Kokua Line June Watanabe

---

Privacy rules cover some medical data

Question: Who can we file a complaint to about the release of confidential medical records? I believe a hospital wrongly released my mom's records without getting permission from her or me. I am her caregiver.

Answer: You can file a complaint with the federal Office for Civil Rights, which is authorized to investigate complaints regarding violations of the federal Health Insurance Portability and Accountability Act.

Call toll-free (866) 627-7748, for information or to receive a complaint form. You can also get information online at www.hhs.gov/ocr/hipaa/.

Complaints must put in writing, either on paper or electronically, and filed within 180 days of when you knew the alleged violation occurred. The period may be extended if you can show good cause.

HIPAA, which took effect in 2003, sets privacy standards for medical records maintained by health-care providers, health plans and health clearinghouses, but only if the records are maintained and transmitted in electronic form.

The state no longer has a medical privacy law. That law was repealed in 2001, partly because of the then-pending HIPAA legislation.

If a state-run facility were involved, the state Office of Information Practices might investigate, but only regarding issues relating to the state's records laws, said Executive Director Les Kondo.

Meanwhile, HIPAA does not guarantee the privacy of medical information that may exist outside of hospitals, etc. In other words, the federal medical privacy law is not as far-reaching as many people might believe.

However, because a hospital is involved in your mother's case, you should look into filing a complaint with the Office of Civil Rights.

"In addition to that, every hospital or care provider that is covered by HIPAA has to have its own internal privacy officer" that you should also contact, said Tena Friery, research director of the nonprofit Privacy Rights Clearinghouse.

Whether there may have been a violation really depends on who the third-party is who received the medical information, she said in a telephone interview from San Diego.

"There are a lot of exceptions to the HIPAA," Friery explained. The Office of Civil Rights generally tries to mediate complaints.

We asked Friery what the significance is of the provision that HIPAA only covers health-care entities that maintain and transmit records in electronic form.

That usually pertains to the hospital or health-care provider using electronic means to transmit information about payments, she said.

"There are just lots of real fine points" to the law, she noted.

Friery also pointed out that HIPAA doesn't cover records dealing with disability insurance; workers compensation insurance; or employee assistance programs, such as weight reduction or smoking cessation programs.

In general, HIPAA doesn't cover employers except when there is some question of group insurance involved, she said.

"There is a public misconception that medical information, just because it's medical, has some overall blanket protection in all circumstances," Friery said. "It's just not the case."

On its Web site, www.privacyrights.org/fs/fs8b-MedFAQ.htm, the Privacy Rights Clearinghouse warns, "A great deal of health-related information exists outside of health-care facilities and the files of health plans, and thus beyond the reach of HIPAA."

Furthermore: "The extent of privacy protection given to your medical information often depends on where the records are located and the purpose for which the information was compiled. The laws that cover privacy of medical information vary by situation. And, confidentiality is likely to be lost in return for insurance coverage, an employment opportunity, your application for a government benefit, or an investigation of health and safety at your work site. In short, you may have a false sense of security."

Mahalo

To a kind woman at Jaime's Snack Shop in Pauoa. Last Thursday, my 94-year-old father was waving signs for a state senator from 4 p.m. until almost 8 p.m. We did not know he was out. He was given a ride to the location, but no one ever came back to pick him up. The woman called me to let me know my father was standing all alone in the dark. She looked after him to make sure he was OK until my husband could pick him up. We are very grateful. -- Chew Nan Chun Family