How HIPAA Protects your Child’s Privacy

What does HIPAA mean, and what does it do

HIPAA is a federal law that gives you rights over your child’s health information. The law limits who can view and receive these details.

HIPAA stands for the Health Insurance Portability and Accountability Act. It covers all forms of health information. This includes details in emails, on paper, or spoken.

Details that are protected

HIPAA protects:

• Information that your child’s health care providers put in the medical record
• Conversations they have about your child’s care or treatment
• Details about your child in St. Jude computer systems
• Billing information about your child

How this Information is protected

St. Jude has safeguards in place to protect your child’s health information. These include:

• Storing paper information in locked cabinets and in rooms with locked doors
• Talking about health information only in private areas
• Storing and transmitting electronic health information securely
• Limiting employees to only what they need to know about your child to do their jobs
• Limiting who can see your child’s information
• Training staff on how to protect your child’s information

Who can see your child’s health information

Your child’s health information cannot be used or shared without your written permission unless the law allows it. For example, unless you give written permission, your health care provider generally cannot:

• Give your child’s information to an employer
• Share your child’s details with St. Jude staff who are not involved in your child’s care

HIPAA does allow your child’s health information to be used and shared without your written permission in these cases:

• To set up treatment and care
• To pay doctors and hospitals for health care
• To use for St. Jude internal operations
• With your family, relatives, friends, or others you name who are involved with your child’s health care or health care bills, unless you say no

Your rights

You have the right to:

• See and get a copy of your child’s health records, except in a few cases
• Have corrections made to your child’s health information
• Ask that your child’s information not be given out, except in some cases
• Get a Notice of Privacy Practices that tells how your child’s health information may be used and shared
• Decide whether to allow your child’s health information to be used or shared for some purposes, such as for fundraising
• Get a report called an Accounting that tells you when and why health information was shared
• Get private information in a different way or location, rather than at a home address

If your child or anyone else believes their rights are being denied or their health information is not being protected, they may file a complaint with the St. Jude Privacy Officer or with the U.S. Department of Health and Human Services, Office for Civil Rights.

How to keep health information from being given out 

Visit Patient Registration and ask for a Privacy Restriction Form.

• Fill out the form and list each person you do not want to receive your child’s health information.
• Sign the form and turn it in.

In these cases, your child’s information may be given out even if you say no:

• In an emergency. St. Jude may share your child’s health information with your family members or other people in an emergency. For example, after surgery, a surgeon may tell parents, legal guardians, or other family members about your child’s progress and health outlook.
• If the law requires it or if HIPAA allows it.
• If St. Jude is legally required to share your child’s health information with a parent. St. Jude may have to do this even if the parent does not have custody of the child, and even if the patient or primary caregiver does not want the information shared.

If you believe that sharing this information would put your child in danger, please tell a member of the St. Jude clinical staff.

For more information, read the Notice of Privacy Practices: https://www.stjude.org/legal/notice-of-privacy-practices.html