Your Right to Privacy

Understanding HIPAA and our role in maintaining confidentiality

Privacy is one of those things that is easy to take for granted. You may not truly appreciate it until you realize that it’s gone. Here at West Georgia Health System, we've always taken your privacy seriously. And we've supported efforts to strengthen privacy laws pertaining to people's personal health information. That's why we're on board with HIPAA, the Health Insurance Portability and Accountability Act of 1996. This federal legislation contains provisions intended to ensure that private information about you and your health remains just that - private.

As your health care provider, we're required to be in compliance with these federal regulations. And as one of our consumers, you're entitled to know how HIPAA impacts our relationship with you and what our specific privacy policies are.

Following are some frequently asked questions and answers about this legislation.

Q: What exactly is HIPAA?
A: HIPAA is an acronym for the Health Insurance Portability and Accountability Act of 1996. This complex legislation has several components. Among other things, it's intended to make it easier for people to get and maintain health coverage and to allow the transmission of health information from one organization to another in a consistent manner.

Q: How does HIPAA help protect your privacy?
A: Medical records may contain considerable information about a person's physical and mental health, and behaviors. If this information is shared inappropriately, it could make people reluctant to confide in health care professionals.

Because they anticipated an increase in the use of computerized systems to collect, store and transmit patients' personal health information, the framers of HIPAA felt it was crucial to include standards for maintaining patients' privacy and security in their legislation.

Known as the privacy rule, these standards guide health care entities in maintaining their patients' confidentiality. In addition to protecting computerized health information, the privacy regulations and standards also apply to information that appears on paper or may be communicated orally.

Q: Who must comply with HIPAA regulations?
A: Basically everyone involved in health care, including medical providers, hospitals, insurance companies, health plans, clearinghouses and health departments, must comply with HIPAA. If an entity conducts any of several key transactions electronically, it is subject to the regulations.

Q: How will the privacy rules impact you and what specific protections will they offer?
A: The privacy rules govern your personal access to your records and restrict the access of others.

Generally, you now:

• Are required to be notified about your rights with respect to your health information.
• May inspect and copy your records.
• Have the right to amend your records.
• Must grant written permission before any personal information that could identify you can be released for nonroutine purposes—things other than obtaining treatment or payment, for example.
• Can request certain additional restrictions on the use and disclosure of your health information.
• Can request an accounting of the nonroutine disclosures of your health information.

Q: What steps are we, as health care providers, required to take to protect your privacy?
A: HIPAA establishes specific obligations for hospitals and other covered entities. Some of these include that:

• Whenever we use or disclose protected health information, we try to limit the information to the minimum amount necessary to accomplish the intended purpose of the use or disclosure.
• A privacy official be appointed and a "notification of privacy practices" be developed. This document explains to consumers how their personal health information will be used and protected.
• We ensure that associates working with us agree to abide by the privacy rules. These associates may include, but are not limited to, medical laboratories, transcription services, law firms and hardware and software vendors.
• Our employees be trained in privacy and the security of personal health information.
• Appropriate systems be established to protect personal health information from accidental access or disclosure. These include:
  (1) Administrative procedures that deal with having policies and processes in place that are designed to protect privacy. These policies may specify which employees can access confidential data, for example, or how privacy training is to be completed.
  (2) Physical safeguards, which include things such as locks and keys and how office equipment, including computer monitors and fax machines, are positioned so as to prevent unauthorized viewing of personal health information.
  (3) Technical measures, which cover things such as computer passwords, virus protection and data encryption.

Q: What if you think your privacy has been violated?
A: If you suspect your privacy rights have been violated, you can file a complaint directly with your health care provider or with the federal government. Details should be available in the provider’s notice of privacy practices.

A health care provider found to be noncompliant with the privacy rules may be subject to civil and criminal penalties.

Q: Where can you get more information about HIPAA and the privacy rules?
A: If you have questions or need more information about HIPAA and the privacy rules, consult our notice of privacy practices or contact Member Services. You may also learn more at the U.S. Department of Health and Human Services Web site, www.hhs.gov/ocr/hipaa.