by Alexandra de Scheel, Citizens’ Council for Health Freedom
After our first post — 23 Years Without Medical Privacy in America — your questions started coming in immediately.
Diane wants to know if a physician can legally refuse to see her if she refuses to sign the HIPAA form—and what alternatives she has.
Suzette has already signed and wants to know if she can take it back.
Debbie asked how to find an app to opt out of consent.
Ian asked how he can deny access to his vital data.
These are questions every patient should be asking. So, let’s answer them.
HIPAA does not require you to sign the acknowledgement statement, and no law or rule instructs or permits your doctor to deny care if you refuse.
So, the short answer is no. However, some clinics and doctors may refuse to see you because their attorneys have told them they can be charged by the federal government with a very expensive HIPAA violation if they do not get your signature. However, this is not true.
Here are the facts:
The federal HIPAA rule only requires providers to make a “good faith effort” to obtain your signature on the Notice of Privacy Practices (NPP) acknowledgement statement (“HIPAA form”). As the Notice of Privacy Practices web page on the U.S. Department of Health and Human Services (HHS) website states:
“The law does not require you to sign the ‘acknowledgement of receipt of the notice.’”
The same HHS page adds: “If you refuse to sign the acknowledgment, the provider must keep a record of this fact.”
The federal rule requires THE STAFF to document your refusal; YOU don’t need to do anything. The rule also says nothing about allowing doctors to deny care.
When a chiropractor told a patient “It’s the law” after she refused to sign, she was turned away. It wasn’t the law; it was a misrepresentation of the law — one that HHS’s own website contradicts.
The best way to get the care you need without signing the statement is to go to the HHS web page and show it to the staff on your phone. Once they see bullet #1 (the law does not require) and bullet #4 (if you refuse), their demands and claims of denial usually disappear. Find the HHS web page at: https://bit.ly/HIPAAHHS.
If a provider denies you care because you refuse to sign, you can file a HIPAA complaint with the HHS Office of Civil Rights. That is the only federal remedy.
Many people assume that signing the HIPAA form ensures that their medical data is kept confidential between themselves and their doctor. This is not the case.
The Notice of Privacy Practices is a notice of disclosure practices — a list of all the ways your data can be shared without your consent. Signing it doesn’t stop any sharing of your information. It only confirms that you received the notice. Refusing to sign doesn’t change the outcome either, because HIPAA permits the sharing whether you sign or not—unless your state has passed a state medical privacy law that protects you from HIPAA.
What signing does accomplish is simple: you are exercising your right to refuse to participate in the government’s deliberate deception called HIPAA.
Once you have signed an acknowledgement of receipt, you cannot un-sign it. This is of no concern. The acknowledgement only states that you received the notice — it doesn’t grant new permissions for your data that didn’t exist before. Your data was already subject to HIPAA’s permissive sharing rules the moment you became a patient (unless your state has passed a state medical privacy law). Getting you to sign it is simply part of the ruse to convince you that you have privacy when you have none.
The practical next step is to refuse to sign going forward. The form or acknowledgment statement appears at registration — not just once, but at each new doctor’s office, annual visits, and hospital admissions. Each visit is a new opportunity to refuse.
The CCHF Refuse to Sign HIPAA card is a wallet-sized reference you can carry and present at check-in, but the “show them the HHS website on your phone” method works the best!
The request to sign the HIPAA form almost never happens in the exam room itself. However, when it comes to actually refusing to sign in the front office, take these steps:
As noted above, the simplest method is to use your phone.
Open the HHS Notice of Privacy Practices page at https://bit.ly/HIPAAHHS or screenshot it before you go.
Show the staff the first bullet: “The law does not require you to sign the ‘acknowledgement of receipt of the notice.”
Show the fourth bullet: “If you refuse to sign the acknowledgment, the provider must keep a record of this fact.”
For many front-desk staff, seeing it on the government’s own website ends the argument.
The form—actually the Notice of Privacy Practices (NPP) acknowledgement statement—can appear in different ways. Typically, you are being asked to say that you have either understood, received, or read the NPP. In all the following forms or technologies, look for the words “Notice of Privacy Practices”:
A separate paper form with a single line asking you to acknowledge the NPP. Decline to sign and explain why (show on your phone).
A consolidated consent form where the NPP acknowledgement is buried alongside consent for treatment, consent to be billed, data sharing agreements, and much more—with only one signature line. Cross out the NPP statement specifically. Take a photo before and after.
The full NPP document listing all the ways your data can be shared without your consent (often 2-4 pages long) where you’re asked to sign at the bottom of each page. Decline to sign any page.
An electronic tablet where you’re asked to click “I agree.” Take the tablet to the clerk and tell them you respectfully opt out. If they say the system won’t allow registration without the click, ask for paper forms instead. If they refuse to give you paper forms, ask for the manager. If the manager refuses, ask for the supervisor. By this time, you should have the HHS web page on your phone, ready to share.
An electronic signature pad, the small, 5x5-inch pad where staff hand you a stylus and tell you it’s the HIPAA form. Tell the clerk you never sign anything you haven’t read. Ask for a paper copy and then refuse to sign it. They must give you a paper copy. They cannot force you to sign sight unseen.
In every scenario: take a photo of the blank form, cross out only what you refuse, take a photo after, and ask for a copy of what you signed. Consider sending a copy of the blank form to CCHF (info@cchfreedom.org).
Practically speaking, nothing.
David Brailer, the first-ever and now former National Coordinator for Health IT, said this about HIPAA: “You can’t force a covered entity to give your data to someone you choose, and you can’t stop them from giving it to someone they choose.”
Whether you sign the HIPAA acknowledgement form or not, your private data can be shared in every way listed in the Notice of Privacy Practices (often with your name, address and more), unless your state legislature has enacted a state medical privacy law that protects you from HIPAA.
The signature request is part of a clever ruse. HIPAA permits the sharing of your data regardless of your signature. HIPAA allows you to request restrictions on data sharing, but providers generally do not have to honor the request (45 C.F.R. § 164.522).
Under HIPAA, 2.2 million entities can access your medical records without your consent if those holding your records choose to share them (Federal Register, Vol. 75, No. 134, July 14, 2010, pages 40872, 40906–40911). That number includes health plans, business associates, researchers, lawyers, corporations, and others whose connection to your care may be indirect or nonexistent. Government agencies can access your data under the rule’s 12 National Priority Purposes.
Yes.
First, you exercise a legal right that most patients don’t know they have.
Second, you refuse to participate in the deception that HIPAA and the NPP protect your privacy. Signing it signals — to the clinic, to the system, to the public — that what the federal government has told us is true, is actually patently false. HIPAA eviscerated privacy rights.
Third, you inform clinic and hospital staff of the truth. Many front-desk employees genuinely believe your signature is required by federal law. When patients refuse and show them HHS’s NPP website, it changes forever what those employees know and what they might tell their team and the next patient. They may even do the right thing and change the form to tell you your signature is not required, as some clinics have.
Fourth, you prevent the clinic from using the signed form against you. If your confidential information is later shared without your knowledge, a practitioner can point to your signature and say you were notified. You were told you have no privacy. It’s your fault you shared confidential information. Refusing to sign removes that argument.
Fifth, every patient who refuses is part of a larger effort to restore patient privacy and consent rights in America. CCHF is working to rescind the HIPAA rule, forcing practitioners and health care corporations to abide by the longstanding, legally-enforceable privacy laws and consent requirements that were in place in every state before HIPAA. This effort is stronger when patients refuse to participate in the deception.
Under HIPAA as currently written, full stoppage is not possible.
But you can take four meaningful steps.
Pay cash when possible. Federal law gives you one binding privacy right over your data. Under 45 C.F.R. § 164.522(a)(1)(vi), a covered entity must agree to restrict disclosure of your health information to a health plan if the service was paid for in full out of pocket and the disclosure would be for “payment” or “health care operations.” That means if you pay the full cost of a visit or service directly — no insurance or government billing — and you request the information not be disclosed, your doctor cannot send that information to your health plan.
NOTE: this restriction only applies to your health insurer, not to government agencies. Your doctor can still share information with the federal government under other regulatory or HIPAA provisions.
Find a doctor outside the network. Doctors who maintain paper records, have direct-pay relationships only, operate outside corporate health systems, and are not connected to state health information exchanges (HIEs) or the national eHealth Exchange have more limited data-sharing infrastructure.
CCHF’s direct-pay physician directory, JoinTheWedge.com, connects patients with independent, cash-based practices nationwide.
Ask your state legislators for a real state privacy law. State medical privacy laws supersede HIPAA, in essence, protecting you from HIPAA. The federal HIPAA rule explicitly yields to stronger state laws (45 C.F.R. § 160.202). Most state legislatures have not enacted stronger laws because legislators incorrectly assume HIPAA already protects patient privacy. Contact your state legislators and ask for a state medical privacy law — one that requires patient consent before data is shared.
Refuse to answer unrelated questions. Questions about housing, food access, social relationships, gun ownership, and mental health that appear at clinic check-in are not medical questions. They are data collection tools, often created by corporations or the federal government. Some questions may be part of the government initiative to collect Social Determinants of Health (SDOH) data on every patient. You have no legal obligation to answer them. Politely decline.
Yes.
CCHF has been working to expose HIPAA as a permissive disclosure rule, not privacy protection. Our efforts have led Americans across the country to refuse to sign the HIPAA form or acknowledgement statement. As a result, more clinics are learning the truth about HIPAA and the truth about your right not to sign the statement or participate in the deception.
Increasingly, clinic forms either explicitly say that you are not required to sign the NPP acknowledgement statement, or they include a section for the staff to record your refusal. Over the past five years, CCHF has received fewer complaints of Americans being denied access to care for refusing to sign the statement.
The HIPAA deception is deep, but in an encouraging sign, more people across the country refusing to sign is bringing truth and the right not to sign to the surface.
CCHF advocates at the federal level for rescission of the HIPAA rule and restoration of the legal protections every patient had before HIPAA took away their privacy rights. At the state level, CCHF supports legislation requiring true consent before health data is shared. The CCHF online legislative library provides model legislation states can use to write their own medical privacy laws.
April is Truth About HIPAA Month at CCHF.
Every year, CCHF uses this month to educate patients, equip them with tools, and push back against the now 23-year-old deception that “HIPAA” and “privacy” mean the same thing. The momentum is building. Join the movement by refusing to sign HIPAA.
No posts
Comments
Nothing yet. Say the first thing.
Sign in to join the conversation.