Implementation Tip: The CE has up to 60 days to provide information located on site, and up to 90 for information located off-site. Notice of an extension must be provided to the individual within the standard deadline time.

1)

The individual agrees in advance; and

2)

The individual agrees in advance to any fees imposed for such summary or explanation.

Implementation Tip: If the same PHI requested is maintained in more than one designated record set or at multiple locations, the CE need only produce the PHI once in response to the request.

Implementation Tip: The CE may discuss other aspects of the request with the individual as necessary for timely provision.

Implementation Tip: If the PHI is not readily producible in the form requested by the individual, it must be provided in a readable hard copy form or other form agreed to by the parties.

1)

The basis for denial;

2)

A statement of review rights and how the individual may exercise such rights (if applicable); and

3)

A procedural description, including the name, title, and phone number of a contact person or office, for the individual to complain to the CE or the Secretary.

Implementation Tip: A CE must document the designated record sets subject to access by individuals, the titles of persons or offices responsible to receive and process requests for access, and must retain such documentation as required.

1)

Psychotherapy notes;

2)

Information compiled in reasonable anticipation of, or for use in, civil, criminal or administrative actions/proceedings; and

3)

Certain PHI maintained by the CE that is subject to, or exempted from, the Clinical Laboratory Improvements Amendments of 1988 (CLIA)

Implementation Tip: A CE may provide access to the excepted material above; however, review is not available if the CE denies access based on one of the exceptions.

1)

Information is covered under an exception stated above;

2)

The CE is a correctional institution or healthcare provider acting under direction of the correctional institution to deny an inmate’s request to obtain a copy of PHI that would jeopardize the health, safety, security, custody or rehabilitation of the inmate, other inmates, safety of an officer, employee or person responsible to transport the inmate;

Implementation Tip: This exception pertains to the denial of a request to copy, but inmates may still inspect records unless another exception applies.

3)

The PHI was obtained by the CE in the course of research in progress that includes treatment of research participants, provided that: (a) the individual agreed to the denial of access in the consent to participate in the research; and (b) was notified that right to access is reinstated at completion of research;

Implementation Tip: Access doesn’t have to be denied and may actually be necessary for the welfare of a participant, in which case, access should be given.

4)

The PHI requested is also subject to the Privacy Act and denial is permitted by the Privacy Act regulations; or

5)

The PHI is obtained from someone other than a healthcare provider under a promise of confidentiality and access would reasonably likely reveal the source of that information.

Implementation Tip: This exception does not cover confidentiality promises to other healthcare providers.

1)

A licensed healthcare professional determines, exercising professional judgment, that access is reasonably likely to endanger the life/physical safety of the individual or another person;

2)

The requested PHI makes reference to another person who is not a healthcare provider and a licensed healthcare professional exercising professional judgment, determines that the access requested is reasonably likely to cause serious harm to the other person (ie., may apply to situations such as group therapy sessions, where information given by one person may be relevant to the care of another);

3)

The request for PHI is by a personal representative of an individual, and a licensed professional, exercising professional judgment, determines that access to the requested information is reasonably likely to cause substantial harm to the individual or to another person (ie., a situation may arise where the CI determines that treating the PR as the individual will cause harm to the individual or another person, perhaps finding that the PR may inflict domestic violence, abuse or neglect, etc.

Implementation Tip: A licensed healthcare professional must make the determination based on the particular circumstances and the current medical professional standards of harm for any of these three standards of harm to apply.

Implementation Tip: A CE may deny access in whole or in part considering particular circumstances, but is not required to deny access.

1)

The CE promptly refers the request to the designated reviewing official;

2)

The official determines, within a reasonable period of time, whether or not to deny access based on the allowed reviewable grounds; and

3)

The CE promptly provides written notice to the individual of the official’s determination and takes appropriate other action required to carry out the determination.

Implementation Tip:
Develop a standard form to be used when a patient requests amendment to his/her record. See the OAHHS HIPAA Compliance Guidelines at www.oahhs.org and click on Sample Forms for an example of a Patient Request for Amendment Form.

Implementation Tip: Notice of an extension must be provided to the individual within the standard deadline time.

Implementation Tip: Covered providers, health plans, and health care clearinghouses that create or receive PHI, other than as a business associate, must comply with these requirements.

Implementation Tip: The CE must document the titles of persons/offices responsible for receiving/processing requests for amendments and retain such information as required by §164.530(j), in written or electronic form for six years from the date of its creation, or the date when it last was in effect, whichever is later.

1)

At a minimum, the CE must make the appropriate change to the PHI covered in the request, and identify the amended/corrected entries, showing the location of the amended/corrected entries;

Implementation Tip : CEs are not required to expunge PHI, unless their own record keeping practices or other applicable law require it. In fact, it would be wise to retain the original record. When you amend a patient's record, do not white out or otherwise eliminate the original record. Rather, include a new page containing the amended information.

2)

Informing the individual – the CE must timely inform the individual of the decision to amend/correct, in accordance with the same timely action requirements as for requests to amend. The CE must obtain individual’s identification of, and consent to share amended/corrected PHI with relevant persons; and

3)

Informing Others – if the individual agrees, The CE must make reasonable efforts to notify, within a reasonable time: (a) entities identified by the individual as needing the amendment information; and, (b) entities the covered provider knows received the erroneous/incomplete PHI information and who may have relied, or foreseeably could rely, on such information to the individual’s detriment.

Implementation Tip:
If you are releasing information to entities the patient did not specifically identify, but that you believe may have relied on the information, be sure to obtain patient authorization for this release.

Implementation Tip: CEs must require business associates receiving notifications of amended PHI to incorporate such information into their own record sets maintained on behalf of the covered entity.

1)

The PHI was not created by the CE (unless the individual provides a reasonable basis to claim that the originator of the PHI is no longer available);

2)

The PHI is not part of designated record set;

3)

The PHI would not be available for inspection under §164.526, dealing with rules of access to PHI; or

4)

The PHI is accurate and complete as is.

1)

The basis for denial, in accordance with Denial of Amendment standards of this section;

2)

The individual’s right to disagree in writing and the process to submit such a statement of disagreement;

3)

Notification of the individual’s right to have requests for amendment and denials included with any future disclosures of the PHI at issue (if the individual fails to submit a disagreement statement);

Implementation Tip: See §164.530(d), §160.306 and §164.530(a)(1)(ii) for a description of how the individual may make a complaint to the CE and the Secretary.

Implementation Tip: If a future disclosure is a “standard transaction” as defined by §162 of HIPAA, and unable to accommodate the required additional materials, such materials may be separately disclosed to the recipient.

1)

Disclosures for purposes of treatment, payment and healthcare operations;

For a sample Accounting for Disclosures form click here.

2)

Disclosures made to individuals about themselves (see §164.502);

3)

Disclosures for the facility’s own directory, persons involved in the individual’s care or other disclosures for notification purposes (see §164.510);

4)

Disclosures for national security or intelligence purposes (see §164.512(k)(2));

5)

Disclosures to correctional institutions or law enforcement officials (see §164.512(k)(5)); or

6)

Disclosures that occurred prior to the compliance date for the covered entity.

Implementation Tip: Specific cross sections referred to should be consulted to ascertain the details of what the exception to disclosure includes/omits. For example, disclosures made for facility directories are excepted from the disclosure requirements; however, the individual must have been informed that certain information could be included in a directory and that certain disclosures may be made, and given the opportunity to object, etc.

1)

That disclosure of the requested information in an accounting would likely impede the agency or official’s activities; and

2)

The specific time period for the suspension.

1)

The date of the disclosure;

2)

The entity name or name of person name receiving PHI, along with their address, if known;

3)

A brief description of PHI disclosed;

4)

A brief statement of purpose., reasonably informing the individual of the basis for disclosure; or, alternatively, a copy of the individual’s written authorization (in accordance with §164.508), or a copy of written request for disclosure (in accordance with §§164.502(a)(2)(ii) or 164.512, if any).

Implementation Tip: If you are part of an organized health care arrangement of affiliated entity, a request for accounting likely includes disclosures by all participants in the arrangement. This is a question you may want to ask the individual. He/she may not want all these disclosures.

Implementation Tip: It may be a good idea to have your system account for all disclosures rather than distinguish between disclosures for treatment, payment or healthcare operations (not subject to accounting) and other disclosures. There are two reasons for this:

1)

I may be easier for your system to simply account for all disclosures rather than attempt to distinguish between the different reasons for disclosure; and

2)

If a patient later amends his/her record, you will need to notify those who received the original record of the amendment.

Implementation Tip: Disclosures made to business associates are included in the accounting requirement. Your business associate agreements must require the associate to account for disclosures they have made of PHI the associate holds on your behalf.

Implementation Tip: In accordance with the administrative requirements of §164.530(j), The CE must document and retain information required for disclosures of PHI that are subject to an accounting, the written accounting provided to the individual, and the titles of persons/offices receiving and processing requests for accountings by individuals.