Alaska's privacy protection: HIPAA and beyond

You have probably heard someone say "that's a HIPAA violation!" when a neighbor gossips about a health problem, or when a boss asks why you called in sick. It sounds right. It feels right. But in most of those cases, it is completely wrong. Understanding the difference between HIPAA and Alaska's other privacy protections could save you a lot of frustration.

The Health Insurance Portability and Accountability Act (HIPAA) became law in 1996. It requires safeguards to prevent unauthorized access or misuse of sensitive health information. HIPAA applies to healthcare providers, insurers, and other organizations handling patient data. That list is much shorter than most people realize. The individuals and organizations subject to HIPAA's Privacy Rule are called "covered entities." They include healthcare providers, health plans, and healthcare clearinghouses.

HIPAA does not cover entities that are not healthcare providers, health plans, or healthcare clearinghouses and do not otherwise meet the definition of a business associate. This includes employers, life insurance companies, many schools and school districts, many state agencies, and many law enforcement agencies. So if your boss asks why you missed work, or your neighbor posts online that there was an ambulance at your house, HIPAA simply does not apply. Those situations may feel like privacy violations, but they are not HIPAA violations.

In Alaska, residents have a layer of privacy protection that goes far beyond what federal law provides. Most people do not know that the Alaska Constitution itself includes this protection, and it touches nearly every part of your life.

The Alaska Constitution plainly states that the people have a right to privacy. Unlike the United States Constitution, the Alaska Constitution expressly safeguards privacy rights. It was added by voters in 1972, making Alaska one of the first states in the country to put privacy into its constitution.

Alaska courts have decided that the constitutional right to privacy actually contains two separate protections. The first is the right to personal autonomy, which protects the right to make personal choices relating to one's own life. The second protection allows individuals to shield their personal information from public disclosure, safeguarding sensitive data that might cause anxiety, humiliation, or harassment if revealed. That second protection is where things get interesting, because it can apply to health information in ways that HIPAA simply does not.

The constitutional right to privacy restricts how state and local agencies collect, store, and share personal data about Alaska residents. If any government agency were to improperly access or share your personal health information, the Alaska Constitution provides you with a direct legal argument against them.

Beyond the constitutional right, Alaska has also enacted specific legislation to further protect residents. Alaska Statute 45.48 requires businesses to protect the personal information they collect, and it specifically covers medical information. If a company fails to protect consumers' personal information or violates the state's data privacy laws, consumers can file a complaint with the Attorney General's office. The Attorney General can investigate and take action, and individuals also may file their own lawsuits for damages.

Both HIPAA and Alaska's privacy laws protect your privacy. The key difference is reach. HIPAA protects you from your doctor or health insurer sharing your records without permission. Alaska's constitutional right protects you from your government doing the same, while state statutes give direction to private businesses. Together, they create a web of protection that covers both private settings and the actions of public agencies.

To file a HIPAA complaint, visit hhs.gov/hipaa/filing-a-complaint. Complaints must be filed in writing by mail, fax, email, or through the OCR Complaint Portal, and must be filed within 180 days of when the violation occurred.

For violations of Alaska's state privacy protections, contact the Alaska Attorney General's office at attorney.general@alaska.gov, or visit the Alaska Department of Law's website at law.alaska.gov.

Christian M. Hartley is a 40-year Alaskan resident with over 25 years of public safety experience and public service. He runs a freelance business, Big Lake Writer, from home in Big Lake that he shares with his wife of 19 years and their three teenage sons.