HIPAA establishes national standards for protecting health information through the Privacy Rule, Security Rule, and Breach Notification Rule. It applies to covered entities including providers and health plans, and to their business associates.
The Privacy Rule permits disclosure for litigation through patient authorization, a qualified protective order, or a subpoena accompanied by specified assurances.
Alternative Names:
Health Insurance Portability and Accountability Act
Why it Matters?
HIPAA does not bar discovery of medical records, but it dictates the mechanism, and getting it wrong stalls record collection. A subpoena alone is insufficient without either satisfactory assurance that notice was given or a qualified protective order. Law firms handling medical records are business associates with direct compliance obligations, which firms frequently overlook when treating HIPAA as their client's concern.
Frequently Confused with
Related terms
Frequently asked questions
Does HIPAA prevent discovery of medical records?
Are law firms subject to HIPAA?
