Requests for Amending Medical Records
Medical practices are receiving more requests for amending medical records since more patients are reading their medical records. The federal Open Notes Rule, or Information Blocking Rule, has made it easier for patients to read their electronic medical record along with patients accessing to their record under the Health Insurance Portability and Accountability Act (“HIPAA”) Privacy Rule. As a result, medical practice staff are managing more requests from patients to delete or correct things from their medical records.
Sometimes patients and their representatives have valid reasons to request amendments to medical records. For example, a physician assistant documented in the original record, “Breasts appear normal, no palpable lumps,” about a patient who had undergone a left radical mastectomy and removal of the pectoral muscle and axillary lymph nodes. In this instance, the medical record should be amended. Other times requests are denied, usually because the information is accurate and clinically relevant.
Patient Rights to Amend Medical Records and Clinician Duties
Regardless of the nature of the request, patients enjoy certain rights and clinicians have specific duties under the HIPAA Privacy Rule. Note: state laws may also apply to the right of access.
- Patients have a right to access their medical and health information in designated record sets maintained by their physicians and advanced health care professionals (collectively “Clinicians”).
- Patients do not have the right to access two categories of information: 1) psychotherapy notes (personal notes by physician or other mental health care professional documenting or analyzing a counseling session) that are maintained separate from the rest of the patient’s medical record and 2) information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding. 45 CFR § 164.524(a)(1)(i)-(ii).
- A “designated record set” is a group of records maintained by or for a covered entity and is comprised of medical records; billing and payment records; health insurance information; clinical laboratory results; medical images, such as x-rays; wellness and disease management program files; clinical case notes; and other information used to make decisions about a particular patient or any patients. 45 CFR § 164.501.
- Patients do not have the right to access two categories of information: 1) psychotherapy notes (personal notes by physician or other mental health care professional documenting or analyzing a counseling session) that are maintained separate from the rest of the patient’s medical record and 2) information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding. 45 CFR § 164.524(a)(1)(i)-(ii).
- Patients have a right to request that the clinician or practice amend their protected health information (“PHI”) in designated record sets. The right of amendment is stated in a federal regulation at 45 CFR § 164.526(a)(1).
- Clinicians and their practices must:
- permit patients or their representatives to request an amendment to PHI, and
- act on the request within 60 days of receiving it.
- permit patients or their representatives to request an amendment to PHI, and
- If clinicians or practices cannot act on the request 60 days after receipt, they must submit a written statement to the patient or representative explaining the reason for the delay and the date by which action on the request will be completed. Action on the request must be completed within 90 days of receipt of the request.
- The clinician’s or medical practice’s duty to permit amendment requests is explained at 45 CFR § 164.526(b)(1). See 45 CFR § 164.526(b)(2) for details about the 60-day deadline.
Acting on Requests to Amend Medical Records
Clinicians and their practices don’t have to make the requested changes, but they do have to respond to the requests. A formal process for managing requests to amend PHI will help clinicians and practices honor their patients’ rights and ensure their compliance with the HIPAA Privacy Rule.
When granting the patient’s request to amend the record, change or amend the affected record(s) and append the changed record(s) or provide a link to the location of any amendments. Don’t remove, destroy, or delete the original PHI during the amendment process. Include the appended or linked information with any future authorized disclosures of the PHI.
Inform the patient or representative that the amendment has been made. Ask the patient or representative to identify persons who have received the PHI that is the subject of the amendment, and notify the persons identified by the patient or representative, especially those who may or could rely on the unamended information to the patient’s detriment.
The practice should also make reasonable efforts to provide the amendment within a reasonable amount of time to persons identified by the patient or representative, business associates, and clinicians and practices who may or could rely on the unamended information to the patient’s detriment.
A request to amend the medical record may be denied if:
- The clinician or practice did not create the medical record entry (unless the patient or representative provides a reasonable basis for the clinician or practice to believe the originator of the PHI is no longer available to act on the requested amendment)
- The clinician or practice does not have the record
- The entry is not available for inspection because the entry is in psychotherapy notes or is part of information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding
- The entry is accurate and complete
How to Handle Denials to Amending Medical Records
If the request is denied, provide patients and/or their representatives with denials in writing and in plain language. Explain that the patient or representative has the right to submit a statement that they are disagreeing with the denial and provide complete information on how to submit a statement of disagreement. Let the patient and/or the representative know that all future disclosures of the PHI will include the amendment request and the denial. Describe the clinician’s or practice’s and the Office of Civil Rights for the US Department of Health and Human Services’ complaint processes. Include the name or job title and telephone number of the person designated by the clinician or practice to manage complaints.
Send patients and/or their representatives a rebuttal to a statement of disagreement. After the first statement of disagreement and rebuttal, clinicians and practices should decide how many times patients and/or their representatives may submit statements of disagreement and how many times clinicians and practices will rebut the statements of disagreement.
A copy of each rebuttal must be provided to patients and/or their representatives. After receiving statements of disagreements, identify the medical record or PHI in dispute and append or link the request for amendment, statement of disagreement (if any), and rebuttal (if any). The appended or linked information must be included with any future authorized disclosures of the PHI.
The following chart shows examples of an excerpt of an original medical record compared to the amendment request:
Additional Resources on Amending Medical Records
Sample HIPAA Policy Template: Patient Requests to Amend Medical Records
Sample Denial Letter of Patients' Request to Amend Medical Record
