MB is tired of correcting people about HIPAA.

Doctors quote it wrong. Hospital managers quote it wrong. Front-desk staff quote it wrong. Your uncle at the barbecue quotes it wrong. HR compliance videos quote it wrong. And the collective result is that a rule Congress passed in 1996 to protect patient privacy has become a phrase used to shut down conversations that HIPAA was never meant to shut down.

This piece settles it. Not comprehensively the HIPAA rules take up hundreds of pages of federal regulation. But well enough that when someone says ‘you can’t ask that, that’s a HIPAA violation,’ you will know whether they are right, wrong, or somewhere in between. Usually somewhere in between. Usually leaning wrong.

The Receipts

HIPAA stands for the Health Insurance Portability and Accountability Act of 1996. It was originally passed to protect health insurance coverage for workers changing jobs. The privacy rules everyone quotes came later in 2003, when HHS issued the Privacy Rule under HIPAA’s authority. The Security Rule followed in 2005. Both live in federal regulation at 45 CFR Parts 160 and 164.

Here is what HIPAA actually does. It regulates how ‘covered entities’ defined in the law as health plans, health care providers, and health care clearinghouses handle ‘protected health information,’ called PHI. Covered entities have obligations. Their ‘business associates,’ meaning anyone who handles PHI on their behalf, have obligations. PHI can only be used or disclosed for specific purposes: treatment, payment, and health care operations, plus a few other categories with specific requirements.

Here is what HIPAA does not do. It does not stop anyone who is not a covered entity or business associate from talking about anyone else’s health information. It does not apply to you personally when you talk about your own health. It does not apply to your friend when she tells another friend about your surgery. It does not apply to your employer’s HR department outside of specific circumstances. It does not apply to journalists, unless they obtain PHI improperly from a covered entity. It does not apply to your church group, your workout group, your extended family, or the TSA agent who sees your prescription bottle. HIPAA regulates a specific category of entities. It does not regulate everyone.

What Most People Get Wrong

The first misconception: that HIPAA gives you a general right to privacy about your health. It does not. HIPAA gives you specific rights against specific entities. You can still be gossiped about. Your employer can still ask about accommodations. Your co-workers can still see you at the doctor. That is not a HIPAA violation. That is life.

The second: that a hospital worker cannot access your chart. Some can. Under HIPAA, ‘workforce members’ including employees, volunteers, and trainees can access protected health information as needed for treatment, payment, or health care operations. Access is stratified by role and logged. Improper access is a violation. But routine access by clinical and administrative staff performing their jobs is not a violation it is exactly what the law permits.

The third: that your family cannot get information about you without your consent. They usually can, in specific circumstances. HIPAA allows covered entities to share information with family members involved in your care unless you object. If you want your family kept out, you have to tell your provider. Silence gets interpreted as consent.

The fourth, and this is the one that matters most: that saying ‘HIPAA violation’ makes a conversation stop. It does not. If the person you are speaking to is not a covered entity or business associate, they are not bound by HIPAA at all. If they are, they may or may not be violating it that depends on the specific circumstance, the specific PHI, and the specific rule. ‘HIPAA violation’ is not a spell. It is a legal term of art with specific application.

What This Means For You

If you are a patient:

You have real rights. You can request your complete medical record. You can request an accounting of who has accessed your information. You can request corrections to your chart. You can file a complaint with HHS Office for Civil Rights if you believe your PHI has been improperly disclosed. Do not let staff tell you HIPAA prevents them from giving you your own information. It does the opposite.

If your family wants information about your care and you want them to have it tell your provider. Sign the authorization form. If you do not want them to have it also tell your provider. Neither is automatic.

If you are a hospital worker:

Access what you need for your job. Do not access what you do not. Chart audits catch employees who look at family members, celebrities, coworkers, or ex-partners and those employees get terminated. Access logs are real. If you are uncertain whether your access to a specific chart is appropriate, ask compliance BEFORE you look, not after.

When patients or families ask questions and you are not sure whether HIPAA permits an answer, ask your compliance officer. Do not default to ‘I can’t tell you that because of HIPAA.’ Half the time you can. Learning which half is your job.

If you are neither a patient nor a hospital worker:

You cannot violate HIPAA because HIPAA does not apply to you. You can still be rude for gossiping about someone’s health. You can still be sued for defamation for making up medical claims about someone. But those are different things than a HIPAA violation. Words matter. Legal terms mean specific things.

The MB Take

HIPAA has become a shorthand in American public conversation for a general right to health privacy that does not exist in American law. That gap between what people think HIPAA does and what HIPAA actually does creates real harm. It confuses patients who could exercise their rights but do not know they have them. It empowers staff who invoke HIPAA to avoid answering questions they could legitimately answer. It gives employers cover for policies HIPAA neither requires nor permits. And it fuels a cottage industry of compliance theater that costs Black patients specifically because when a system defaults to ‘we can’t tell you that,’ the patients who lose most are the ones already fighting to be heard.

MB is not telling you HIPAA is bad. HIPAA does important work. MB is telling you HIPAA is misunderstood, and that the misunderstanding costs you. Read the actual rule. Ask real questions. Do not accept ‘HIPAA’ as a conversation-ender when it is being used to hide something.

The next Blueprint 101 opens the Hospital Policy By Role sub-series because the same HIPAA rule applies radically differently depending on which seat you hold in the hospital. That is not a design flaw. It is how the system was built. And it is why most conversations about HIPAA go sideways within the first sentence.

Where To Learn More

• HHS Office for Civil Rights — HIPAA resources — hhs.gov/hipaa

• 45 CFR Parts 160 and 164 (the actual regulatory text — free to read online)

• HHS ‘Your Rights Under HIPAA’ patient-facing summary — hhs.gov/hipaa/for individuals

• File a HIPAA complaint — hhs.gov/hipaa/filing-a-complaint

Public health, reimagined. · www.melaninblissmedia.com · Not a brand. A blueprint.