About Public Health
Careers at DOH
County Health Department Administrators/Directors
Disease Control and Health Protection
Emergency Preparedness and Community Support
Health Promotion and Health Policy
Public Health Clinical Practice
Careers at the Department of Health
Public Meetings, Comments and Records
Documents for Public Comment
Administrative Functions
Agency Clerk
Contract Administrative Monitoring
Florida Vital Check
FDOH Organization Chart
State and Community Health Reports
SHIP Process
The Health Management System (HMS)
Deputy Secretary for Children's Medical Services
Deputy Secretary for Operations
Deputy Secretary for County Health Systems
​Deputy Secretary for Health
CHD Leadership
Patient Rights and Safety
Do Not Resuscitate
Legislative Planning, Office
125 Years of Florida Public Health
Florida Public Health Exhibit
Governor's Proclamation
Historical Links
Historical Podcasts
Public Health Heroes
State Health Officers 1889–2014
HomeAbout the Department of HealthAbout UsPatient Rights and SafetyHIPAA
Health Insurance Portability and Accountability Act
DOH'S HIPAA INFORMATION PRIVACY AND SECURITY
In 1996, Congress passed the Health Insurance Portability and Accountability Act (HIPAA). One component of HIPAA was to streamline the process to exchange information and to make health information more readily accessible to patients.
The HIPAA Privacy Rule went into effect it April 2003 and created a federal standard for protecting the privacy of health information. The Privacy Rule also requires DOH to comply with Florida laws that provide greater protection to patients.
HIPAA and You
The Privacy Rule, generally prohibits the use and disclosure of health information without written permission from the patient. The Privacy Rule also gives patient's rights to access their medical and billing records, request amendments to those records, and obtain an accounting of disclosure of protected health information. The Department's Notice of Privacy Practices further describes the use and disclosure of patient medical information and how patients may obtain access to their information.
What does the Privacy Rule require?
The Privacy Rule prohibits the use or disclosure of protected health information or PHI, unless the patient has signed an authorization to disclose PHI.
What is PHI?
PHI is defined as any health information created or received by a health care provider that: (1) identifies and individual; and (2) relates to that individual's past, present, or future physical or mental health condition or to payment for health care.
Protected health information includes information in any form or medium, from a paper medical record to a conversation between colleagues consulting on the care of a patient.
What is the Notice of Privacy Practices?
The Notice of Privacy Practices explains to patients the ways DOH is allowed to use a patient's protected health information and lists the rights patients have with respect to their health information.
What is an Authorization to Disclose?
A written document signed by the patient giving permission for a health care provider to disclose PHI to specified individuals and/or entities.
A patient's authorization to disclose is not required for the following purposes:
For the treatment of a patient
For payment of or billing for services
For health care operations (for example, quality assurance, credentialing, audits, compliance monitoring)
Protected health information may also be provided to patient caregivers (for example family members) but only if the patient expressly agrees or impliedly consents.
Certain disclosure may also be made by a health care provider without patient authorization to accomplish public health activities and other permitted uses as set forth in the Privacy Rule.
HIPAA Questions and Complaints
The following is a list of commonly asked questions that should be directed to the Department of Health and Human Services, Office of Civil Rights at 202-619-0257 or toll free at 877-696-6775
What is HIPAA and what are my rights?
How do I file a HIPAA complaint against my health care provider
What do it do if my doctor will not give me my medical records?
If I am a health care provider, how do I comply with HIPAA?
If you believe your privacy rights have been violated by a DOH employee, you may file a complaint with the Department of Health's Inspector General at 4052 Bald Cypress Way, BIN A03/ Tallahassee, FL 32399-1704/ telephone 850-245-4141 or with the Secretary of the U.S. Department of Health and Human Services at 200 Independence Avenue, S.W./ Washington, D.C. 20201/ telephone 202-619-0257 or toll free 877-696-6775.
The complaint must be in writing, describe the acts or omissions that you believe violate your privacy rights, and be filed within 180 days of when you knew or should have known that the act or omission occurred. The Department of Health will not retaliate against you for filing a complaint.
Forms and Notices
Authorization to Disclose Confidential Information
Request for Accounting of Disclosures
Request for Confidential Communication by Alternative Means or Alternative Locations
Request to Amend Protected Health Information
Public Health Activities
HIPAA and Disease Reporting Requirements
HIPAA privacy standards and public health disease reporting.
HIPAA and Newborn Screening Requirements
Disclosure of newborn screening information result request form.
HIPAA and Poison Control Centers
This letter relates to providing health information to the Poison Control Centers.