Note: Your progress in watching these videos WILL NOT be tracked. These training videos are the same videos you will experience when you take the full ProHIPAA for Leaders program. You may begin the training for free at any time to start officially tracking your progress toward your certificate of completion.
In this lesson, we'll go over patients' rights under HIPAA, what information requires authorization, when patient authorization is not required, and real-world examples you may encounter in practice.
Covered Entities and Patients' Rights
All covered entities (health plans, healthcare clearinghouses, and healthcare providers transmitting PHI electronically) are required to provide individuals a Notice of Privacy Practices upon request. This notice describes how medical information may be used and disclosed, as well as the process for filing complaints.
Patients have several key rights regarding their Protected Health Information (PHI), including:
- Record Inspection: The right to inspect and obtain copies of their medical records within 30 days.
- Record Corrections: The right to request corrections or additions if they believe information is inaccurate or incomplete.
- Communication Restrictions: The right to ask for restrictions on how their health information is shared or communicated.
- Accounting of Disclosures: The right to request an accounting of disclosures made outside of routine treatment, payment, and healthcare operations.
Pro Tip #1: Out-of-Pocket Payment Exception: If a patient pays for a healthcare service in full out of pocket, they have the right to require that the provider not share information about that specific service with their health plan.
Patient Authorization Requirements
Patient authorization is necessary to disclose an individual's personal health information outside of routine healthcare operations, but written authorization is not required in order to treat the patient.
Pro Tip #2: Treating Without Written Authorization: Healthcare providers often ask if they can see a patient without obtaining written authorization. The answer is yes. However, it is always best practice to update the patient's medical record and note the circumstance.
Sharing PHI Without Patient Authorization
There are specific legal exceptions where covered entities may disclose PHI without prior written authorization from the patient or parent:
- Workers' Compensation & Public Health: Information can be disclosed as required for workers' compensation claims or valid public health reporting.
- Imminent Danger & Abuse Reporting: Providers may alert law enforcement or official agencies if there is an imminent danger to the patient or others, or if abuse is suspected. Reporting suspected abuse can save a child's or adult's life.
- School Healthcare Disclosures: Covered healthcare providers may disclose PHI about students to school nurses or school physicians for treatment purposes without written authorization from the parent or student (e.g., a primary care doctor discussing medication management directly with a school nurse).
