What is HIPAA?
HIPAA stands for the Health Insurance Portability and Accountability Act of 1996. This law requires certain entities that provide or pay for health care (such as hospitals, insurance companies, and government health plans like MassHealth) to standardize the way they exchange health information. HIPAA also requires the health entities that must comply with its provisions (covered entities) to set up certain protections for the security and privacy of certain health information.
How does HIPAA affect me?
HIPAA, also known as the Privacy Rule, went into effect on April 14, 2003. The Privacy Rule limits how MassHealth and other covered entities may use and share your protected health information (PHI). It also provides you with certain rights concerning your PHI.
What is PHI?
PHI is any information that:
- has to do with the physical or mental health of an individual, the provision of health care to an individual, or the payment for health care for an individual, and
- identifies the individual, or can be used to identify the individual.
What are my rights under the Privacy Rule?
You have the right* to:
- See and get a copy of your PHI.
- Ask MassHealth to change your PHI if you think it is wrong or missing information.
- Ask MassHealth to limit the use or sharing of your PHI.
- Ask MassHealth to get in touch with you in some other way, if reaching you at the address or telephone number that we have on file for you would put you in danger.
- Get a list, with certain exceptions, of when and with whom MassHealth has shared your PHI.
- Get a paper copy of our Notice of Privacy Practices at any time. The Notice is also available for download on the Web.
*These rights may not apply in certain situations.
How do I get in touch with MassHealth about these rights?
You must ask in writing and mail this request to:
MassHealth
Privacy and Security Office
600 Washington Street, 7th Floor
Boston, MA 02111
I'm a senior...can my children or others still call MassHealth for me with questions?
- If you want MassHealth to share your information with someone, you may give MassHealth verbal permission to share your information over the telephone, once you verify your identity. However, you must be present with that person during the call. In this case, your permission will only be good for that call, and MassHealth will not be able to share your information with that same person on future calls unless you are present and give your verbal permission again.
- If you want MassHealth to share your information with someone whenever they call without you being present, MassHealth needs to have your permission in writing. You will need to fill out a MassHealth Permission to Share Information form (PSI), which you can find on the HIPAA forms for MassHealth Members page. On this form, you must be clear about the types of information you want MassHealth to share, and for how long. If you give this permission, you can change it later, but each change must also be in writing. Once you fill out the PSI you should mail it or fax it to the MassHealth Enrollment Center nearest you.
- If you want another person to act on your behalf as your representative for eligibility purposes (including the right to sign MassHealth forms on your behalf and change your information), then you must complete an. The person you name on this form will have all the rights you have to information about your eligibility.
What should I do if I feel that MassHealth has wrongfully given my PHI to others without my permission?
MassHealth takes your privacy very seriously. If you feel that MassHealth has violated your privacy rights, contact Office of Medicaid Privacy and Security Office, in writing at:
MassHealth
Privacy and Security Office
600 Washington Street, 7th Floor
Boston, MA 02111
You may also file a complaint with the U.S. Secretary of Health and Human Services. Filing a complaint or exercising your rights will not affect your MassHealth benefits.
Can MassHealth release my PHI without my permission?
MassHealth is permitted to use or share your PHI for certain purposes without getting your permission, such as for activities involved in running the MassHealth program or paying your health-care providers for services you receive. There are also times when MassHealth is required by law to release your information. MassHealth does not need your permission to do this.
Can I keep my same doctor?
The Privacy Rule does not affect your choice of doctor.
Will I lose any services that I now get?
The Privacy Rule will not change your MassHealth benefits.