Right of access PHI in a “designated record set”
A “designated record set” is defined as a group of records maintained by or for a covered entity that comprises the medical records and billing records about individuals maintained by or for a covered health care provider.
Other records that are used, in whole or in part, by or for the covered entity to make decisions about individuals. This last category includes records that are used to make decisions about any individuals, whether or not the records have been used to make a decision about the particular individual requesting access.
Excluded from the right of access are:
Psychotherapy notes, which are the personal notes of a mental health care provider documenting or analyzing the contents of a counseling session, that are maintained separate from the rest of the patient’s medical record. Information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding.
Personal Representatives
An individual’s personal representative (generally, a person with authority under State law to make health care decisions for the individual) also has the right to access PHI about the individual in a designated record set (as well as to direct the covered entity to transmit a copy of the PHI to a designated person or entity of the individual’s choice), upon request, consistent with the scope of such representation
Requiring a Written Request
A covered entity may require individuals to request access in writing, provided the covered entity informs individuals of this requirement. In addition, a covered entity may require individuals to use the entity’s own supplied form, provided use of the form does not create a barrier to or unreasonably delay the individual from obtaining access to his PHI.
Verification
A covered entity is required to take reasonable steps to verify the identity of an individual making a request for access. Generally, the covered entity will request a government issued photo ID (such as a driver’s license, or passport).
Fees for Copies
The HIPAA Privacy rule permits a covered entity to impose a reasonable, cost-based fee if the individual requests a requests a copy of the PHI (or agrees to receive a summary or explanation of the information).
Individual’s Right to Direct the PHI to Another Person
An individual also has a right to direct the covered entity to transmit the PHI about the individual directly to another person or entity designated by the individual. The individual’s request to direct the PHI to another person must be in writing, signed by the individual, and clearly identify the designated person and where to send the PHI. The same requirements for providing the PHI to the individual, such as the fee limitations and requirements for providing the PHI in the form and format and manner requested by the individual, apply when an individual directs that the PHI be sent to another person.
Must a covered entity inform individuals in advance of any fees that may be charged when the individuals request a copy of their PHI?
Yes. When an individual requests access to her PHI and the covered entity intends to charge the individual the limited fee permitted by the HIPAA Privacy Rule for providing the individual with a copy of her PHI, the covered entity must inform the individual in advance of the approximate fee that may be charged for the copy.
When do the HIPAA Privacy Rule limitations on fees that can be charged for individuals to access copies of their PHI apply to disclosures of the individual’s PHI to a third party?
The fee limits apply when an individual directs a covered entity to send the PHI to the third party. Under the HIPAA Privacy Rule, a covered entity is prohibited from charging an individual who has requested a copy of her PHI more than a reasonable, cost-based fee for the copy that covers only certain labor, supply, and postage costs that may apply in fulfilling the request. This limitation applies regardless of whether the individual has requested that the copy of PHI be sent to herself, or has directed that the covered entity send the copy directly to a third party designated by the individual (and it doesn’t matter who the third party is). To direct a copy to a third party, the individual’s access request must be in writing, signed by the individual, and clearly identify the designated person or entity and where to send the PHI
May a health care provider withhold a copy of an individual’s PHI from the individual who requested it because the covered entity used the individual’s payment of the allowable fee for the copy to instead pay an outstanding bill for health care services provided to the individual?
No. Just as a covered entity may not withhold or deny an individual access to his PHI on the grounds that the individual has not paid the bill for health care services the covered entity provided to the individual, a covered entity may not withhold or deny access on the grounds that the covered entity used the individual’s payment of the fee for a copy of his PHI to offset or pay the individual’s outstanding bill for health care services.
Can an individual be charged a fee if the individual requests only to inspect her PHI at the covered entity (i.e., does not request that the covered entity produce a copy of the PHI)?
No. The fees that can be charged to individuals exercising their right of access to their PHI apply only in cases where the individual is to receive a copy of the PHI, versus merely being provided the opportunity to view and inspect the PHI. The HIPAA Privacy Rule provides individuals with the right to inspect their PHI held in a designated record set, either in addition to obtaining copies or in lieu thereof, and requires covered entities to arrange with the individual for a convenient time and place to inspect the PHI.
How do I request birth/death certificates?
Birth and death certificates are not available from Ballad Health’s health information department. These certificates must be ordered from the Tennessee Vital Records office, Virginia Vital Records office, or by calling your local health department.
