Letters From Cancerland: Whose HIPAA Is It Anyway?
HIPAA. We, or at least those of us living in the United States, all know the five-letter acronym even if we can’t tell you what the letters stand for. Passed in 1996, the Health Insurance Portability and Accountability Act has been with us for more than two decades.
And we all know about HIPAA, even if we don’t know it. Anytime any one of us goes to a hospital or medical center for testing or x-rays or surgery, registration staff will ask, “Do you want a copy of your HIPAA rights?”
HIPAA has a lot of facets to it, but there are two core foundations to keep in mind. First, HIPAA established requirements for keeping medical records secure from improper disclosure. Second, HIPAA firmly established that it is the patient, and not the medical provider, who owns the medical records.
Twelve years ago, I spent two years creating a mental health docket for a local court. A mental health docket is for offenders who, but for a diagnosed underlying mental illness such as schizophrenia or bipolar disorder, would not have committed the crime. In a mental health docket, participants receive intensive supervision (probation) and treatment for the mental illness.
As the one crafting the docket, including its protocols, I had to immerse myself in HIPAA. What could the Court ask for? What could the participant release? For the program to work, Court personnel needed to see diagnosis, evaluation, and treatment reports. We had considerable pushback from local mental health providers who insisted that no patient records could ever be shared because of HIPAA. They believed HIPAA was a shield that they could hold to fend off invasions. But after studying HIPAA and looking at similar programs around the country, I knew otherwise. We had a few more discussions with providers and soon reached a resolution. The docket is about to turn 10 years old.
When it comes to HIPAA, I’ve been there and done that.
I have been with my local oncologist since my initial myeloma diagnosis in November 2004. He and I are yoked together by my illness. It has been a successful and enriching pairing for me, and I would like to think for him as well.
My oncologist is part of a moderate-size, private oncology practice, one which is known and respected in Ohio. It recently changed its office operating system: registration, billing, medical records, the works. There were some grumbles and some gaffes. Further down the road, it seems to be functioning now.
Along with the change in the operating system came a new patient portal.
I treat with two oncologists: my one here, and one at the Mayo Clinic as well. I see the Mayo Clinic doctor quarterly only. He leaves it up to me and my oncologist to track the progress and stability of the myeloma, especially watching the M-spike and the alkaline phosphatase levels. Prior to the new portal, I would simply go to the old portal and review my lab results as they became available.
Easy peasy.
So imagine my surprise when I went to the new portal and saw only a "CBC with Diff" (complete blood count with differential). No metabolic panel, no M-spike, no serum free light chain assay. Nothing.
Excuse me? Assuming operator error (mine), I tried again.
CBC with Diff.
I brought it up with my oncologist when I saw him in February. He was baffled. What did I mean I could only see my CBC? How were his patients supposed to see their results? I told him I would try again with the new labs and report to him in March.
Well, I tried again. Nothing. So I sent a patient message asking what I needed to do to access my lab results. That triggered a series of conversations with one very patient nurse. The reason I could not see any results beyond the CBC was because the doctors of the practice restricted patient access (more about that later). Would I like her to email me the results? Yes, thank you! Oops, sorry, not allowed to email the lab results because of HIPAA.
Oh, don’t tell a lawyer that HIPAA doesn’t allow a doctor to send medical records by email when the patient requests they be sent that way.
Before firing off a memo to my oncologist, I did my research first. Yes, I could request my records by email. If I specified an email address and made the request in writing, the medical provider had to comply. Period.
It took me five days and seven rewrites of my memo to pare it down to what was important. I had to remove the sarcasm from the memo; I had to remove the rants from the memo. I had to take out my favorite anti-doctor lawyer joke. In the end, I summarized the issue, explained why the medical practice did not control my HIPAA rights, and spelled out a protocol I would follow when requesting my records.
At my next oncology appointment, my oncologist and I discussed the situation. He had done some investigating at his end as to why the portal was so limited. Some of his colleagues believe patients lack the intelligence to understand their lab results, hence the limited access to the portal. That’s not his belief, but he’s not on the technology committee. We discussed HIPAA; he offered that some in the profession seemed to think HIPAA was for them and not the patient. We discussed my needing the labs, and I handed him my signed release.
My oncologist made sure my release went into my file. I know that because a week later, when I requested my lab results by email, following the protocol I had set up, I received the complete report immediately, with a gracious note from the same nurse who had struggled hard to get them to me the prior month.
Whose HIPAA? My HIPAA. Your HIPAA. Our HIPAA.
April Nelson is a multiple myeloma patient and columnist at The Myeloma Beacon. You can view a list of her previously published columns here.
If you are interested in writing a regular column for The Myeloma Beacon, please contact the Beacon team at .
Thank you for this article, very informative and helpful. I'm an attorney and should know better, but I have never challenged the restrictions on access to my husband's records via e-mail. My husband treats at a widely respected cancer center, and I have been told that I can only have records sent to me via e-mail if I set up a secure restricted e-mail system (they offer this service, and I have done this). Pathology reports (such as for bone marrow biopsies and immunofixation electrophoresis tests) are delayed presumably in order to permit time to meet with the doctor to explain the results.
I am less clear on whether they have to allow access to pathology reports in advance of a meeting with a doctor. Sometimes these reports are complete, but a doctor's appointment still may be days or weeks away. I also find it helpful if we have a chance to review a report in advance of a doctor's visit. Often, when we receive the report / results at the visit with the doctor, we haven't had a chance to digest it, and the doctor necessarily goes over the main takeaways. I am sure I am not the only one who has looked at a report after meeting with a doctor, and wished they had seen incidental findings that were not discussed but raise further questions. When we review results after meeting with the doctor, we always have additional questions.
I do want to add that all the service providers have been helpful in trying to get us requested information consistent with the center's rules.
Thank you for this great, well-written piece.
Thank you, April. That was quite an interesting and informative column. I have noticed that access to medical records varies from state to state and from medical facility to medical facility. For a patient, it can be quite frustrating. Like you, we are tenacious in getting access to my husband’s medical records, but I fear that there are many patients who are not. This puts them at a disadvantage when it comes to being proactive in their own care and treatment. Like you we believe that HIPAA should serve the needs of the patient and gaining access to medical records should not be difficult.
Thanks, April, for your thought provoking article about obtaining one's own patient records. I always ask for a copy of my lab results, and other test results, and have kept them in a thick binder. Thus I can look back on how my results have been and have found that to be useful sometimes too. Although the medical staff here is on an electronic portal to get results, the patients must wait for an appointment to get the results of their tests, or can phone in and talk to a nurse, given the permission of the doctor. This may sound a bit cumbersome, but I haven't had any problems with it. There are legal reasons, I believe, as to why the patients where I am here in Canada cannot simply access their results before they actually have an opportunity to discuss them with the medical staff. It is just a good idea to ask for a printout of results if you want to have a file of them. Of course, patients do have a right to have a copy of their own medical data, within a reasonable time frame. Lawyers also can request relevant data from doctors, for their clients.
Great article April.
I found one easy way around the emailing of records issue is to simply ask for a fax of the records in question. Every medical office I've worked with seems to be OK with faxing records, but they all balk at emailing the results. So, I actually keep an old-school fax machine around in my home office for this sole reason.
I also find it annoying that my lab results at some facilities will not be released to me until a doctor has first discussed the results with me. While I can appreciate why some practices want the chance to first explain lab results before a patient's imagination goes wild in making their own interpretations of lab data, I am not in that camp. So, that's one of the reasons I started to go directly to labs such as Labcorp and Quest Diagnostics for all of my routine screens. The labwork at these facilities is still covered under my insurance and all of my results show up online within one week of my blood draws and are not subject to first being cleared by my doctor. I for one would rather have all of my data in hand before I talk to my doctor so that I may have a more productive discussion with the doctor.
Hi April,
I really love reading your articles and opinions as you sprinkle them with lovely insights. My name is Nisha and I am from Bangalore, India. My mother was diagnosed with multiple myeloma in December 2017. We got to know as she had a compressed cord and like most people did not know about multiple myeloma prior to being detected.
She has undergone an induction of Velcade, Revlimid, and dexamethasone (VRD) and is currently on Revlimid 25 mg and dex (once a week). She has attained a very good partial response (VGPR) and is on maintenance (her doctor has not yet recommended a transplant).
Like many folks here, our lives have turned upside down with the diagnosis. I am always living on the edge, and the Beacon is the place I turn to for support.
Thanks.