[20050204]RS20500_病历隐私：HIPAA规则问答.pdf

Congressional Research Service The Library of CongressCRS Report for CongressReceived through the CRS WebOrder Code RS20500Updated February 4, 2005Medical Records Privacy: Questions andAnswers on the HIPAA Rulename redactedSpecialist in Life SciencesDomestic Social Policy DivisionSummaryThe HIPAA privacy rule gives patients the right of access to their medicalinformation and prohibits health plans and health care providers from using ordisclosing individually identifiable health information without a patients writtenauthorization except as expressly permitted or required by the rule. Plans and providersare permitted to use and disclose health information for treatment, payment, and otherroutine health care operations and for various specified national priority activities (e.g.,law enforcement, public health, research). Providers may also share certain informationwith family members and others, as long as the patient is given the opportunity to object.Health plans and providers must give enrollees and patients a notice explaining theirprivacy rights and how their information will be used. They are also required to havein place reasonable safeguards to protect the privacy of patient