The Health Insurance Portability and Accountability Act (HIPAA) has been a popular reference when the subject arises of disclosing one's COVID-19 vaccination status.

A common thought has been that HIPAA protects the everyday person from disclosing their own medical history and the issue was brought up during L.A. Public Health's most recent virtual town hall.

What Is HIPAA

HIPAA regulations cover health plans, most health care providers, health care clearinghouses (third party systems that interpret claim data between providers and insurance payers).

During the L.A. Public Health town hall, an Angeleno explained a situation where a relative pointed to HIPAA when asked about their vaccination status, saying they did not have to disclose their vaccination status.

"We ask each other, as family, all kinds of questions and we don't have to tell, but it's not because of HIPAA," L.A. Public Health Officer Dr. Muntu Davis said. "It's actually a federal law that requires some standards to protect sensitive patient information and it really applies to individuals and organizations who are health care providers... and those that work with them, say, like an insurance company to process claims for health care."

Davis added that HIPAA does not apply to a family or friend that "doesn't want to answer your question."

How Does HIPAA Help Patients

The U.S. Health and Human Services explain that HIPAA gives patients certain rights, such as:

• Owning a copy of their health records
• To request information not provided in the health records
• Request that a mistake in the record be corrected
• Submit written statements of disagreement with information in your record
• Know how your health records are used in shared

What Can and Cannot Be Done With Your Records

Health records may be shared among doctors when working together on a patient's treatment plan. Record information can be used when assessing data to report things such as the flu in any given area.

Patient information cannot be given to employers without your permission and at any point, one may ask to see who has seen or accessed their information through an "Accounting of Disclosures." Patients may also request that record information not be shared with specific people or organizations.

Right To File A Complaint

If a patient feels the rights above have been violated, a complaint can be filed within 180 days of the incident. The complaint may be filed by mail, email, fax, or the Office for Civil Rights portal.