Why is the HIPAA Privacy Rule needed?
The personal information of patients has moved among hospitals, doctors’ offices, insurers and other third party payers for years, relying on a national patchwork of Federal and State laws to protect its privacy. Under the patchwork of laws existing prior to adoption of HIPAA and the Privacy Rule, personal health information could be used, disclosed and distributed – without notice to, or authorization from, the patient – for reasons that had nothing to do with the patient’s medical treatment or payment for care. For example, unless otherwise forbidden by a State or local law and without the Privacy Rule, patient information held by a health plan could, without the patient’s permission, be passed on to a lender who could then deny the patient’s application for a home mortgage or a credit card, or to an employer who could use it in personnel decisions. The Privacy Rule establishes basic Federal-level safeguards to protect the confidentiality of medical information nationwide. State laws
