You see the acronym a lot when it comes to signing forms at the doctor’s office, but what is HIPAA? How did its passage start a sea change in our access to healthcare? Co-hosts Erin Stein and Dr. Gillian Goddard explain medical privacy, your right to your records, pre-existing conditions, the ACA, COBRA, and why doctors still fax.
Gillian takes us back to the world before HIPAA, when losing coverage for even a short time could mean your insurer refused to pay for care. We explain how HIPAA narrowed pre-existing condition exclusions, how that connects to COBRA and the Affordable Care Act, and what each law did and didn’t fix.
We also get into the privacy side: your right to a copy of your medical records, why you now see lab results at the same time as your doctor, and why your doctor may not be able to text or email you freely. We uncover the mysteries why doctors fax, what happens when you turn 18, and why hospital staff have been fired for looking up celebrity charts.
We take a moment to remind you that while this is a medical discussion, it is not providing a diagnosis or treatment or any medical advice. The only way to get a diagnosis, treatment or medical advice for your particular condition is through a discussion with your doctor.
Please subscribe savvypatient.substack.com
Visit www.thesavvypatient.com/podcast for episode transcripts.
Watch full podcast episodes @TheSavvyPatient on Youtube.com.
Get your copy of The Hormone Loop by Dr. Gillian Goddard wherever books are sold.
This episode was produced and edited by Erin Stein. Music: “All We Live For (instrumental)” by Wolfclub licensed through Audiio.com. Intro and outro edited, and video created, by Ian Mayer. The Savvy Patient logo by Amanda Spielman.
TRANSCRIPT
Gillian Goddard: Hello everyone and welcome to The Savvy Patient.
Erin Stein: Hi everyone. We have another fun topic that is an acronym.
Gillian Goddard: My goodness, alphabet soup, right? Medicine loves alphabet soup.
Erin Stein: It does. It really does.
Gillian Goddard: Almost as much as the Roosevelt administration back in the nineteen thirties.
Erin Stein: Wow, that's a deep cut, Gillian.
Gillian Goddard: Ha! I do my best.
Erin Stein: Mm-hmm. Alright, what does HIPAA stand for?
Gillian Goddard: Oh HIPAA. HIPAA is the Health Insurance Portability and Accountability Act of 1996.
Erin Stein: Wow, that sounds…
Gillian Goddard: Yeah.
Erin Stein: Super boring.
Gillian Goddard: Yeah. A little like watching paint dry.
Erin Stein: A little. But there's more to it. It's not as boring. Or maybe it will be. We always try to make it interesting, but it actually is a really critical thing.
Gillian Goddard: It is.
Erin Stein: You hear about it a lot in regards to privacy.
Gillian Goddard: Yes, you probably sign a form or sign something on an iPad. At least every time you go to a new doctor's office, you are supposed to sign a HIPAA form stating your privacy rights.
Erin Stein: Yes, it controls your privacy and who has access to your medical records. That seems important and a good thing.
Gillian Goddard: It is.
Erin Stein: Although maybe, we'll get into this later, but it does affect some weird things. Like sometimes your doctor is very annoying, but it's because they're following HIPAA.
Gillian Goddard: Yes. We're doing our best.
Erin Stein: Yeah, but Gillian can explain herself. But it's not just that, it does all these other things, so tell us, Gillian.
Gillian Goddard: Yeah, so I think that to really understand why HIPAA was so important, I think it's helpful to kind of take a trip back in the time machine and remember what the world was like before HIPAA. And I don't know about you, like I was in college in 1996. Well, I do know about you, you were in college too.
Erin Stein: Yeah. Same time.
Gillian Goddard: Even though it was enacted in 1996, it didn't actually take effect until 2003 and 2004. That means we're remembering back to maybe early adulthood and maybe adolescence when you probably weren't so involved in your health insurance.
Erin Stein: Correct.
Gillian Goddard: The big thing we have to remember, at the time, is that you typically could only be on your health parents' health insurance until you were 18, unless you were a full-time student. And typically at that point, you could stay on your parents' health insurance through your undergrad. So for most of us that meant [age] 21, 22, 23 tops. When you were graduating from high school or college and going out and getting a job, typically that job, you know, most of us in the United States get our health insurance through our employer. And you would go to that job. And if you had not had health insurance even for a very brief period of time, your new health insurer could tell you they wouldn't cover all these pre-existing conditions, which really affected almost anything. I remember when I got my first job in 2000, I had not had health insurance for 90 days because I could not have my parents' health insurance after December of 1999 because I graduated from college in December. And my new employer had a 90-day new employee trial period—
Erin Stein: Trial. Yep.
Gillian Goddard: Where you didn't have a long-term contract and didn't get health insurance. So I basically had three months where I didn't have health insurance. And as a result, my new health insurance refused to pay for my birth control pills because they said that my irregular periods that my birth control pills were prescribed to treat was a pre-existing condition.
Erin Stein: That's wild.
Gillian Goddard: Isn't that crazy to think about?
Erin Stein: I remember you could be on your parents' insurance through college. You had to be a full-time student and then you were on your own.
Gillian Goddard: I remember having to get stuff from my university to give to my parents for them to send to their insurance company so that I could stay on their insurance.
Erin Stein: Mm, mm-hmm, mm-hmm.
Gillian Goddard: So that's me at 22, not having insurance for 90 days. You can imagine people who were older or sicker than I was at that point, who might have not had insurance for a more extended period of time, being told that much more expensive treatments and medications would not be covered because they were related to a pre-existing condition.
Erin Stein: Which is an ongoing issue in certain situations, because, you know, we are told you get health insurance and you pay into it and then it covers the health care you need. But it's this Catch-22 because if you have something, it's pre-existing, but then you need to get the insurance to help cover it. And in a smaller form I had this problem with my cats trying to get cat insurance, but they were like, well, you already got the diagnosis, so it's a pre-existing condition, so if you get insurance for them, we won't cover any of it. I'm like, well then what's the point of having the insurance?
Gillian Goddard: Yeah, yeah. And they could exclude anything that happened within twelve months of you signing up for your insurance. But at the time it was like anyone could call anything a pre-existing condition if you had not had insurance for any period of time. So say you lost your job and you were gonna start a new business, for example. And so you weren't gonna be employed by someone. You were gonna be self-employed. It was really, really difficult to get insurance at that time as an individual. And I saw a statistic that twenty percent of people who applied for insurance at the time for individual insurance were rejected outright. We're not talking it was super expensive. The insurance companies just said no. And so the portability part of the Health Insurance Portability and Accountability Act was it closed a lot of loopholes on pre-existing conditions. It didn't completely get rid of pre-existing conditions. That actually was a piece of the Affordable Care Act. But it did significantly narrow pre-existing conditions and significantly lengthened the time you had to be without insurance for something to be pre-existing so if you didn't have insurance for a month or 90 days the new insurance company couldn't consider something pre-existing. You had to not have insurance for 12 months for them to call something pre-existing. So it extended benefits there. And it also created a bunch of patients' rights about privacy practices.
Erin Stein: Mm-hmm.
Gillian Goddard: So the other thing to know about what was going on before all of this was that there was sort of like this hodgepodge patchwork of rules and regulations at many levels of government, that made the rules about privacy and how your records had to be maintained, who could see them, who could not see them, how they had to be discussed and transmitted to others, doctors, healthcare workers or otherwise. And what HIPAA did was create sort of this big overarching federal rules that codified all of this and created the same rules for everyone everywhere.
Erin Stein: What kind of rules, did they put in place? What are the basics that HIPAA was like, listen, everybody deserves this basic treatment.
Gillian Goddard: You have to be notified of what the privacy practices are, which is why every time you go to a new doctor's office, you sign a HIPAA form. That form notifies you of the rules.
Erin Stein: Mm-hmm.
Gillian Goddard: It controlled who can get access to medical records and actually guaranteed patients the rights to get copies of their medical records. And that has since been expanded even further. In 2014 they made a rule that you can get your lab results directly from the lab. And during COVID, they made it so that your lab results are released to you at the same time that they're released to the doctor. Before that the doctor had to review the results before you could see them. And during COVID, they decided that they didn't want to delay getting results of COVID tests out to individuals.
Erin Stein: Right, we needed to know. Mm-hmm.
Gillian Goddard: Yes, that's important. And a COVID test is pretty easy to interpret. Positive means you have COVID. Negative means you don't have COVID. But what they did to get those lab results out to everybody is now the patient and the doctor get the results from the lab at the same time. And that creates some conflict because the patient is waiting with bated breath for their lab and maybe gets lab results a couple times a year and is anxious about them. The doctor may order hundreds, I mean, I'm an endocrinologist, everything we do is based on lab results. I order hundreds of labs in a day and I'm getting all those labs at the same time and the patients are getting them at the same time and it is not actually possible for me to review them and respond to them before the patient is looking at them. And those labs are more difficult to interpret oftentimes. So that can create some friction.
Erin Stein: Yes, and as a patient, we've mentioned this before too. I think as a patient we've realized that this is what happens now. Especially if it's not a simple blood test where, you know, it's like you're in the green, so you must be okay or not. You know, you usually need some context and explanation from your doctor and I know for me, I didn't realize that they expanded that during COVID and that it applied to everything. So for a while I think most of us were like, why am I getting this before the doctor has even looked at it? Like it's annoying.
Gillian Goddard: Yeah.
Erin Stein: But now in that context, it makes sense.
Gillian Goddard: Right.
Erin Stein: The poor doctor needs a second to catch up, but we're getting it right away. But I also would rather have ready access to my lab results and my medical records because it used to be you would go to the doctor and you never saw anything. And you never got anything.
Gillian Goddard: And so, yes, this is better. But also give your doctor a little grace. Patients can actually request amendments or corrections to their medical record. However, those requests can be denied by your doctor if your doctor considers it to be making the record not factual. You have to communicate with your doctor in a confidential way. That was part of HIPAA. That is why your doctor needs your permission to communicate with you via email, and why so many doctors don't like to communicate via email. That is why doctors, myself included, push patients to use the communication devices in the patient portals. I know there's a million of them and it can be difficult to keep track of, but it is because the communications tools within those electronic medical records are HIPAA compliant. They are set up to protect your privacy. This is why doctors still fax.
Erin Stein: Yes, I was hoping we would get to the fax machine.
Gillian Goddard: So to be clear, for the most part in my office, we are not using a fax machine with thermal paper to get and receive information. It is going to and from other doctors' offices electronically, but it is doing that through a fax line, through a telephone line. Instead of through the internet. And that may seem semantic, but it is considered to be safer and less likely to be subject to somebody who should not have your health information getting their hands on your health information.
Erin Stein: Huh. So practically speaking usually what's being faxed is from one doctor's office to another, correct?
Gillian Goddard: Yes, because no one else has the ability to fax anything anymore.
Erin Stein: And so once it gets there, it's being put in your medical record anyway, so…?
Gillian Goddard: So in our office, if somebody else faxes us something, we get it as an e-fax directly into the medical record, and it actually automatically gets assigned into the patient's chart.
Erin Stein: Right. So someone could still hack your chart and get your information. It just got there securely.
Gillian Goddard: Yes, however, medical records are similar to and probably even better protected from an electronic security point of view, I would say they're even better protected than bank records. Yeah.
Erin Stein: Interesting. Wow, okay. And so faxing information. I've definitely had to do that. I've definitely had offices say it has to come to us via fax, which I’m like, why? What dark ages are we living in? But that explains it.
Gillian Goddard: That is a HIPAA thing. Yeah. That is why. And I bet your doctor's office doesn't have a fax machine. Yeah.
Erin Stein: Probably not. Um, and sometimes you also have to bring things on CD, which I imagine is another security thing.
Gillian Goddard: Yes.
Erin Stein: If you have imaging or whatever, they're like, here's a CD to take to your doctor and I'm like, you can't just email it?
Gillian Goddard: Yeah. So most commercial radiology centers now have a password protected portal where I can see my patients imaging and imaging reports so that we don't have to get CDs, but occasionally people still do come with CDs, yeah.
Erin Stein: Yeah. I love that we're keeping the phone companies in business with some phone lines for your medical records.
Gillian Goddard: Ha ha. Other things from HIPAA, other than the fact that your doctor still uses faxes, accounting disclosures. You are able to get a full list of the different charges in your account, whether those charges were paid by you or by your insurance company.
Erin Stein: Mm-hmm.
Gillian Goddard: And there is one that always catches people by surprise. And despite having dealt with it a million times as a physician, it caught me by surprise. Minors. So HIPAA says that the day you turn 18, you control your medical records, and your parents no longer have access to your medical records. And I cannot tell you how often parents of kids who are, you know, 18, 19, 20 are still calling to try and get medical information about their kid, and we cannot give it to them without their kids' consent. And they don't have access to their kids' patient portal unless the kid gives them access, meaning the kid gives them their username and password. If there is a special situation like where parents have power of attorney over an adult child who may have cognitive impairment that keeps them from being able to consent and make these decisions on their own, we cannot release information to parents as a physician without that adult child's consent. Adult child, that is an oxymoron, if ever there was one.
Erin Stein: Mm-hmm. Well, the healthcare power of attorney or healthcare proxy documentation we've talked about. You have to have some legal documentation.
Gillian Goddard: You do. So for example, I was filling out a form for my son, and we needed his vaccination records, and it was the day after his 18th birthday, and I didn't think anything of it, and I went logging on. Basically, I can still see that he's there and I have not only no access to current records things going from the age of eighteen, I no longer have access to his records from birth onward. Yeah. We had to get on the phone together and he had to set up his own patient portal with the pediatrician and get his vaccination records.
Erin Stein: I didn't realize that was from HIPAA.
Gillian Goddard: Yes, that is from HIPAA. HIPAA also put into place privacy regulations around hospital staff. So when you work at a hospital or in a doctor's office, you typically log into the medical record system. Depending on who you are, you can see different pieces of the medical record system.
Erin Stein: Mm.
Gillian Goddard: You can search patients' names, for example. And depending on who you are in the hospital, particularly if you're a doctor or a nurse, or someone else who has access to records, you can get a lot of information about a person who is in the hospital. And that's important for providing patient care. But sometimes there are people in the hospital who people are curious about. So you and I live in New York.
Erin Stein: Mm-hmm.
Gillian Goddard: There are often famous people in the hospital. I have taken care of some people whose names you would recognize.
Erin Stein: Mm-hmm.
Gillian Goddard: And I'm not allowed, obviously, to say that I took care of that person or under what circumstances. They can disclose that information as the patient, but as the provider, I'm not allowed to disclose that information. And just because you work at a facility where that famous person was does not mean that you can look at their chart if you are not involved in the direct care of that patient. So if anyone will remember, the president when HIPAA was passed was Bill Clinton. And in the early aughts, Bill Clinton—and now I'm disclosing the information available to the public. Bill Clinton had a heart attack. And Bill Clinton was hospitalized at a hospital where I was working at the time. I had not gone to med school yet. I was working in a research lab. And a number of people at the hospital were fired for trying to look at Bill Clinton's medical records. And that was public information [that they were fired].
Erin Stein: Mm.
Gillian Goddard: What is in the medical records, I don't know. I was not one of those people. I liked my job.
Erin Stein: Good job.
Gillian Goddard: So yes, but people were fired for looking at medical records for patients that they were not directly related to. This again, this often happens in the context of celebrities because if Joe Smith is in the hospital, most people aren't especially curious about his medical records right.
Erin Stein: Not usually putting it on TMZ, right? Yes, and I think as a person who has looked at someone's hospital medical records, they are bizarre documents to the lay person. There's so many categories and ways the information is entered and it's very structured and somewhat repetitive.
Gillian Goddard: Mm-hmm. Yeah, this is not creative writing.
Erin Stein: But you can see who logged in and put that information in. All of that is identified in there. And it seems laborious and onerous perhaps for hospital staff, but also important because you need to know who is doing what, who has done what. And I imagine that it limits what you as a staff member can access based on your role. Yeah.
Gillian Goddard: Yes, yes. That is all correct. Yes. Medical records are highly structured and they are full of jargon and they are full of abbreviations and full of things that if you didn't know what they were, you would find it really difficult to interpret.
Erin Stein: It doesn't make sense as a lay person because it's not a holistic view. It's very compartmentalized. This is this kind of test, this is that kind of test, this is what this person looked at, this is what that person looked at. It's all these little individual pieces and that's how it's presented in the record because they're all put in these separate places.
Gillian Goddard: Mm-hmm.
Erin Stein: And it's all important, but trying to put that all together into you know, we want it to be a narrative, like what happened to this person, and it's pretty hard to figure that out yourself. Or at least it was for me.
Gillian Goddard: Yes. If you don't know what you're looking at, reconstructing the narrative that occurred can be really almost impossible for a non medical person.
Erin Stein: And I make narratives for a living and it was very challenging to try and figure out what was happening. Okay, so that all seems,fortunately now, like basic things that probably should be in place.
Gillian Goddard: Yeah. Yes, although I will say there are still common infractions that occur all the time that don't always get addressed. Things like discussing cases in hallways where other people might hear you. I can't tell you how often I'm in doctors' offices and you know, nobody's doing it on purpose, but like you're walking down the hall with the doctor, and they say something about like a medicine or something like that, but technically they shouldn't be saying that in a hallway where other people can hear. Monitors visible to the public. You're supposed to have privacy screens on your monitors, and it's always interesting to me to see. People who really should not be trying to see monitors, trying to see monitors. There was a lawsuit, and a criminal investigation where I was actually subpoenaed because a pharmaceutical company, their representatives were trying to see monitors, like their sales reps in the office were trying to see monitors and get patient information from people who worked in the office.
Erin Stein: Mm-hmm.
Gillian Goddard: Luckily they got in a lot of trouble for that.
Erin Stein: Good.
Gillian Goddard: Looking up records out of courtesy and curiosity. We already talked about that, but courtesy, like, oh sure, I'll take a look at your medical record, even though I'm not your doctor of record. That's technically not okay. And then texting without permission. There are texting platforms that are encrypted. Patients get frustrated. So I use one through a platform called Doximity. Say I'm on call over the weekend, calls the answering service and says they need a refill on their insulin. I put in the refill, I send it to the pharmacy. I don't need to talk to them about it. So I just send them a quick text and say that your prescription for blah blah blah was sent into your pharmacy. And if you have any issues, give us a call back. But I do that through an encrypted platform. Patients often want the convenience of texting with their doctor, but you have to use specific platforms. You can't just use iMessage, for example.
Erin Stein: Yeah, and I get texts like that from one provider and I think it protects their privacy as well. You know, the platform they're using, it's a different number every time.
Gillian Goddard: Yes, yes.
Erin Stein: I can communicate with them for a short-term exchange about an appointment, but everyone's being protected.
Gillian Goddard: If I give you my cell phone number as your doctor and I'm on a long flight and I don't get your text until I land and you texted me about something urgent, that hasn't helped either of us.
Erin Stein: So we talked about pre-existing health conditions. Did it change insurance in any other way?
Gillian Goddard: It barred health status discrimination in group plans. Meaning they couldn't base employers eligibility or premiums on health factors of individuals from that employer.
Erin Stein: Okay.
Gillian Goddard: Does that make sense? So like when the employer went to the insurance company they couldn't base it on who was being employed.
Erin Stein: They couldn't say, we're gonna charge you more to insure your employees because a bunch of them have whatever, cancer, some disease.
Gillian Goddard: Yes. Yep. Yes.
Erin Stein: So that makes sense.
Gillian Goddard: It did leave some big gaps. If you were without health insurance for more than twelve months, then insurance companies could say that something was pre-existing; plans could still exclude a condition outright. Such as apparently a blanket exclusion of cleft lip and palate treatment, which seems crazy.
Erin Stein: Seems pretty bad.
Gillian Goddard: And so actually the Affordable Care Act went in and closed up some of these loopholes. So exclusions for pre-existing conditions were banned for children by the Affordable Care Act. In 2014 insurers had to accept all applicants regardless of their health status. And so pre-existing conditions were banned completely in 2014. Premiums can only vary based on family size, location, and age, not on an individual's health issues. And so one of the things the Affordable Care Act did was go in and clean up some of the loopholes that HIPAA had left in place from a coverage perspective.
Erin Stein: Mm-hmm. And did HIPAA make it easier to get your own insurance policy? Or it really wasn't until Affordable Care Act that it…
Gillian Goddard: HIPAA made it easier to get accepted as an individual, but it didn't completely get rid of people getting denied as individuals. And it didn't do anything about cost for individuals. Insurance companies could, if you were a high-risk individual, they could charge you incredibly high premiums that might effectively prevent you from having health insurance because it wouldn't be affordable.
Erin Stein: Right.
Gillian Goddard: So the Affordable Care Act really went in and said we're gonna provide affordable care. Provide affordable health insurance to people who don't have employer-based insurance.
Erin Stein: Mm-hmm. Which seems non-controversial to me, yet many people have argued over this.
Gillian Goddard: Yes. Interestingly, the Affordable Care Act was actually modeled after the Massachusetts health insurance laws, which were actually implemented by Mitt Romney.
Erin Stein: Fun facts.
Gillian Goddard: Massachusetts is the first state to have universal healthcare. And they did it using a plan very similar to the Affordable Care Act.
Erin Stein: Good job, Massachusetts. Taking care of your peeps. How does COBRA fit into all of that? The other alphabet soup acronym.
Gillian Goddard: Ah, COBRA. COBRA stands for the Consolidated Omnibus Budget Reconciliation Act of 1985.
Erin Stein: Good lord.
Gillian Goddard: So COBRA predates HIPAA. It requires employers to let former employees and their dependents stay on the company's group health plans for a limited period of time. So meaning you lose your job, you are allowed to stay on COBRA for typically up to eighteen months after the end of your employment. And you stay on at the rate given to individual employees without the employer's contribution plus two percent in administrative costs.
Erin Stein: Uh-huh.
Gillian Goddard: You pay 102% of the full cost of whatever plan you were on, but you can do that for up to 18 months. And that includes you, your spouse and your dependents. It's expensive, COBRA is. So usually people transition off of COBRA as quickly as they're able to based on new jobs or cheaper options. But that is what it is, and it's been around since the mid 1980s.
Erin Stein: Didn't realize it had been around since the mid-80s. And that is meant to provide some continuity of care. Whether you can afford to take advantage of the offer or not as a separate thing since you usually just lost your job.
Gillian Goddard: Right.
Erin Stein: Some jobs, certainly not all, will cover the COBRA cost for a couple of months.
Gillian Goddard: Maybe part of your severance package if you're being laid off. Yes.
Erin Stein: Part of your severance, maybe. It was extended during COVID.
Gillian Goddard: Mm-hmm.
Erin Stein: Which was I think very nice and very helpful for many people, including myself.
Gillian Goddard: And really before HIPAA existed, COBRA was the only thing you had to kind of protect against this issue of pre-existing conditions.
Erin Stein: So pre-existing conditions is a problem.
Gillian Goddard: Mm-hmm. It was a big problem.
Erin Stein: It was a really big problem. It still can be occasionally a problem. We've addressed it, but politicians keep talking about doing things to the Affordable Care Act, getting rid of it, replacing it, changing it, whatever.
Gillian Goddard: This piece of the Affordable Care Act is the piece that is by far the most popular among all people.
Erin Stein: That makes sense to me. It seems highly beneficial for all of us.
Gillian Goddard: Feel how you feel about some of the other things. This piece, about pre-existing conditions and keeping people from being excluded because of pre-existing conditions, has pretty wide bipartisan support in part because American people like it.
Erin Stein: Okay. Now you know what it is. It's not a hippo, it's HIPAA.
Gillian Goddard: I try to remember when I get frustrated logging into my patient portal that really the reason it is frustrating to log into your patient portal is because people are working really hard to protect your private health information.
Erin Stein: Generally, I think that's true in life that all these millions of passwords and pass keys and security measures are very annoying, but they're important and they're there for a reason. And when it comes to your medical records, I'd say that's very big reason.
Gillian Goddard: Yes. Yes. And when your doctor doesn't want to give you their cell phone and you find it frustrating to try to reach them, know that it's to protect them, it's to protect you. It's to keep everybody using the appropriate channels for communicating and for everyone's safety.
Erin Stein: Yeah, so there.