Inservice

If you've ever tried to do anything remotely related to health care of any sort in the United States, you've hopefully heard of HIPAA. (For the record, that's one P and two A's--as in Health Insurance Portability and Accountability Act.)

The gist of HIPAA is that (except in very specific cases) personal health information cannot be released without consent. This is a good idea in theory. However, in practice, it can get messy. Even if you pay for the medical care for your 18-year-old daughter, her doctor is not permitted to tell you about her treatment without her consent.

Or let's say your husband, who has never been in therapy of any kind, attempts suicide, and he's admitted to the hospital. You (back at home) want to make sure the hospital has called your insurance company for prior authorization. Unless your husband has already signed a release of information with the insurance company--not a common thing for people to do prior to attempting suicide--you're out of luck.

(And let's not even talk of situations in which an adult is not able to give consent--for example, he or she is severely psychotic, drunk, or in a coma. Or when a non-custodial parent is required to provide health insurance as part of child support--in which case the custodial parent must do the consenting, and I don't want to be a fly on the wall for that kind of conversation.)

Like I said, HIPAA gets messy.

But listen well, for here comes my point:

You cannot assert HIPAA against yourself.

As your provider, I cannot release your personal health information to another provider without your consent (except, again, as permitted or required by law). But HIPAA does not apply if you haven't yet told me anything about yourself.

I kid you not--people have said to me, "You can't ask me to give you my own personal information. That's prohibited by HIPAA."

Um, no. Not quite.