Keeping Treatment Communications Private
If you share insurance, a phone, mail or a patient portal, ask how treatment messages and billing information will reach you. Make separate arrangements with the provider and health plan; one request may not cover both.
To print this guide, use your browser’s Print command.
No email or account is required. Use the PDF or printed spaces for private notes. This guide does not collect worksheet answers. Save and reopen a completed PDF to check your notes.
HIPAA applies to covered health providers and health plans, with defined rules and exceptions. It does not mean that every person, app or document is protected in the same way. Ask the privacy officer who can access messages, records and billing information in your particular situation.
Sources: [1]
Sources: [1]
Check Each Route
| Where information may appear | Question to ask |
|---|---|
| Phone calls and voicemail | Which number can you use? What may a message say? Can you record my preference? |
| Mail and insurance notices | Where will bills and explanations of benefits go? How do I request confidential communications? |
| Email, text and portals | Which account receives notifications, and who has proxy or shared access? How do I review or change it? |
| Forms releasing information | Who receives what information, for what purpose? How can I change or revoke a permission, and what are the limits? |
Some substance-use treatment records receive additional protection under 42 CFR Part 2. That rule applies to records from federally assisted Part 2 programs, not automatically to every mention of substance use in every medical record. The updated rule allows a single consent for future treatment, payment and health care operations. Ask whether the program is covered and what the consent you are signing permits.
Sources: [2]
Sources: [1]
Private Communication Plan
- Provider arrangements
- Safe contact method; message wording; privacy officer; date requested and confirmed.
- Health-plan arrangements
- Requested address/method; process and forms; who confirmed the change and when it applies.
- Accounts or permissions to check
- Portal proxy access, shared email, release forms or an unanswered question. Do not record passwords here.