The Privacy Rule gives patients rights over their own health information. You do not have to process every request yourself, but you must recognize a request and send it to the right place quickly, because the deadlines are set by law.
Notice of Privacy Practices
Covered entities must give patients a Notice of Privacy Practices (NPP) that explains how their information may be used and shared, their rights, and how to complain.
- A health care provider with a direct treatment relationship gives the notice no later than the first service delivery and makes a good-faith effort to get a written acknowledgment that the patient received it.
- The notice must be posted in a clear and prominent place at the facility and on the organization's website, if it has one.
Right of access
Patients have the right to inspect and get a copy of their PHI in the organization's records — medical and billing records, among others.
- The organization must act on a request no later than 30 days after receiving it.
- If it cannot, it may extend the time once, by no more than 30 more days, if it tells the patient in writing, within the first 30 days, why and when it will act.
- The copy must be given in the form and format the patient asks for if it is readily producible — for example, electronic copies of electronic records.
- The organization may charge only a reasonable, cost-based fee for copies. It may not refuse access because the patient has an unpaid bill.
There are limited grounds to deny access, such as psychotherapy notes. Never tell a patient "you can't have your records" on your own — pass the request to the person or department that handles access.
Right to request an amendment
Patients may ask the organization to amend information they believe is wrong or incomplete. The organization must act within 60 days (one 30-day extension allowed). It may deny the request in some cases — for example, if the record is accurate and complete — but must explain the denial in writing and let the patient submit a statement of disagreement.
Right to an accounting of disclosures
Patients may ask for a list of certain disclosures of their PHI made in the six years before the request. The accounting does not have to include disclosures for treatment, payment or health care operations, disclosures to the patient, or disclosures made under the patient's authorization. The organization must act within 60 days (one 30-day extension allowed).
Other rights
- Right to request restrictions on uses and disclosures. The organization usually does not have to agree — but it must agree not to disclose information to a health plan for payment or operations about an item or service the patient paid for out of pocket in full, unless the law requires the disclosure.
- Right to confidential communications — for example, asking to be contacted on a mobile phone rather than at home, or at a different address. Providers must accommodate reasonable requests.
- Right to complain — to the covered entity and to the HHS Office for Civil Rights (OCR). Complaints to OCR are generally filed within 180 days of when the person knew, or should have known, of the problem. No one may be retaliated against for complaining.
Scenarios
A request at the front desk. A patient tells the receptionist she wants a copy of her records on a USB drive she brought. The receptionist should not refuse or decide on her own. She records the request and sends it at once to the department that handles access, which must act within 30 days. Many organizations do not accept outside USB drives for security reasons; they will offer another electronic format.
A parent asking about a teenager. A father asks for his 16-year-old's records. A parent is usually the personal representative of a minor child, but state law can give minors control over some kinds of care. This request needs to go to the people who handle release of information.
A disagreement about a note. A patient says his chart wrongly states he smokes. Pass the amendment request to the right department. Even if it is denied, he has the right to file a statement of disagreement.
Key points
- Give or offer the Notice of Privacy Practices, and know where to send rights requests.
- Access: act within 30 days, one extension of up to 30 days; reasonable cost-based fee; an unpaid bill is not a reason to refuse.
- Amendment and accounting: act within 60 days; accounting covers six years but excludes TPO.
- A provider must honor a restriction on telling a health plan about care the patient paid for in full.