STD tests and privacy: records, insurance, public health

People worry about three audiences when they test: their insurer, the people around them, and the government. Each one learns about a test in a different way, and some of those ways you control. This guide walks through each one. It is general information, not legal advice.

Key points

• If you pay the testing provider directly and no claim goes to your health plan, your insurer has nothing to report on an explanation of benefits.
• HIPAA protects records held by health plans and by providers and labs that bill electronically. Not every health app or online company is covered.
• Positive results for chlamydia, gonorrhea, syphilis and HIV are reported to public health in every state. Hepatitis B and C are nationally notifiable too. This includes tests ordered online.
• Public health reports are confidential, and the data CDC receives have no names attached.
• You can let a clinician or the health department tell your partners, and they won't say who you are.

Where an STD test result is recorded

A test creates records in a few places:

• The testing provider and the lab. They keep your order, your sample record and your result.
• Your insurer, only if a claim is filed. Insurers learn about care through claims.
• Your regular doctor, only if you share it or if your doctor ordered the test.
• The health department, only for reportable infections that test positive.

HIPAA in plain terms

HIPAA is the federal law that sets rules for health information. It applies to "covered entities": health plans, and health care providers that do certain business electronically, such as billing insurance. The national lab chains are covered.

Under HIPAA you can:

• See and get a copy of your records. HHS says your provider normally has up to 30 days to provide a copy, and you can't be refused because of an unpaid bill.
• Keep a cash-paid service from your health plan. If you pay a covered provider in full out of pocket, you can ask it not to share that service with your health plan. HHS says the provider must agree unless a law requires the disclosure.
• Choose how you're contacted. You can ask for mail to a different address or calls to a different number. HHS says health plans must accommodate reasonable requests if you say the disclosure could endanger you, and may not question that statement.

Not every company that sells tests online is a HIPAA covered entity. Some health apps fall instead under the FTC's Health Breach Notification Rule, which requires certain companies not covered by HIPAA to tell customers about a breach of health information. Read a provider's privacy policy before you order, and look for who runs the lab work.

Insurance and the explanation of benefits

An explanation of benefits, or EOB, is the statement your insurer sends after it processes a claim. The Texas Department of Insurance puts it plainly: "It's not a bill. Your insurance company sends an explanation of benefits to let you know it got a claim."

If you're on someone else's plan, such as a parent's or partner's, the EOB goes to the address the plan has on file. You have two ways to avoid that:

1. Pay the testing provider directly and don't submit a claim. Several providers don't bill insurance at all. Quest's consumer site, for example, calls its tests "no insurance, no EOB."
2. Ask the plan for confidential communications, as described above.

Our cash vs insurance guide covers the cost side.

Public health reporting

Each state sets its own reporting laws. CDC says health care providers and laboratories must tell the health department when a person is diagnosed with a reportable condition. CDC's treatment guidelines state that syphilis, gonorrhea, chlamydia, chancroid and HIV are reportable in every state. Hepatitis B and hepatitis C are on CDC's list of nationally notifiable conditions.

Online orders are included. Labcorp OnDemand's test page says results "may also be provided to a local, state, and/or federal health authority," because many states require the lab to report certain infections. HIPAA allows this. HHS says covered entities may share information with public health authorities without your authorization to prevent or control disease.

Trichomoniasis, herpes, HPV and Mycoplasma genitalium are not on the national list.

What reporting means

• Your name and result go to your state or local health department. CDC says all states use name-based HIV reporting.
• Health department staff may contact you to check that you were treated and to offer help notifying partners.

What reporting does not mean

• It is not public. CDC says STI and HIV reports are kept confidential, and in most places state law or regulation protects them.
• CDC doesn't receive your name. States share case records with CDC voluntarily, and CDC says those records contain no personally identifiable information. HIV data reach CDC without personal identifiers.

Telling partners

You have options:

• Tell partners yourself.
• Ask your clinician or the health department to tell them. CDC's guidelines say patients can authorize a provider or public health professional to notify partners. CDC's partner services recommendations say that when staff notify partners, the identity of the original patient "must never be revealed."
• Ask about expedited partner therapy for chlamydia or gonorrhea, where your clinician gives you medicine or a prescription for your partner. CDC lists it as permissible in 49 states.

Practical steps

• Before ordering, read the provider's privacy policy and check whether it bills insurance.
• Use an email address and phone number you check privately.
• Keep your itemized receipt somewhere private if you plan to use an HSA or FSA.
• If you're on someone else's plan and want to use insurance, ask the plan about confidential communications first.