I went to King's Island this weekend with a group of friends. (For those of you reading this from outside of the Midwest, King's Island is an amusement park North of Cincinnati, Ohio.) We were discussing work when one of them shared a "HIPAA" story with me. I share it with you as an illustration as the continued confusion surrounding HIPAA.
According to the woman relaying the story, one of her colleagues at work is pregnant. When her colleague told their boss the good news, the boss told her that was great, but that she could not tell her coworkers. When she asked why not, the boss explained that because of HIPAA and medical privacy she needed to keep the information to herself. Of course, this raised a number of questions, the most obvious question being, what was the lady supposed to do when she started to show? Was she supposed to make up a story about gaining weight? (Of course, weight gain can also be a health condition which would appear to implicate the company?s understanding of HIPAA and medical privacy as well.) Perhaps she was just supposed to ignore anyone asking such a question.
The lady telling the story asked me if this was really what HIPAA required. I explained that HIPAA restrains covered entities from using or disclosing an individuals protected health information. HIPAA gives individuals certain rights to access their health information. What an individual chooses to do with their own health information is their decision. HIPAA does not prevent an individual from sharing their information with whomever they choose (or putting it on a website or billboard for that matter). An individual may even authorize others to disclose their information to others. Obviously, this employer has a fundamental misunderstanding of HIPAA.
The story is funny, but is a reminder that most people, especially those outside of health care, really do not understand HIPAA. The notion that HIPAA prevents you from sharing your own health information is similar to the experience many providers had shortly after HIPAA went into effect of an insurance company refusing to confirm coverage, because HIPAA will not allow us to disclose this information.
It would appear that many people still need some education on what HIPAA actually requires. In the meantime, if your employees want to share their own health information with others, HIPAA does not prohibit that.
Permalink
