As many of you may know, the Privacy Rule of HIPAA- Health Insurance Portability and Accountability Act of 1996 - was implemented all across the United States in April of 2003. However, you may not know what your rights as a patient are under that rule. There are 6 basic rights afforded a patient. The following are your rights and details regarding each right:
1. The right of access to copy or inspect your medical records.
You may contact your provider for the purposes of either requesting a copy of your medical records, viewing your medical records or both. However, you should be aware that a physician has 30 days to respond to your request initially and may take an additional 30 days due to extenuating circumstances. In addition, if state law permits, they may charge you for those records.
You should also know that the HIPAA guidelines detail some very specific circumstances under which you may not have access to your records. Should you be denied access to your records, you also have the right to request a second opinion. You may select another physician of your own choosing to review the records and make a determination as to whether or not you should be granted access to your records.
Finally, under this section, you should also be advised that although the information contained in the records is yours, the actual medical records are not yours. State laws designate the physicians as the records owners and therefore they are required to follow all laws as it relates to the privacy and security of those records. You should not go in to a physician's office demanding to see your records immediately because they are "your records." By law, they are not your records.
2. The right to request an accounting of all non-routine third-party disclosures of your health information.
The Privacy rule states that a physician is required to keep an accounting of all third-party non-routine disclosures of your health information. What is not required to be accounted for is anything that is treatment, payment, healthcare operations related or if it released pursuant to an authorization signed by you. Essentially, the only thing required to be accounted for are disclosures pursuant to legal mandates.
The law states a physician is only required to keep an accounting for a 7 year period. For example, since the rule came in effect in 2003, the physician is only required to keep that accounting until 2010. If you go in the year 2011 and request an accounting, it will begin in 2004. Additionally, you can request either a complete accounting for the entire 7 years, or you may make the request for any range within those 7 years. The rule also states the physician may charge you for that accounting of disclosures.
The physician has 30 days to comply with your request.
3. The right to request an amendment be made to your medical records in the case of an error.
This section is similar to your credit report. Once you have access to your medical records, should you see something that appears to be in error, you may request the physician amend your record and change it. However, your request may not be granted if clinically the information in your record is correct, or, if the information you want changed was not created by that physician (i.e., a consult report from a specialist.) In the case of the latter, the physician's office will instruct you to make that request to the other physician.
If the information you want to have amended does turn out to be incorrect, the physician is required to make that change and to notify any other physicians, insurance companies, or any others involved of the error and instruct them to make that change.
Lastly, if you make a request for an amendment and the physician does not change the information, should you feel strongly that the information is incorrect, you have the right to submit a rebuttal statement that will be included in your record. From that point forward, anyone who receives that information will also receive your rebuttal statement.
The physician has 30 days to comply with your request.
4. The right to request restrictions on certain disclosures of your health information.
You have the right to make a request of your physician to not further disclose your information. However, the physician has sole discretion whether or not to grant you that restriction. If your request is related to treatment, payment, healthcare operations, or a legally mandated disclosure, most likely your request will not be granted.
If your request for a restriction has been granted, it is also up to the physician's sole discretion to take it off whenever they want. If they remove the restriction, they must notify you in writing.
5. The right to alternative communications.
You have the right to request that all communications to you be via an alternative manner. For instance, while you may still be living in your home, you may request that a physician send all communications to a post office box or other address other than your home address. Or, you may request that any phone calls from your physician be to an alternative phone number rather than your home phone.
While there are many means for alternative communications (fax, phone, e-mails, address) it is up to the physician to determine which means of alternative communications you will be permitted. Most physician offices will not allow communications via fax or e-mail due to the stringent requirements for electronic communications stated in the security rule.
6. The right to file a complaint with your physician, the Department of Health and Human Services or both.
And, finally, you have the right to file a complaint without fear of retribution. You should receive a copy of their notice of privacy practices. That notice of privacy practices should include either a phone number or address for you to contact their privacy official in addition to the phone number and address to the Department of Health and Human Services.
If you have any questions with regards to your privacy rights, you can find all the information you need from the DHHS Office for Civil Rights website (see link at bottom of post).
