely linked to an employer, the group health plan may be subject to ADA confidentiality restrictions and HIPAA privacy regulations.

HIPAA does not protect individually identifiable health information maintained by a covered entity in its role as an employer. For example, if a worker supplies their health information to an employer's HR department but it is never used for any specific purpose, HIPAA does not apply in this scenario. The Privacy Rule does not protect employment records, even if the information is health-related. However, it does protect medical or health plan records if an individual is a patient of the provider or a member of the health plan.

Even when HIPAA does not apply, employers have other legal obligations to protect the confidentiality of employee health information. For instance, the Americans with Disabilities Act (ADA) requires employers to maintain disability-related medical information about an employee in a confidential medical file separate from the employee's personnel file. This information can only be disclosed in limited situations and to specific individuals, such as supervisors and managers who need to know about necessary work restrictions or accommodations.

Additionally, the Genetic Information Nondiscrimination Act (GINA) mandates that employers treat an employee's genetic information as a confidential medical record. While employers can request a doctor's note or other health information for sick leave, workers' compensation, or wellness programs, they cannot obtain this information directly from the employee's healthcare provider without the employee's authorization, unless other laws require them to do so.

HIPAA and Families of Adults with Special Needs

The Health Insurance Portability and Accountability Act (HIPAA) is a federal law that governs health information privacy and security. HIPAA ensures that patients have control over how their health care information is used and disclosed by their health care providers. This includes patients with disabilities or special needs.

HIPAA helps protect sensitive treatment and diagnostic information from public disclosure. However, this can become an obstacle if family members of adults with special needs require access to this information to help make healthcare decisions or answer questions. In such cases, health care providers can share private medical information with a patient's family or friends if the patient specifically gives permission or does not object. For example, if a patient brings a friend to an appointment and the friend joins them in the examination room, the doctor can discuss medical information in front of the friend.

HIPAA also permits a "personal representative" of the patient to obtain a copy of their private medical information. Personal representatives include people holding powers of attorney for healthcare, parents, legal guardians, and estate executors or administrators. State law may permit other representatives to gain access.

Families of adults with special needs should be aware of how HIPAA affects medical privacy and decision-making. They should have a plan in place for emergencies, including signing a healthcare power of attorney and providing their relative with an emergency contact card or health alert bracelet. It is also important to establish a relationship with healthcare providers and understand their proof of identity requirements and record release policies.

It is important to note that HIPAA does not restrict "family" from sharing information with providers. Family, in this context, can refer to anyone actively involved in caregiving, such as parents, siblings, spouses, adult children, or friends.

Frequently asked questions