HIPAA Consult

Answers to your questions about . . .

By Margaret M. Davino, JD

Patients' right to restrict access

Q: Can a patient prohibit one of my staff members from seeing her medical records?

A: Under HIPAA, your patient may request that restrictions be placed on the use and disclosure of her medical information. For example, if she knows your billing clerk personally and is concerned about confidentiality, she may ask that the clerk be restricted from seeing her records. You aren't required to honor impractical requests, however. (Your billing clerk, for instance, may need to know certain information in order to do her job.) Assure patients whose requests you deny that your staff members are trained to protect the confidentiality of patient records.

Unlimited access

Q: Does HIPAA give patients unlimited rights to obtain their medical records?

A: No. Patients don't have access to (a) psychotherapy notes; (b) information compiled for use in (or in reasonable anticipation of) a civil, criminal, or administrative proceeding; or (c) information restricted by the Clinical Laboratory Improvement Act, which permits labs to disclose test results to providers and not directly to patients.

You may also refuse a patient access to medical records if, among other reasons, you work for a correctional institution and release may jeopardize another person's safety; your patient participates in a research protocol and has waived her right of access until completion of the research; or the records are subject to the federal Privacy Act of 1974. In such cases, you must tell the patient why you denied the request.

If you deny access for other reasons (for example, access may place the patient in physical danger), the patient has the right to request an internal review. In such cases, the reviewing official must be a healthcare professional who didn't take part in the initial decision to deny access. A solo physician might designate her nurse, for instance; a physician group could assign one physician to review all such cases, assuming care is taken not to involve him in initial decisions. In either case, the decision of the reviewer must be followed.

Partial release of records

Q: Am I permitted to hold back part of a medical record, and release the remainder?

A: Yes, but you must justify your action to the patient—and that justification must be one permitted by HIPAA, as outlined above. If the denial triggers the right to an internal review, you must inform the patient of that right. You must also tell her what steps to follow to submit a complaint to the Secretary of HHS.

Summaries vs whole records

Q: Am I permitted to offer a patient a summary of his medical records instead of offering a complete copy?

A: Yes, but only if the patient agrees and only if he accepts the fee you may charge for the service. From a liability standpoint, however, it's risky to offer a summary. First, your view of events may not be shared by your patient. Second, it's easy in summarizing to omit something that your patient—or his lawyer—thinks is important. For these reasons, think hard before offering a summary as an alternative to a copy of the actual record.

Margaret M. Davino is a healthcare attorney with Kaufman Borgeest & Ryan, in New York City. She can be reached at mdavino@kbrny.com. This department answers common HIPAA-related questions. It isn't intended to provide specific legal advice. If you have a question, please submit it via e-mail to mehipaa@medec.com, or by regular mail to Medical Economics, 5 Paragon Drive, Montvale, NJ 07645. ATTN: HIPAA CONSULT. If we select your query, we'll address it in an upcoming issue. Your name will not be used.

 

Margaret Davino. HIPAA Consult: Answers to your questions about. . .. Medical Economics Nov. 21, 2003;80:18.