HIPAA. We, or at least those of us living in the United States, all know the five-letter acronym even if we can’t tell you what the letters stand for. Passed in 1996, the Health Insurance Porta­bility and Account­ability Act has been with us for more than two decades.

And we all know about HIPAA, even if we don’t know it. Any­time any one of us goes to a hospital or medical center for testing or x-rays or surgery, registration staff will ask, “Do you want a copy of your HIPAA rights?”

HIPAA has a lot of facets to it, but there are two core foun­da­tions to keep in mind. First, HIPAA established require­ments for keeping medical records secure from improper disclosure. Second, HIPAA firmly estab­lished that it is the patient, and not the medical provider, who owns the medical records.

Twelve years ago, I spent two years creating a mental health docket for a local court. A mental health docket is for offenders who, but for a diag­nosed under­lying mental illness such as schizo­phrenia or bipolar disorder, would not have committed the crime. In a mental health docket, participants receive intensive super­vision (probation) and treat­ment for the mental illness.

As the one crafting the docket, including its protocols, I had to immerse myself in HIPAA. What could the Court ask for? What could the participant release? For the pro­gram to work, Court per­son­nel needed to see diag­nosis, evalu­a­tion, and treat­ment reports. We had con­siderable pushback from local mental health providers who insisted that no patient records could ever be shared because of HIPAA. They believed HIPAA was a shield that they could hold to fend off invasions. But after studying HIPAA and looking at similar pro­grams around the country, I knew other­wise. We had a few more discussions with providers and soon reached a resolution. The docket is about to turn 10 years old.

When it comes to HIPAA, I’ve been there and done that.

I have been with my local oncologist since my initial myeloma diag­nosis in November 2004. He and I are yoked together by my illness. It has been a successful and enriching pairing for me, and I would like to think for him as well.

My oncologist is part of a mod­er­ate-size, private oncology practice, one which is known and respected in Ohio. It recently changed its office operating system: registration, billing, medical records, the works. There were some grumbles and some gaffes. Further down the road, it seems to be functioning now.

Along with the change in the operating system came a new patient portal.

I treat with two oncologists: my one here, and one at the Mayo Clinic as well. I see the Mayo Clinic doctor quarterly only. He leaves it up to me and my oncologist to track the progress and stability of the myeloma, especially watching the M-spike and the alkaline phosphatase levels. Prior to the new portal, I would simply go to the old portal and review my lab results as they became available.

Easy peasy.

So imagine my surprise when I went to the new portal and saw only a "CBC with Diff" (complete blood count with differential). No metabolic panel, no M-spike, no serum free light chain assay. Nothing.

Excuse me? Assuming operator error (mine), I tried again.

CBC with Diff.

I brought it up with my oncologist when I saw him in February. He was baffled. What did I mean I could only see my CBC? How were his patients supposed to see their results? I told him I would try again with the new labs and report to him in March.

Well, I tried again. Nothing. So I sent a patient message asking what I needed to do to access my lab results. That triggered a series of conversations with one very patient nurse. The reason I could not see any results beyond the CBC was because the doctors of the practice restricted patient access (more about that later). Would I like her to email me the results? Yes, thank you! Oops, sorry, not allowed to email the lab results because of HIPAA.

Oh, don’t tell a lawyer that HIPAA doesn’t allow a doctor to send medical records by email when the patient requests they be sent that way.

Before firing off a memo to my oncologist, I did my research first. Yes, I could request my records by email. If I specified an email address and made the request in writing, the medical provider had to comply. Period.

It took me five days and seven rewrites of my memo to pare it down to what was important. I had to remove the sarcasm from the memo; I had to remove the rants from the memo. I had to take out my favorite anti-doctor lawyer joke. In the end, I summarized the issue, explained why the medical practice did not control my HIPAA rights, and spelled out a protocol I would follow when requesting my records.

At my next oncology appoint­ment, my oncologist and I discussed the situation. He had done some investi­gat­ing at his end as to why the portal was so limited. Some of his colleagues believe patients lack the intelligence to understand their lab results, hence the limited access to the portal. That’s not his belief, but he’s not on the tech­nology committee. We discussed HIPAA; he offered that some in the profession seemed to think HIPAA was for them and not the patient. We discussed my needing the labs, and I handed him my signed release.

My oncologist made sure my release went into my file. I know that because a week later, when I requested my lab results by email, fol­low­ing the protocol I had set up, I received the com­plete report im­medi­ately, with a gracious note from the same nurse who had struggled hard to get them to me the prior month.

Whose HIPAA? My HIPAA. Your HIPAA. Our HIPAA.