The Foundation of the Right of Access
HIPAA grants individuals the right to inspect and obtain a copy of their protected health information held in a designated record set, with limited exceptions. Covered entities must respond within 30 days, with one 30-day extension permitted if the individual is notified of the reason for delay.
Advanced Scenario: Access to Psychotherapy Notes
Psychotherapy notes are treated differently from the rest of the medical record. They are excluded from the right of access and generally require specific patient authorization for disclosure, even to the patient themselves in some interpretations, distinct from the rest of the designated record set which patients can access directly.
Advanced Scenario: Deceased Patients
The right of access can be exercised by a personal representative of a deceased individual, such as an executor or administrator of the estate, and HIPAA protections for a deceased individual's information continue for 50 years after death, though access rules for representatives differ from those for living patients.
Advanced Scenario: Minors and Parental Access
Parents are generally the personal representatives of their minor children and can exercise access rights on the child's behalf, but state law exceptions apply, such as when a minor has consented to their own treatment for certain services like reproductive health or substance abuse treatment, in which case the minor may control access independently.
Fees for Copies
- Covered entities may charge a reasonable, cost-based fee that includes labor for copying, supplies, and postage
- Fees may not include costs associated with retrieving or searching for the record
- When a patient directs that a copy be sent to a third party, the same fee limitations generally apply
Format and Transmission
Patients have the right to request records in the form and format they prefer, if readily producible, including electronic formats. If a covered entity maintains records electronically and a patient requests an electronic copy, the entity must provide it in the requested format if feasible or a mutually agreed alternative.
Denials and the Right to Review
Some denials are reviewable, meaning the individual can request that a licensed health professional review the decision, such as when access is denied due to a reasonable belief that access could endanger the life or safety of the individual or another person. Other denials, such as those involving information compiled for legal proceedings, are not subject to review.
Exam Strategy
- Distinguish reviewable from non-reviewable grounds for denial
- Know that psychotherapy notes and information for legal proceedings are excluded from the right of access
- Apply the personal representative rules correctly for minors and deceased patients
Key Takeaway
The RHIA exam tests nuanced applications of the right of access far beyond the basic 30-day rule, particularly around excluded categories, personal representatives, and denial review procedures.