Back More
Salem Press

Table of Contents

Privacy Rights in the Digital Age

Health care information

by Gretchen Nobahar

Healthcare records of patients that are retrievable by personal identifiers such as a name, Social Security number, or other identifying number or symbol. Most Americans believe that medical and other health information is private and should be protected, and most want to know who has this information. An individual's health care information is protected by the following major federal laws: the Privacy Act of 1974, the E-Government Act of 2002, and the Health Insurance Portability and Accountability Act (HIPAA).

The Privacy Act of 1974, 88 Stat. 1896, as amended at 5 U.S.C. 552a, protects health care information. Individuals are entitled to access to their health records and to request correction of these records under certain circumstances.

The Privacy Act prohibits disclosure of these records without the written consent of the individual patient to whom the records pertain unless one of the twelve disclosure exceptions in the act applies. The Privacy Act applies only to federal agencies and covers only records possessed and controlled by federal agencies.

The Privacy Act requires that agencies create and maintain, as necessary, system of records notices (SORNs), as defined in the Privacy Act. This system of records consists of any item, or collection of information on an individual, where the records are retrievable by the name of the individual or by some other type of identifier unique to the individual.

The E-Government Act of 2002, 116 Stat. 2899 (2002), requires federal government agencies to assess the impact on privacy for systems that collect personally identifiable information in privacy impact assessments (PIAs). All Department of Health and Human Services (HHS) PIAs can be found online.

The privacy provisions of the federal Health Insurance Portability and Accountability Act (HIPAA), 110 Stat. 1936, apply to health information created or maintained by healthcare providers who engage in certain electronic transactions, health plans, and healthcare clearinghouses. The Department of Health and Human Services issued the regulation “Standards for Privacy of Individually Identifiable Health Information,” which applies to entities covered by HIPAA. The Office for Civil Rights (OCR) is responsible for implementing and enforcing the HIPAA privacy regulation.

The HIPAA Privacy Rule, 45 C.F.R. § 164.500, provides federal protections for individually identifiable health information held by covered entities and their business associates, and gives patients an array of rights with respect to that information. At the same time, the Privacy Rule is balanced so that it permits the disclosure of health information needed for patient care and other important purposes. The Security Rule, 45 C.F.R. § 164.302, specifies a series of administrative, physical, and technical safeguards for covered entities and their business associates to use to ensure the confidentiality, integrity, and availability of electronic protected health information.

The Privacy Rule grants the individual rights with regard to his or her health information and sets rules and limits on who may access an individual's health information. The Privacy Rule applies to all forms of individuals' protected health information, whether electronic, written, or oral. The Security Rule requires security for health information in electronic form.

The information covered in this law includes information that doctors, nurses, and other healthcare providers place in a medical record; conversations a doctor has about the patient's care or treatment with nurses and others; information about the patient in a health insurer's computer system; and billing information about the patient at a clinic.

Most other health information about you is held by those who must follow these laws. Organizations not covered by these Privacy and Security Rules include life insurers, employers, workers' compensation carriers, most schools and school districts, many state agencies like child protective services, most law enforcement agencies, and many municipal offices. Entities covered by the law must implement safeguards to protect individual health information and ensure that they do not use or disclose individual health information improperly. Covered entities must reasonably limit uses and disclosures to the minimum necessary to accomplish their intended purpose; they must have procedures in place to limit who can view and access the health information of individuals as well as implement training programs for employees on how to protect health information.

State privacy laws in many states can be as important as HIPAA. In some states, state privacy and security law either doesn't exist or is identical to HIPAA. In most states, however, the differences between HIPAA and state privacy law require the individual to be aware of both federal and state law.

Further Reading

1 

Carroll, Jamuna. Privacy. Detroit, MI: Greenhaven Press, 2006.

2 

Donaldson, Molla S. Health Data in the Information Age: Use, Disclosure, and Privacy. Washington, DC: National Academy Press, 1994.

3 

HIPAA in Practice: The Health Information Manager's Perspective. Chicago, IL: AHIMA, 2004.

4 

Hosek, Susan D., and Susan G. Straus. Patient Privacy, Consent, and Identity Management in Health Information Exchange: Issues for the Military Health System.

5 

US Government Printing Office. Protecting Our Personal Health Information, Privacy in the Electronic Age: Hearings before the Committee on Labor and Human Resources, United States Senate, One Hundred Fifth Congress, First Session Examining Standards with Respect to the Privacy of Individuals. Washington, DC: Author, 1998.

See also: Data Protection Regimes; Fair Information Practices Principles (FIPPs); Health Insurance Portability and Accountability Act (HIPAA); HIV testing; Privacy Act of 1974; Privacy Laws, Federal; Privacy laws, state

Citation Types

MLA 9th
Nobahar, Gretchen. "Health Care Information." Privacy Rights in the Digital Age, edited by Christopher T. Anglim & JD, Salem Press, 2016. Salem Online, online.salempress.com/articleDetails.do?articleName=PRDA_0109.
APA 7th
Nobahar, G. (2016). Health care information. In C. Anglim & JD (Ed.), Privacy Rights in the Digital Age. Salem Press. online.salempress.com.
CMOS 17th
Nobahar, Gretchen. "Health Care Information." Edited by Christopher T. Anglim & JD. Privacy Rights in the Digital Age. Hackensack: Salem Press, 2016. Accessed May 30, 2026. online.salempress.com.