What options do we have under the law, and as a practical matter when it comes our medical records? First, each of us, under HIPAA, has the right to request an accounting from any healthcare provider of anytime our information was released to anyone. This accounting should contain who the information was released to, why, and when. Second, if you believe your rights have been violated based on the accounting you receive, you can report this to DHHS (Dept. of Health and Human Services) or CMS (Centers for Medicare and Medicaid Services-- local offices exist in each state) and the provider can face fines up to $25,000 per occurrence. The specific remedy for you will be determined on a case by case basis. Finally, you can file a Statement of My Right To Medical Privacy form, provided by the Privacy Rights Organization and available at
http://www.patientprivacyrights.org/ . While the statement may not stop every (or even most) providers from releasing your information when it is legitimately requested in accordance with HIPAA, it will put them on notice about the importance of making sure their own policies are HIPAA compliant.
Lastly, personal health records are available today through many organizations. If you are looking at electronic storage of your health information keep in mind that, under current HIPAA law, unless the organization that is storing your information is a health care provider or other covered entity (those organizations who are business associates of the provider), federal law will not protect the security of your information. Your state law may provide some protections and, of course, there are always some common law legal remedies that can be pursued. But, these solutions are inconsistent and uncertain. More important, common law remedies will not kick in unless your rights are violated – the exact issue we are all hoping to avoid. Your best bet here is to have your personal health records (PHR) stored by an organization that provides you with a contractual guarantee of security, if you are unable to use a healthcare provider to store and manage your PHR.
I address the importance of a complete, accurate, computerized medical record in Step 2 of my book 7 Steps to Your Best Possible Healthcare. You can read more about the book and getting your best possible healthcare at
www.7stepshealth.com .