A Health Insurance Portability and Accountability Act (HIPAA) disclosure is the legally authorized sharing of individual physical or health information by health care facilities. HIPAA is a United States federal law that was passed in 1996 to ensure the Department of Health and Human Services (HHS) established guidelines to protect individual medical records. The guidelines are known as the HIPAA Privacy Rule, which calls for confidentiality of health information with certain legal allowances for disclosures.
The United States Office of Civil Rights oversees the HIPAA Privacy Rule to make sure health care facilities, known as covered entities, only share individual medical information in federally authorized instances. The most basic HIPAA disclosure is individual, in which a doctor can share a patient’s medical information with the particular individual. Individual disclosure also allows a patient to voluntarily waive his or her privacy rights and allow the doctor to share health information with the patient’s family or friends, such as updating them on the patient’s condition or allowing them to pick up prescriptions.
HIPAA disclosure is allowed for treatment purposes. A doctor can share a patient’s health information with another specialist who will be treating the patient. Health information can also be legally shared for payment reasons, such as billing a patient’s insurance company.
Medical information can be reported if it is a threat to the public. HIPAA disclosure is permitted if a patient has a contagious disease or virus and is required to be reported or quarantined. The United Stated federal government also requires medical records to be shared in the event of suspected bioterrorism.
Under the Occupational Safety and Health Act (OSHA), an employer is legally obligated to inform the Occupational Safety and Health Administration of any employee injuries that occur in the workplace. The employer is allowed to share any pertinent employee health information with the administration. If the employer does not report the information, he or she faces financial and legal consequences.
HIPAA disclosure is required if it is significant to a criminal investigation or legal case. It can be used by investigators to determine cause of death or to locate a suspect, victim, or witness. Confidential medical information can also be shared if ordered by a judge to appear as evidence.
Healthcare facilities can disclose children’s medical records if neglect or abuse is suspected. In that case, doctors do not have to inform the children’s parents or guardians. They are authorized to turn over any information involving child endangerment to the local or federal government. Under the HIPAA Privacy Act, healthcare workers are also allowed to use professional judgment in determining if HIPAA disclosure is necessary, even if it is not clearly outlined in the act.