Patient Rights

Standards That Already Protect You

HIPAA, ACA coverage rules, and the No Surprises Act form a connected framework. Here's how each piece fits, in the order you'd actually encounter them.

The Framework

Three Layers, One Continuous Protection

Layer 1 — Your Records

HIPAA governs who can access, share, or request your medical record, and guarantees you a right to obtain your own copy.

Layer 2 — Your Coverage

ACA protections set a floor for what plans must cover, including pre-existing conditions and essential health benefits.

Layer 3 — Your Bill

The No Surprises Act limits unexpected out-of-network charges once care has already been delivered.

Medical privacy documents and patient forms on a desk

Medical Privacy Basics

Where Your Information Can — and Can't — Travel

HIPAA doesn't make your medical information completely private from everyone. It defines a specific, limited set of circumstances where sharing is allowed without your separate authorization.

Allowed without separate consent: sharing between your treating providers for direct care coordination.

Allowed without separate consent: billing and payment processing tied directly to your care.

Requires your authorization: most marketing use, and disclosures unrelated to your treatment or payment.

Before vs. After

What ACA Protections Changed

Without These Protections

Coverage could be denied based on a prior diagnosis
Annual or lifetime dollar limits could cap total coverage
Preventive services could carry a copay or deductible

Current Baseline Standard

Pre-existing conditions cannot be used to deny coverage
Annual and lifetime dollar limits on essential benefits are prohibited
Listed preventive services are covered without cost-sharing

Scenario Panels

When the No Surprises Act Applies

Scenario

Emergency Room Visit

Emergency care is protected regardless of network status — you generally cannot be billed above in-network cost-sharing.

Scenario

Out-of-Network Specialist at an In-Network Facility

If you didn't choose the out-of-network provider, protections generally still apply, such as an anesthesiologist assigned during surgery.

Scenario

Scheduled Out-of-Network Care

If you knowingly and willingly choose an out-of-network provider for non-emergency care, standard protections may not apply.