27 January 2016

HIPAA and Individuals’ Right to Access their Health Information

The Department of Health and Human Services rang in the New Year by releasing updated guidance on patients’ right to access their health information. The updated guidance is a good opportunity for health care providers to revisit their practices, policies and procedures and make any necessary changes.

The guidance reminds covered entities that individuals have a right to inspect and obtain a copy of their protected health information (“PHI”) found in a “designated record set.” A “designated record set” is defined in federal regulations (42 C.F.R. 164.501) as a group of records maintained by or for a covered entity that comprises the medical and billing records, enrollment, payment, claims adjudication, and case or medical management records system maintained by a health plan or other records used by or for the covered entity to make decisions about individuals.

The guidance noted PHI that is not part of a designated record set does not need to be provided to individuals. For example, peer review files, certain quality assessment or improvement records or business planning documents may not be in a designated record set. Additionally, individuals do not have a right to access psychotherapy notes and information compiled in reasonable anticipation of civil, criminal or administrative proceedings.

Practical Takeaways:

  • Individuals are entitled to inspect and obtain a copy of their PHI found in a designated record set
  • Covered entities do not need to provide individuals with documents such as peer review records or psychotherapy notes that are not maintained as part of the designated record set
  • Covered entities can require individuals to submit a written request to copy or inspect their records
  • Covered entities should generally produce the PHI in the form and format requested by the individual