Protect Your Privacy with Your Healthcare Providers

Privacyrights.org is a nationally-recognized consumer education and advocacy nonprofit organization, which is dedicated to protecting the privacy of American consumers.  Here are some excellent tips from their website on how to protect the privacy of your medical records:

A. Discuss your confidentiality concerns with your doctor. If you want a specific condition to be held in confidence by your personal physician, bring a written request to the appointment that revokes your consent to release medical information to the insurance company and/or to your employer for that visit. You must also pay for the visit yourself rather than obtain reimbursement from the insurance company.

To be especially certain of confidentiality, you may need to see a different physician altogether and pay the bill yourself, forgoing reimbursement from the insurance company. Realize that under HIPAA, your attempts to restrict the sharing of specific records can be denied by the health care provider.

B. Ask your health care provider to use caution when photocopying portions of your medical records for others. Sometimes more of your medical records are copied than is necessary, for example, when requested by the insurance company or another health care provider.

C. Find out if your health care provider has a policy on the use of cordless and cellular phones and fax machines when discussing and transmitting medical information. Wireless telephones are not as private as standard "wireline" telephones. Because they transmit by radio wave, phone conversations can be overheard on various electronic devices. Digital systems are more secure. (See PRC Fact Sheet 2: Wireless Communications)

Fax machines offer far less privacy than the mail. Frequently many people in an office have access to fax transmissions. Staff members at all levels of the organization should take precautions to preserve confidentiality when sending and receiving medical documents by fax machine. (See PRC Fact Sheet 12: Checklist of Responsible Information Handling Practices)

Your medical information is not confined to health care institutions. Here are some additional situations where you must be careful to protect your privacy.

D. If your records are subpoenaed for a legal proceeding, they become a public record. Ask the court to allow only a specific portion of your medical record to be seen, or better yet, not to be open at all. A judge will decide what parts, if any, of your medical record should be considered private. After the case is decided, you can also ask the judge to "seal" the court records containing your medical information.

E. If your employer is self-insured, the human resources department is likely to have information about any health-related claims that you file. If you are concerned about the privacy protection policies and practices of your employer, talk to the appropriate administrator. You should consider following up with a letter to the head of the department that handles health-related information. Diplomatically stress your desire for all of your health information to be handled with the utmost confidentiality. Keep a copy for yourself, filed at home.

F. Think twice before filling out marketing-related questionnaires. They commonly contain sections that ask for a great deal of family health information. The loss of your medical privacy is a high price to pay in exchange for a few free coupons or a chance to win a contest. For more information, read the PRC' s 2001 testimony to the Federal Trade Commission.

G. Before participating in health screenings offered in shopping malls and other public places, find out what uses will be made of the medical information that is collected. If you are not given the opportunity to say "no" to the sharing of your medical information with others, don't participate.

H. Use caution when visiting health-related websites and when participating in online discussion groups.

·         Carefully read the privacy policies and terms of services of medical websites. Do not fill out registration forms unless you are satisfied with the web operator's privacy policy.

·         Use a pseudonym when participating in chat rooms and online forums.

·         Before sharing personal information with a health website, find out if it participates in a web seal program such as TRUSTe, URAC Health Web Site Accreditation, HON (Health on the Net) and BBBOnline.

·         Remember, companies can change their privacy policies at any time. And if the company goes bankrupt, its data base of user information could be sold to the highest bidder.

I.  Establish your own history of treatment. If you decide to change physicians or health care organizations, it is a good idea to obtain copies of your medical records. Physicians may retire, move out of state or merge practices with other physicians. Health care facilities may merge with another facility or even go out of business following bankruptcy. Get copies of medical records while you can. Don't count on your ability to get your records years after treatment. If your doctor or health care provider goes out of business, be sure to find out where they intend to store the medical records of their patients.

Although HIPAA does not require that medical records be kept for a set time, many states have such laws. To find out what your state has to say about retention of medical records, see the following American Health Information Management Association (AHIMA) Practice Brief: Retention of Health Information.

J. If your employer offers an employee health or wellness program, an EHP, ask about any established privacy policy. You want to know whether your progress reports will be maintained by an outside consultant or made a part of your permanent personnel file.

K. Be on guard against employers or health insurers that ask for your permission or require you to submit to genetic testing. A 2008 federal law, the Genetic Information Nondiscrimination Act of 2008 (GINA) prohibits employers and most health insurance plans from denying you employment or health benefits based on genetic information. In addition, on October 9, 2009, the U.S. Department of Health and Human Services, joined by the U.S. Department of Labor and U.S. Department of the Treasury, issued interim final rules implementing GINA’s nondiscrimination provisions. Among other things, HHS has determined that genetic information, like other health-related information, is subject to the privacy protections of HIPAA.

The interim final regulation can be found here: www.hhs.gov/ocr/privacy/hipaa/understanding/special/genetic/ginaifr.pdf

In addition, the non-profit organization Council for Responsible Genetics (CRG) has extensive information available on privacy and genetics. CRG’s website also includes tips on how to protect your genetic privacy.  www.councilforresponsiblegenetics.org/geneticprivacy/tips.html

Bettina Altizer- Attorney at Law

Altizer and Altizer

540-345-2000