The other day a certain politician was asked by a reporter if she was vaccinated against the coronavirus, and she replied that even to ask her this question was a violation of HIPAA. This resulted in HIPAA trending on Twitter for a bit, and made me think to write this blog entry explaining what the actual law means, since a lot of people have misconceptions about it and since it is an issue that occasionally pops up in the missing persons world.
The term is HIPAA, not HIPPA. It is often misspelled. It stands for “Health Insurance Portability and Accountability Act” and was passed in 1996. What it basically means is that except in a few circumstances, your health care providers are not allowed to share your medical information with others without your permission. This is a super serious thing and a violation can mean serious consequences for the violator’s career.
Health care providers aren’t even allowed to share medical information with the police without permission from the patient, unless the police can get a court order requiring them to disclose it.
The thing that should be emphasized is that HIPAA applies ONLY to health care providers, not to anyone else. Your doctor, your nurse, your pharmacist, etc., could be punished with a large fine and/or suspension or revocation of their license to work in the field if they disclose your medical information without your consent. The patient could also sue the provider for the privacy violation. I think the violator could even face criminal charges in certain instances, though I’m not 100% sure on that.
If your best friend gets diagnosed with a sexually transmitted disease and tells you and you gossip about it to others, that’s not a nice thing to do, but you would not be in violation of HIPAA unless you were also your best friend’s health care provider. If your best friend gets diagnosed with an STD and their doctor tells you about it and you gossip about it to other people, the doctor would be in violation of HIPAA, but you would not be, since you’re not the care provider in this situation.
Several times I have been accused of committing a HIPAA violation just by writing about a missing person’s medical conditions. But if I find out, one way or another, that a missing person had a certain disease and put this information on the Charley Project, that’s not against the law.
Nor is it against the law for anybody to ask anybody else about their medical information (as the reporter did with the politician). The person certainly does not have to answer the question if they don’t want to, but it’s not illegal to ask them, nor is it illegal to publish the information if it becomes available.