Patient’s Guide to HIPAA – Basic Rights: D. Right to Request Amendment (FAQ 29 – 36)
You are reading the Patient’s Guide to HIPAA, FAQ 29-36 .
HIPAA Guide Quick Links:
The HIPAA rule defines seven patient rights, one of them is a right to request amendment. This page includes all FAQs explaining this right (FAQ 29-36.)
On our list, the right to request an amendment of your health record is only the fourth right out of seven. Normally, access and amendment go hand in hand. We list amendment lower than access because the limits on the amendment right seriously undermine its utility. Nevertheless, if you can use it, the right to request an amendment may be important to you.
We want to underscore that the law does not give you a right to amend your record. You only have a right to request an amendment. We see this as a reasonable implementation of a patient’s interest in amending a record. The record keeper has rights and interests as well as the patient, and these rights and interests deserve respect too. You cannot, for example, reasonably expect your doctor to change the record so that it no longer shows that you were treated. A doctor has a legal and professional obligation to maintain treatment records.
This part of HIPAA comes as a surprise to many who believe they have a right of outright deletion. This is not the case.
FAQ 29: How Do I Make a Request for Amendment?
Start by obtaining a copy of the notice of privacy practices. You may already have a copy. If not, each HIPAA covered entity must provide a copy of its notice to anyone who asks for one. In addition, a copy should be available on the website of each covered entity (if the covered entity has a website). The notice of privacy practices describes your rights, including your right to ask for an amendment. The covered entity’s notice will tell you where to submit your request for amendment.
You might be asked to write a letter or fill out a form to make your request for amendment. You might be asked to tell the record keeper what information is wrong or is not about you. You may have to explain why you want the amendment.
When you make a request, the covered entity must act on your request within 60 days. The entity can take an additional 30 days to act if it provides you with a written explanation of the delay.
FAQ 30: Can I Ask that Incorrect Information be Removed From My File?
Yes, but it may not be that easy. A HIPAA-covered entity does not necessarily have to remove incorrect information. It can mark the information as incorrect and add additional notes that show the correct information.
There is a reason for this policy. Suppose that your doctor suspects that you have an infection. Before the test results come back, the doctor prescribes an antibiotic. When the test later shows that you didn’t have the infection, the doctor tells you to stop taking the antibiotic.
Now suppose that you ask the doctor to remove the initial diagnosis of an infection. If the information is totally removed, it will be impossible for the doctor to explain or justify the prescription for an antibiotic. It may not be appropriate to remove the entire incident from the record because the doctor will be unable to explain the treatment provided or the bill for the services. The doctor also needs to keep the record in the event that there are complications from the drug. The doctor rightly needs a history of the treatment for his/her protection for both legal and medical reasons. Your health record isn’t just about you. It’s about your provider too.
Health care providers are typically nervous about removing information from health records. For the most part, they have a reasonable concern for the reasons explained above. However, when the information in your health record is not about you, the provider’s concern is weaker. When the information in your record is not about you and the presence of the information did not affect your subsequent care, the argument for removal is stronger. For example, if your record includes a lab slip belonging to another patient, it may be appropriate for the record keeper to remove the slip entirely and put it in the right record.
However, if the incorrect information did affect your treatment – even if that treatment was inappropriate – then retaining some or all of the incorrect information (suitably marked as incorrect and including a full explanation) may be legally and medically justifiable. You may be able to negotiate with the provider about how the information should be marked or otherwise segregated from your medical record.
The problems faced by medical identity theft victims seeking amendment of their record can be particularly difficult. See the World Privacy Forum’s FAQ for identity theft victims at http://www.worldprivacyforum.org/2012/04/faq-rvictims-of-medical-id-theft/.
FAQ 31: What Other Limits Are There on the Right to Seek Amendment?
A covered entity does not have to amend a record that it considers accurate and complete. It does not have to amend a record that is not available for inspection by you under the access provision.
More importantly, a covered entity is not required to amend a record not created by the covered entity. That means if the information in your record came from any third party – including another provider, an insurer, a relative, or anyone else – the covered entity has no obligation to amend your record or even to consider your request. We find this limitation on the right to seek an amendment to be unfair, inappropriate, and dangerous. Be aware that state law may not have the same limitation on amendment rights.
The covered entity must consider your request for amendment of third-party information if you provide a reasonable basis to believe that the originator of the information is no longer available to act on the requested amendment. Thus, if the record contains information from a previous physician who is no longer in practice, you may be able to force your current provider to consider amending information supplied by that physician. We note that it can be difficult to prove that the originator of information is unavailable, and an uncooperative covered entity can string a requester along if it doesn’t want to deal with a request for amendment honestly.
If the covered entity that is the originator of the incorrect information is available but does not act on a request for amendment, the information in the subsequent covered entity’s record may be just as wrong and could have a continuing detrimental effect on the patient. This can present a real Catch-22 for patients.
In most circumstances, a health care provider will act reasonably to verify information that may affect patient care. For example, if you tell your surgeon that you think that your blood type is A, the surgeon is not likely to cavalierly accept contrary information just because it came from a third party. Any health care provider is likely to be suitably concerned about the possibility of a medical error based on wrong information.
However, there may be real problems with third party information in some circumstances. Health insurers may not be as worried about an error, especially if the error provides an excuse to deny a claim.
FAQ 32: Do I Have Greater Amendment Rights under State Laws, other Federal Laws, or Hospital Policies?
Maybe. Some states have health privacy laws that provide greater rights of amendment. If your records are held by the federal government (e.g., Medicare, VA, or Indian Health Service), your rights to ask for amendment of records under the Privacy Act of 1974 may be greater than under HIPAA. These two sets of privacy rules overlap, and you are entitled to the best parts of both laws. Not only may other laws provide patients with better amendment rights than HIPAA, but they may offer better remedies and clear causes of action in case you have to sue to correct records.
FAQ 33: What Happens When a Covered Entity Agrees to Make an Amendment?
The covered entity that agrees to make an amendment must:
• Make the amendment;
• Tell the requester what it did; and
• Make reasonable efforts to inform others about the amendment within a reasonable time.
The third requirement is most noteworthy. If you convince a covered entity to amend your record, the covered entity must tell any persons that you identify who received the original incorrect information and who need the amendment. In addition, the covered entity must notify any persons who have the information that was the subject of the amendment and who may have relied or could foreseeably rely on the information.
To make sure that amendments have been appropriately distributed, you may want to ask for an accounting of disclosures. The right to receive an accounting is explained elsewhere in this guide. (See FAQs 37-44.) What is important is that amendments be provided to those who may rely on the original incorrect information. Each patient has the right to tell a covered entity to send the amendment to anyone who received the original information and needs the information.
Be sure to ask that any amended information that bears on your future medical treatment be shared with other providers. Similarly, be sure to ask that amended information that bears on insurance and payment matters is shared with insurers and, possibly, with employers. The goal is to find and eliminate any incorrect information that others have and that may affect you adversely.
It may take considerable effort to make sure that every appropriate person has the information and that those with the information correct their own records. Every covered entity must act when it receives a notice of amendment, but that doesn’t mean that it will be done quickly or properly. It may be appropriate to ask each covered entity that received an amendment to confirm that it actually made the amendment. You may have to request a copy of your record from that covered entity to be certain. Should you do all of this? It may depend how important the information is to your future treatment.
Be aware of any Health Information Exchanges that may impact where your records are located. For example, covered entities in some states exchange electronic health records through a third party called a Health Information Exchange. Ask about the presence of an exchange or network so you can locate all of the copies of your records. As health records and health networks expand, some aspects of seeing and amending records may become easier. But some things may be harder, especially if no entity has clear responsibility for a health record. This is an evolving area, and there may be a lot of learning for everyone to do.
FAQ 34 Can I Appeal if a Covered Entity Refuses to Make an Amendment?
Maybe. An institution must accept complaints about its health privacy policies and practices. Filing a complaint with an institution may not be the equivalent of filing an appeal of a denial of a request for amendment, but it may help if it forces someone new at the covered entity to review your request. However, some institutions may accept formal appeals. Consult the institution’s notice of privacy practices to see if there is an appeal method for a denial of a request for amendment. Talk to the privacy officer at the covered entity to see if you can obtain help.
You can also complain to the Secretary of the federal Department of Health and Human Services about how your request was handled. The Department’s Office of Civil Rights processes complaints. You can find information about the process at http://www.hhs.gov/ocr/privacy/hipaa/complaints/index.html.
You have another alternative. When a covered entity denies your request for amendment, it must tell you that you can request the covered entity to provide a copy of your request for amendment with any subsequent disclosure of the disputed information. In some instances, it may be important to make the request. Remember that the covered entity is not required to tell others about the dispute unless you ask. Read FAQ 35 for more information about other remedies if your request is denied.
FAQ 35: Are There Other Remedies if My Request for Amendment Is Denied?
Yes. You have the right to file a written statement of disagreement, and that is an important right. When a covered entity denies your request for amendment, it must tell you about this right.
The statement of disagreement gives you the opportunity to explain your side of the story. The covered entity can reasonably limit the length of the statement of disagreement, so don’t plan on writing a novel-length document. We also suggest that your statement should be factual and should refrain from making personal attacks on anyone involved in the process.
The covered entity can prepare and circulate a rebuttal to your statement of disagreement. If it does so, it must provide you with a copy of its rebuttal.
HIPAA offers another protection even if you don’t file a statement of disagreement. The rule requires a covered entity that received and denied an amendment request to append or link the record in question to your request for amendment if you ask it to do so. The purpose here is to make sure that whoever sees the disputed record will also see the request for amendment. If you ask for a change and it is denied for a good reason, you may not want to ask that your request be shared. However, if you still disagree and you want others to know your views, then you should ask. One reason to ask to inspect or have a copy of your record is to see if the covered entity properly handled this requirement.
FAQ 36: Can a Covered Entity Still Disclose The Information that I Disputed?
Yes, but HIPAA offers additional rights. First, if you submitted a statement of disagreement, the covered entity must disclose it when it discloses the disputed information.
Second, if you choose not to submit a statement of disagreement, the covered entity must include your request for amendment (and its denial) along with any subsequent disclosure only if you requested that the covered entity do so. If you ask for a change and it is denied for a good reason, you may not want to ask that your request be shared. If you still disagree and you want others to know your views, then you should ask.
Roadmap: Patient’s Guide to HIPPA: Part 2: Basic Patient Rights: D. Right to Request Amendment (FAQ 29 – 36)