The federal health-privacy law, per HHS: providers, insurers, and their partners cannot share your identifiable health information without your written authorization - with narrow exceptions for treatment, payment, operations, and specific public-interest carve-outs.
Your rights: see and copy your records (30-day response), request corrections, get some disclosure accounting, complain to HHS. The surprises - not covered: most employers, health apps not tied to a provider, authorizations you sign, and what you share yourself. The daily-work rights: your records are yours to see, and sharing them needs your say-so.
What to do
Common questions
What is HIPAA and what does it protect?
HIPAA - the Health Insurance Portability and Accountability Act - is the federal law that keeps your health information private, per HHS. Who it binds: healthcare providers, health insurers, and their business partners (billing services, hospital systems). What it protects: your identifiable health information - diagnoses, records, test results, even the fact that you are a patient. The core rule: covered parties cannot share your information without your written authorization, with narrow exceptions - treatment (your doctors talking to each other about your care), payment, healthcare operations, and specific public-interest carve-outs (public health reporting, court orders, imminent danger). Your own rights under it: see and get copies of your records (they can charge reasonable copying costs and must respond within 30 days), request corrections, get an accounting of some disclosures, and file complaints with HHS. What HIPAA does NOT cover - the surprises: most employers (your boss asking about your health is a different legal area), health apps and wearables that are not tied to a provider, life insurance applications you authorize, and anything you share yourself. The practical takeaway: your records are yours to see, and your doctor sharing them needs your say-so - those two rights do most of the daily work. Pymander, a free AI doctor available 24/7 by text, can help with specific situations.