The Health Insurance Portability and Accountability Act protects Americans with health-related conditions from exclusions, limitations and discrimination in group health coverage. It also imposes confidentiality rules on medical professionals regarding patients’ records. Indeed, cyber thieves see data as a commodity, and patients’ digital medical records are 50 times more valuable than financial information, according to security experts. Civil penalties for breaking HIPAA rules range from $100 for an unknowing violation to $1.5 million for willful neglect.

In 2020, the HIPAA Right of Access Initiative was launched. Its purpose was to enforce a patient’s right to get access to their medical records promptly and in a readily producible format of their choice, without being overcharged.

Preexisting conditions

One of the most crucial parts of HIPAA is that it redefines the phrase “preexisting conditions.” A patient is considered to have a preexisting condition if they have received medical advice, a diagnosis, care or treatment in the six months prior to enrolling in their current health plan. Insurers may then refuse to cover a patient for that condition. However, HIPAA places a six-month lookback limit on identifying preexisting conditions. In other words, if you’ve had a condition for longer than six months, the condition is not considered preexisting and you cannot be excluded from coverage on that basis.

More broadly, HIPAA limits the ways companies can exclude coverage:

Pregnancy is no longer considered a preexisting condition. You can switch group health plans while pregnant without risking a break in coverage.
Your health plan or insurer can’t apply the preexisting condition exclusion when you adopt or give birth to a baby who’s been enrolled in a health plan within 30 days of birth, adoption or placement for adoption. The adopted child or child placed for adoption must be younger than 18.
Genetic information can’t be treated as a preexisting condition in the absence of a diagnosis. State law may provide additional protections.
For those who have a preexisting condition, HIPAA imposes a shorter exclusion period than was in force previously. That is, people can get covered faster than before. The maximum exclusion period is generally 12 months from the date you enrolled in the plan.
Job changers are protected. That is, you can switch jobs without fear you’ll lose coverage for certain conditions. If you switch from one group health plan to another, you won’t face new exclusions due to preexisting conditions, provided the break in your health coverage is no longer than 63 days.

HIPAA offers several other protections. For example, patients may not face discrimination based on health and may not be excluded from coverage or charged more for coverage because of their health status.

This is just a summary of a complicated series of rules and regulations. There are many additional provisions and exceptions. If you are facing health discrimination issues or are concerned about a possible privacy violation and not getting a satisfactory response, be sure to consult qualified legal advice.