There is no universal privacy law; this is a common misunderstanding of HIPAA.
HIPAA only applies to health care providers, health plans, and what HIPAA calls "health care clearinghouses", that is, those that transmit payment information electronically. It does not include employers, medical boards, the courts, or insurers. It is not a HIPAA violation when you authorize release of your medical information.
HIPAA has many exceptions to protected health information, including details that identify you. You don't have the right to object when your information is used for treatment, payment, or operations, including disclosures to business associates of your health care provider or plan.
The flow of your medical information is also beyond your control when the disclosure is made by a covered entity to or in connection with:
- disclosure required by federal, state, or local regulation,
- public health authorities/interests
- FDA
- DEA
- if you may have been exposed to a communicable disease
- an employer to conduct workplace medical surveillance or to evaluate whether you have a work-related illness or injury
- victims of abuse, neglect or domestic violence.
- in response to a court order, subpoena, or discovery request
- collection agency for unpaid medical bills.
- coroners and medical examiners.
- funeral directors.
- Organ procurement organizations.
- institutional review board approval.
- if you are a threat to public safety or public health; disclosure may be made to family members, employers, school admins, police, etc.
- U.S. and foreign military commanders.
- U.S. Department of Veterans Affairs to determine eligibility for benefits
- U.S. Department of State to verify health fitness of employees and their families for foreign duty.
- Correctional institutions involved in health care of inmates.
- workers compensation uses authorized by state law.
- Law enforcement access is authorized in a number of ways under HIPAA. In some cases information may be disclosed without a warrant or court order.
HOWEVER, HIPAA does state that special requirements exist for psychotherapy notes. Psychotherapy notes should not be disclosed to others without your authorization. There are exceptions if the notes are used for such purposes as training staff or to defend the doctor or health plan in court. Interestingly, you can be denied access to your own records, including psychotherapy notes or information compiled for lawsuits. Your request can also be denied if the provider decides the information you want could reasonably endanger your life, your physical safety or that of another person.
So, bottom line is that you have to self-report and every application I've seen asks for your authorization to access your records, "do a background check" etc. I would imagine this is a condition of employment, licensing, credentialing, etc. and that failure to do so would raise sufficient red flags.
