Authorization for Name of Practice/Health Care Facility to Use Or Disclose My Health Care

Authorization for Name of Practice/Health Care Facility to Use Or Disclose My Health Care

REQUESTS TO CORRECT OR AMEND HEALTH INFORMATION

Purpose: To provide a process for handling requests by patients or their legally authorized representatives to amend or correct protected health information (PHI) consistent with federal and state laws.

Policy:

  1. In general, patients or their legally authorized representatives have a right to request to amend or correct PHI maintained by the facility.
  2. The appropriate party shall review verbal requests in a timely fashion, and, if granted, the correction shall be noted in the appropriate record.
  3. Written requests must be approved or denied—in whole or in part—in a timely fashion.
  4. The appropriate party shall review written requests.
  5. Written requests and their disposition shall be documented, and any denial of a written request, in whole or in part, shall be in writing.
  6. Where applicable, the disposition of the request will be disclosed to others who need it.

Primary Responsible Party:

Employees of Island Hospital Medical Records Department will be responsible for receiving and processing requests for amendments. The Privacy Officer shall be ultimately responsible for the processing of these requests.

Other Responsible Party:

All staff must have sufficient understanding of the patient’s rights and the practice/health care facility’s obligation to approve/deny requests—in whole or in part—according to pertinent laws.

Procedure:

Verbal Requests

  1. When an individual makes a verbal request to correct or amend PHI, ask for verification of the identity and the authority of the individual if warranted (if the identity or the authority of the individual is not known to the practice/health care facility).
  2. The appropriate party shall approve or deny the request.[1]
  3. If the request is granted, see procedure 3 under Written Requests.
  4. If a verbal request is denied, offer the individual the opportunity to make the request in writing by completing and signing the Request to Correct or Amend Health Information form.
  5. If the individual chooses not to make a written request, then no additional procedures are required. In some circumstances, it may be advisable to offer the patient the opportunity to have a statement of disagreement admitted into their record (see procedures 5 and 6 under Written Requests).

Written Requests

  1. Written requests must be handled within 10 calendar days.[2] If there is a delay due to unusual circumstances (e.g., if the record is in use), specify in writing, within the 10 calendar days, to the individual:
  2. The reason for the delay
  3. The date the request will be answered—but no later than 21 calendar days from the date the request was received.[3]
  4. Written requests should be reviewed, and approved or denied, by the health care provider or other person who completed the entry in question.[4] It may be appropriate to first discuss the matter with the patient or the legally authorized representative.
  5. If the request is approved:
  1. The correction or amendment shall be made in the appropriate record.
  2. Mark the record affected by the change as corrected/amended at patient’s request.
  3. Draw a single line through any information to be modified, and date and sign or initial it.
  4. The affected record shall be attached or linked or shall otherwise indicate where in the record the corrected or amended information is located.
  5. In the next available space, document correction or amendment to chart note dated (date of entry being corrected or amended), enter the new information, and date and sign the entry.
  6. Send a copy of the correction or amendment to any third-party payor or insurer that previously received the changed PHI.
  7. Obtain and document the individual’s identification of any persons the individual wants notified of the correction or amendment, and take reasonable steps to notify such persons of the change within a reasonable time.[5]
  8. Notify others the practice/health care facility knows have the PHI that is the subject of the correction or amendment and could rely on the un-amended information to the patient’s detriment.[6] Take reasonable steps to notify such persons of the change within a reasonable time.
  9. Document the disclosures (see the Documenting of and Accounting for Disclosures of PHI Policy).
  1. The following permissible reasons to deny any part of an individual’s request are noted on the Request to Correct or Amend Health Information form and on the sample denial letter.

  1. The existing health information is accurate and complete.[7]
  2. Due to federal and state laws the individual does not have access to the information (and therefore it is not available for correction or amendment). Examples of when this reason could be used include:[8]
  3. Psychotherapy Notes;
  4. Information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding;
  5. PHI where access is prohibited by or exempt from Clinical Laboratory Improvements Amendments of 1988, 42 U.S.C. 263a (CLIA);
  6. PHI contained in records subject to the Privacy Act, 5 U.S.C. 552a, if the denial of access under the Privacy Act would meet the requirements of that law;
  7. PHI maintained by a correctional institution, or a provider acting under the direction of a correctional institution, if access would jeopardize the health, safety, security, custody or rehabilitation of the patient or other inmates, or the safety of persons at the institution or those responsible for transporting the inmate;
  8. PHI created or obtained by a covered health care provider in the course of research—that includes treatment—and the access is temporarily suspended for as long as the research is in progress, provided that the individual has agreed to the denial of access when consenting to participate in the research that includes treatment, and the covered health care provider has informed the individual that the right of access will be reinstated upon completion of the research;
  9. PHI obtained from someone other than a health care provider under a promise of confidentiality, and the access requested would be reasonably likely to reveal the source of the information;
  10. A licensed health care professional has determined, in the exercise of professional judgment, that the access requested is reasonably likely to endanger the life or physical safety of the patient or another person;
  11. The PHI makes reference to another person (unless such other person is a health care provider) and a licensed health care professional has determined, in the exercise of professional judgment, that the access requested is reasonably likely to cause substantial harm to such other person; or
  12. The request is made by the patient’s personal representative and a licensed health care professional has determined, in the exercise of professional judgment, that the provision of access to such personal representative is reasonably likely to cause substantial harm to the patient or another person.
  13. The record no longer exists or cannot be found.
  14. The request pertains to information that is not PHI, i.e., it does not pertain to the patient’s medical and financial records and the information requested was not compiled or used to make decisions about payment or treatment.[9]
  15. The requested information was not created by the practice/health care facility. Caution—if there is reason to believe the originator of the information is not available, then this ground cannot be used. [10]

  1. The practice/health care facility does not maintain the record. If known, give the individual the name and address of the health care provider who does maintain the record.[11]
  1. Individuals must be informed of the disposition of the written request. If the request is denied—in whole or in part—they shall be informed in writing (see attachment A—denial letter). If the written request is denied:
  1. Send the individual the denial letter and include the reason for denial and information about the individual’s option to file a statement of disagreement.[12]
  2. Document the reason for denial on the Request to Correct or Amend Health Information form.
  3. Add the Request to Correct or Amend Health Information form, any statement of disagreement, and a copy of the denial letter to the medical and/or financial record.
  4. Mark the challenged entry to indicate that the patient claims the entry is inaccurate or incomplete and indicate where the request for amendment and any statement of disagreement is located in the record.[13]
  5. Send any statement of disagreement to any third-party payor or insurer that previously received the disputed PHI.[14]
  6. Document the disclosure (see the Documenting of and Accounting for Disclosures of PHI Policy).
  1. Future disclosures must include the written request, the denial and any statement of disagreement.[15] However, if no statement of disagreement is filed, the written request and the denial can be included in future disclosures ONLY upon request by the patient or authorized individual. The denial letter may provide an opportunity for the patient to make this request (see attachment A).
  2. If notified by another health care entity that an amendment or correction has been made to a patient’s PHI then:
  1. The correction or amendment shall be filed in the appropriate record; and,
  2. As necessary, mark the record affected by the change as corrected or amended; and
  3. The affected record shall be attached or linked or otherwise indicate where in the record the corrected or amended information is located.

Internal References:

Responding to Requests to Access and/or Copy Protected Health Information (PHI) Policy

Documenting of and Accounting for Disclosures of Protected Health Information (PHI) Policy

External References:

45 CFR Section 164.524 (Access)

45 CFR Section 164.526 (Amendment)

RCW 70.02.080-.110

Policy effective date: 4/14/2003 Revision date(s): 4/08/2003

[1] See Procedure 2 under Written Requests.

[2] RCW 70.02.100(2).

[3] RCW 70.02.100 (2)(d).

[4] This is a risk management recommendation. The practice/health care facility may have another process in place for who makes the final determination (e.g., medical director). For requests to amend medical information, if the individual is no longer available, consider having the current provider or medical director review the request to correct or amend to determine whether or not the information in the challenged entry is accurate and complete. At times, it may be appropriate to discuss the matter with the patient. If the information is indisputably incorrect (e.g., a typo), it is appropriate to make the correction.

[5] You may want the patient to sign an authorization form if the disclosure would ordinarily require the use of that form. See footnote 8.

[6] s. 164.526(c)(3). State law neither requires these disclosures nor forbids them. State law only requires disclosure to third-party payors and insurers. RCW 70.02.110(3). It is therefore unclear whether state law is more stringent here. However, to the extent that prior recipients are those to which disclosures are permitted without authorization, this step seems appropriate. You may want to obtain the patient’s written authorization, not just his permission, to disclose the change if the prior disclosure was made pursuant to a signed authorization.

[7] s. 164.526 (a) (2) (iv).

[8] s. 164.526 (a) (2) (iii). These are examples of federal and state laws that permit denial—these details in (i-x) do not have to be disclosed to the patient. However, sometimes it may be advisable to give the patient the more specific reason for the denial.

[9] s. 164.526 (a) (2) (ii). An example of when this reason could be used is when the information requested is not PHI because it was compiled and used solely for quality improvement or peer review records or for the practice’s attorney or malpractice insurer.

[10] s. 164.526 (a) (2) (i).

[11] RCW 70.02.100 (2) (b) and (c).

[12]Other required information is on Attachment A.

[13]The practice/health care facility may, but need not, prepare and file in the medical record a written rebuttal to a statement of disagreement and must provide the individual with a copy of any rebuttal. Generally, we recommend not preparing such a statement.

[14]RCW 70.02.110 (3)

[15]While HIPAA would allow the practice/health care facility to summarize the disagreement in lieu of sending copies, it is unclear whether state law permits that option. From a risk management perspective, we recommend not preparing a summary.

Top View