Overview of Patient Rights
The HIPAA Privacy Rule grants patients several specific rights regarding their protected health information. HIM professionals are often the primary point of contact for patients exercising these rights, making a thorough understanding essential for both compliance and patient service.
Right of Access
Patients have the right to inspect and obtain a copy of their protected health information maintained in a designated record set. Covered entities must respond to access requests within 30 days, with one 30-day extension permitted if the patient is notified of the reason for delay. Fees for copies must be reasonable and cost-based, and covered entities cannot deny access simply because a bill is unpaid.
Right to Amendment
Patients may request an amendment to their health information if they believe it is inaccurate or incomplete. The covered entity must respond within 60 days, with one 30-day extension available. If the request is denied, the entity must provide a written explanation, and the patient has the right to submit a statement of disagreement that becomes part of the record.
Accounting of Disclosures
Patients have the right to receive an accounting of certain disclosures of their protected health information made in the six years prior to the request. Notably, disclosures for treatment, payment, and healthcare operations are excluded from this accounting requirement, as are disclosures made pursuant to the patient's own authorization.
Right to Request Restrictions
Patients may request restrictions on how their information is used or disclosed for treatment, payment, or healthcare operations. Covered entities are not generally required to agree to these requests, with one important exception: a covered entity must honor a patient's request to restrict disclosure to a health plan when the patient has paid out of pocket in full for the related service.
Confidential Communications
Patients have the right to request that communications from their provider be sent by an alternative means or to an alternative location, such as requesting that appointment reminders be sent to a specific phone number rather than a home address.
Additional Patient Rights
- Right to receive a Notice of Privacy Practices
- Right to request that a covered entity not sell their information without authorization
- Right to file a complaint with the covered entity or with the HHS Office for Civil Rights
Handling Complaints
Covered entities must have a documented complaint process and may not retaliate against a patient for filing a complaint. Complaints filed with the Office for Civil Rights can trigger investigations and, in cases of substantiated violations, corrective action plans or monetary penalties.