INTRODUCTION TO PATIENT RIGHTS

INTRODUCTION TO PATIENT RIGHTS

 

HIPAA isn’t just about what healthcare providers must do – it’s also about empowering patients with rights over their own health information.

The Six Major Patient Rights:

 

1. Right to Notice of Privacy Practices

2. Right to Access Medical Records

3. Right to Request Amendments

4. Right to an Accounting of Disclosures

5. Right to Request Restrictions

6. Right to Request Confidential Communications

Why These Rights Matter:

 

These rights give patients control, transparency, and protection. Understanding and honoring these rights:

• Builds patient trust
• Ensures legal compliance
• Empowers patients in their healthcare
• Protects vulnerable populations

RIGHT 1: NOTICE OF PRIVACY PRACTICES

 

What It Is:

 

Every covered entity must provide patients with a Notice of Privacy Practices (NPP) – a document explaining how PHI may be used and disclosed and what rights patients have.

Required Content:

 

 

 

“THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.”

 

2.  Uses and Disclosures:

 

• Explanation of uses/disclosures for treatment, payment, operations
• Other permitted uses/disclosures
• Uses/disclosures requiring authorization
• Examples of each

3.  Individual Rights:

 

• Right to access records
• Right to request amendments
• Right to an accounting
• Right to request restrictions
• Right to request confidential communications
• Right to complain
• How to exercise each right

4.  Covered Entity Duties:

 

• Duty to maintain privacy
• Duty to provide notice
• Duty to abide by terms of current notice
• Right to change notice
• How changes will be communicated

5.  Contact Information:

 

• Privacy Officer contact
• How to file complaints
• How to get more information

6.  Effective Date:

 

• Date notice takes effect

When to Provide NPP:

 

Healthcare Providers with Direct Treatment:

 

• First service delivery date
• Best efforts to obtain written acknowledgment of receipt

Health Plans:

 

• At enrollment
• At least once every 3 years (remind of availability)

Must Also:

 

• Post NPP on website if you have one
• Make NPP available at facility
• Provide upon request

Acknowledgment of Receipt:

 

You must make good faith effort to obtain written acknowledgment that patient received NPP.

If Patient Refuses to Sign:

 

• Document the refusal
• You can still provide treatment!
• Keep documentation of attempt

Example Documentation:

 

“Patient Jane Doe refused to sign acknowledgment of receipt of Notice of Privacy Practices on 1/15/2025. NPP was provided to patient and explained. Witnessed by: [name].”

When to Update NPP:

 

Update when you:

• Make material changes to uses/disclosures
• Change patient rights processes
• Change duties or privacy practices
• Make changes to complaint process

Distribute Updated NPP:

 

• Post prominently in facility
• Post on website
• Provide to individuals upon request
• Health plans: within 60 days of material change

RIGHT 2: ACCESS TO MEDICAL RECORDS

 

The Right:

 

Patients have the right to inspect and obtain a copy of their PHI in a designated record set.

What is a Designated Record Set?

 

• Medical records
• Billing records
• Enrollment/payment/claims records
• Any other records used to make decisions about individuals

NOT Included in Designated Record Set:

 

• Psychotherapy notes (separate protection)
• Information compiled for legal proceedings
• Lab results where law prohibits access (rare)
• Information held by researchers (if patient agreed to temporary denial)

Timeline for Response:

 

General Rule:

 

• 30 days from request
• Can extend ONCE for additional 30 days (must provide written notice of delay and expected completion date)

If Records Not On-Site:

 

• 60 days (extendable once to 90 days)

Summary or Explanation:

 

Patient can request:

• Full copy of records
• Summary of records (if they agree)
• Explanation of records

You can provide summary/explanation instead of full copy ONLY if:

• Patient agrees in advance
• Patient agrees to any associated fees

Format of Records:

 

Patient Can Request:

 

• Paper copy
• Electronic copy (if maintained electronically)
• Specific electronic format if readily producible

You Must:

 

• Provide in format requested if readily producible
• If not readily producible, provide in readable electronic form agreed to by patient
• Can provide electronic copy to third party designated by patient

Example:

 

Patient requests records in PDF format. You maintain records in your EHR system that can export to PDF. You MUST provide PDF.

Patient requests records in specific software format you don’t use and conversion would be difficult. You can provide in readable alternative format (like PDF).

Fees You Can Charge:

 

Reasonable, Cost-Based Fees for:

 

• Labor for copying (whether paper or electronic)
• Supplies for creating paper copy

• Postage (if mailed)
• Preparing summary/explanation (if patient agreed)

You CANNOT Charge For:

 

• Retrieval of records
• Searching for records
• Maintaining systems
• Staff time to coordinate/process request

Fee Limits:

 

Many states have specific fee limits (e.g., $X per page, maximum total). Know your state law!

Delivering Records:

 

Options:

 

• In person pickup
• Mail to address specified
• Email (if patient requests electronic delivery)
• Patient portal
• Third party designated by patient

Security:

 

• Verify identity before releasing
• Use secure transmission for electronic delivery
• Get confirmation from patient for unusual requests

Denying Access:

 

Unreviewable Denials (you can deny without review):

 

• Psychotherapy notes
• Information compiled in reasonable anticipation of litigation
• Information prohibited by law (e.g., certain lab results under federal law)
• Correctional institution or law enforcement custody (in some circumstances)
• Research records (if patient agreed to temporary suspension)
• Privacy Act protected information

Reviewable Denials (patient can request review):

 

• Licensed healthcare professional determined access would endanger patient or another person
• Request for someone else’s information (e.g., parent requesting info about competent adult child)
• Privacy Act situations where denial was proper

Denial Process:

 

Must provide written denial including:

• Basis for denial
• Patient’s right to review (if applicable)
• How to request review
• How to complain to covered entity and HHS

Review Process:

 

• Another licensed healthcare professional (not involved in original denial) reviews
• Decision made within reasonable time
• Must grant or deny in full

Example Access Scenarios:

 

Scenario 1: Straightforward Request

 

Patient calls requesting complete medical records. You:

1. Verify identity

2. Provide/send access request form

3. Process within 30 days

4. Provide records in requested format

5. Charge reasonable, cost-based fee

6. Document request and fulfillment Scenario 2: Third-Party Request Patient’s lawyer requests You:
   1. Obtain patient’s written authorization (unless valid subpoena/court order)

2. Verify authorization is valid

3. Process like regular access request

4. Send to designated third party

5. Document

Scenario 3: Parent Requesting Adult Child’s Records

 

Parent requests records for 25-year-old child. You:

1. Determine if parent is personal representative

2. If child is competent adult, likely DENY (or get child’s authorization)

3. If denial, provide written denial with review rights

4. Document

RIGHT 3: REQUEST AMENDMENTS

 

The Right:

 

Patients can request that you amend (correct or supplement) their medical records if they believe the information is incorrect or incomplete.

Timeline:

 

• You have 60 days to respond
• Can extend ONCE for additional 30 days (must notify patient in writing of delay)

Accepting Amendment:

 

If you accept the request:

1. Make the amendment

2. Inform the individual

3. Obtain individual’s identification of persons/entities who need the amendment (and make reasonable effort to inform them)
4. Inform relevant business associates

5. Include amendment in future disclosures of that information

How to Make Amendment:

 

• Link amendment to original record (don’t delete original!)
• Identify as amendment
• Date of amendment
• Keep both original and amended information

Example:

 

Original: “Patient reports no alcohol use.”

Amendment: “Amendment 1/15/2025: Patient clarifies consuming 2 glasses wine nightly. Original statement reflected misunderstanding of question.”

Denying Amendment:

 

You CAN deny if:

 

• Information was not created by you (unless patient proves originator is no longer available)
• Information is not part of designated record set
• Information would not be available for inspection (psychotherapy notes, compiled for litigation)
• Information is accurate and complete

Denial Process:

 

Must provide written denial including:

• Basis for denial
• Patient’s right to submit statement of disagreement
• How to file statement
• How to file complaint

If Patient Submits Statement of Disagreement:

 

• You can prepare rebuttal
• Include patient’s statement and your rebuttal with record
• Include in future disclosures of that information

Example Amendment Scenarios:

 

Scenario 1: Clear Error

 

Record states patient is allergic to penicillin. Patient has no penicillin allergy – it’s their sister.

• ACCEPT amendment
• Correct error
• Note amendment date and reason
• Inform relevant parties (especially pharmacy, other providers)

Scenario 2: Difference of Opinion

 

Record states “patient non-compliant with diabetes management.” Patient disagrees, says they’ve been very compliant.

• May DENY (this is provider’s professional assessment)
• Explain denial reason
• Allow patient to submit statement
• Include their statement with record

Scenario 3: Information Created by Another Provider

 

Patient wants to amend specialist’s note in their primary care chart.

• May DENY (created by specialist, not you)
• Can append patient’s statement
• Suggest patient request amendment from specialist

RIGHT 4: ACCOUNTING OF DISCLOSURES

 

The Right:

 

Patients can request an accounting (list) of disclosures of their PHI made by you in the last 6 years.

Timeline:

 

• Provide within 60 days of request
• Can extend ONCE for 30 days (must notify patient of delay)

What Must Be Included:

 

For each disclosure:

• Date of disclosure
• Name and address of recipient
• Brief description of information disclosed

• Brief statement of purpose (or copy of authorization/request)

What Is NOT Included in Accounting:

 

Major Exclusions:

• Disclosures for treatment, payment, or operations
• Disclosures to the individual (patient themselves)
• Disclosures pursuant to individual’s authorization
• Incidental disclosures
• Facility directory or to persons involved in care
• National security or law enforcement (some circumstances)
• Disclosures before compliance date (April 14, 2003 for most)
• Limited data set disclosures
• Prior to date covered entity was required to maintain accounting

Practical Impact:

 

Most routine disclosures are excluded, so accountings are often short!

What Typically WOULD Be in an Accounting:

 

• Public health reporting (communicable diseases)
• Abuse/neglect reporting
• Court orders/subpoenas without patient authorization
• Workers’ compensation disclosures
• Disclosures to coroners/medical examiners
• Organ donation disclosures
• Research disclosures without authorization
• Health oversight activities

Fees:

 

• First accounting in 12-month period: FREE
• Additional accountings in same 12 months: Can charge reasonable, cost-based fee
• Must inform patient of fee in advance and give opportunity to withdraw/modify request

Suspension of Right:

 

In limited circumstances, HHS or law enforcement can request temporary suspension of patient’s right to accounting:

• Must be in writing
• Must specify time period
• You must maintain accounting but not provide to patient during suspension

Example Accounting:

 

“Accounting of Disclosures for Jane Doe

For Period: January 1, 2024 – January 1, 2025

1. Date: March 15, 2024

Recipient: County Health Department Information: Diagnosis of tuberculosis Purpose: Required public health reporting

2. Date: June 3, 2024

Recipient: Adult Protective Services

Information: Medical records regarding suspected elder abuse Purpose: Report of suspected abuse as required by law

3. Date: October 12, 2024 Recipient: County Coroner’s Office

Information: Medical records and cause of death (patient’s mother) Purpose: Death investigation

Total disclosures: 3″

RIGHT 5: REQUEST RESTRICTIONS

 

The Right:

 

Patients can request that you restrict:

• Uses and disclosures for treatment, payment, or operations

• Disclosures to family/friends involved in care or notifications

Your Obligation:

 

• You are NOT required to agree to most restrictions
• If you agree, you must document and comply
• Exception: If patient pays out of pocket in full, you MUST restrict disclosure to health plan

Mandatory Restriction – Pay Out of Pocket:

 

If ALL of these are met, you MUST agree:

1. Patient requests health plan not be informed

2. Disclosure would be to health plan

3. Disclosure is for payment or healthcare operations (not treatment)

4. Patient (or someone on their behalf) has paid in full out-of-pocket

Example:

 

Patient gets STD testing, pays $150 cash, requests you not bill insurance or disclose to insurance. You MUST honor this request.

Exception to Mandatory Restriction:

 

If disclosure is required by law, you may disclose even if patient paid out of pocket.

Voluntary Restrictions:

 

For other requested restrictions, you can:

• Agree to restriction
• Deny restriction
• Negotiate modified restriction

If You Agree:

 

• Document agreement
• Train staff on the restriction
• Implement systems to ensure compliance
• Comply with restriction until patient revokes or you both agree to terminate

Termination of Agreement:

 

• Patient can revoke at any time
• You can terminate prospectively (for future information) IF:
• You inform patient, AND
• Termination is only for PHI created/received after informing patient of termination

Example Restriction Scenarios:

 

Scenario 1: Mandatory – Out of Pocket

 

Patient: “I’m paying cash for this visit. Please don’t tell my insurance company.” Service: Primary care visit, $200

You MUST: Honor restriction; do not disclose to health plan

Scenario 2: Voluntary – Family Member

 

Patient: “Don’t give any information to my daughter, even though she’s listed as emergency contact.” You MAY: Agree to restriction, document it, ensure staff knows

Scenario 3: Request You Can’t Honor

 

Patient: “Don’t disclose my HIV status to any other provider.”

You SHOULD: Decline – could compromise patient safety and treatment. Explain why restriction could be harmful.

 

RIGHT 6: CONFIDENTIAL COMMUNICATIONS

 

The Right:

 

Patients can request that you communicate with them by alternative means or at alternative locations.

Your Obligation:

 

• Must accommodate reasonable requests
• Cannot require explanation for the request
• Cannot require them to provide “good cause”

Examples of Requests:

 

• “Call my cell phone, not my home phone”
• “Mail bills to my work address, not home”

• “Email me instead of calling”
• “Send texts instead of voicemails”
• “Only contact me at specific times”
• “Use my nickname, not legal name, when calling”

What is “Reasonable”?

 

Generally reasonable if:

• Logistically feasible
• Doesn’t disrupt care
• Patient provides alternative contact information
• You have capacity to accommodate

May Be Unreasonable:

 

• “Only communicate through my attorney” (for routine care communications)
• Requests that would significantly delay treatment
• Methods you don’t have technical capability for

Processing Requests:

 

1. Accept request (can provide form but can’t require form)

2. Determine if reasonable

3. Implement accommodation

4. Document request and how you’re accommodating

5. Train staff on the accommodation

6. Honor the request

Healthcare Providers:

 

Must accommodate if patient states request is needed to avoid endangerment

Health Plans:

 

Must accommodate if request is reasonable

Example Scenarios:

 

Scenario 1: Domestic Violence Victim

 

Patient requests all communications go to friend’s address, not home address where abuser lives.

• MUST accommodate
• Document special instructions
• Train relevant staff
• Ensure consistent implementation

Scenario 2: Privacy Preference

 

Patient prefers email for appointment reminders instead of phone calls.

• Should accommodate if you have email capacity
• Ensure emails are secure
• Document preference

Scenario 3: Work Address

 

Patient requests bills sent to work, not home.

• Reasonable request
• Accommodate
• Update mailing address for billing only (keep home address for medical records)

PATIENT COMPLAINTS

 

Right to Complain:

 

Patients have the right to file complaints if they believe their privacy rights have been violated.

Two Complaint Routes:

 

1. To Covered Entity:

 

• Must have process for receiving complaints
• Identify Privacy Officer or other contact
• Include in Notice of Privacy Practices
• Cannot retaliate against individuals who file complaints

2.  To HHS Office for Civil Rights:

 

• Patients can file directly with HHS
• Or after filing with covered entity
• No permission needed from covered entity
• 180 days from when patient knew or should have known of violation

Your Complaint Process Should Include:

 

1. **How to File:**

• Written or verbal
• Contact person/office
• Forms available (but not required)

2. **Receipt and Logging:**

• Acknowledge receipt
• Log all complaints
• Track status

3. **Investigation:**

• Prompt investigation
• Document findings
• Determine if violation occurred

4. **Response:**

• Respond to complainant
• Corrective action if needed
• Documentation

5. **Non-Retaliation:**

• No retaliation for filing complaint
• No intimidation
• No requirement to waive right to complain

Documenting Complaints:

 

Maintain log with:

• Date complaint received

• Nature of complaint
• Name of complainant (if they provided it)
• Investigation conducted
• Findings
• Resolution
• Date completed

Example Complaint Process:

 

Complaint Received:

 

“I received a bill at my home address even though I specifically requested all mail go to my work address.”

Investigation:

 

Review patient’s confidential communications request. Verify request was documented. Discover billing department not notified of special instruction.

Findings:

 

Confirmed: Patient had valid request on file. Violation occurred due to internal communication breakdown.

Resolution:

 

• Apologize to patient
• Correct mailing address in billing system
• Implement process to ensure special instructions communicated to all departments
• Retrain billing staff
• Follow up with patient
• Document corrective actions

PROCESSING PATIENT REQUESTS: BEST PRACTICES

 

General Principles:

 

1. Make It Easy

 

• Provide simple request forms
• Accept requests in multiple formats (written, verbal, email)

• Don’t create unnecessary barriers
• Be patient-friendly

2.  Verify Identity

 

• Ensure you’re responding to actual patient or authorized representative
• Use consistent verification methods
• Document verification

3.  Respond Timely

 

• Track all requests
• Meet deadlines
• Communicate delays if needed
• Keep patient informed

4.  Train Staff

 

• Everyone who might receive requests needs training
• Know how to recognize and route requests
• Understand timelines and requirements
• Customer service approach

5.  Document Everything

 

• Request received
• Actions taken
• Communications with patient
• Fulfillment or denial
• Lessons learned

6.  Have Standard Forms

 

• Access request form
• Amendment request form
• Accounting request form
• Restriction request form
• Confidential communications request form
• BUT: Don’t REQUIRE forms; accept requests in any format

7.  Track and Monitor

 

• Log all requests
• Monitor compliance with timelines
• Identify patterns
• Continuous improvement

8.  Communicate Clearly

 

• Plain language
• Patient-friendly explanations
• Clear instructions
• Contact information for questions

COMMON MISTAKES AND HOW TO AVOID THEM

 

Mistake 1: Charging Excessive Fees for Access

 

• Problem: Charging retrieval fees, staff time, system costs
• Solution: Only charge for copying labor, supplies, postage

Mistake 2: Delaying Responses

 

• Problem: Missing 30/60-day deadlines
• Solution: Tracking system, automated reminders, sufficient staff

Mistake 3: Denying Appropriate Requests

 

• Problem: Denying access or amendments without proper basis
• Solution: Training on valid denial reasons, legal review of denials

Mistake 4: Poor Documentation

 

• Problem: No record of requests or responses
• Solution: Centralized tracking system, consistent documentation

Mistake 5: Not Honoring Mandatory Restrictions

 

• Problem: Billing insurance after patient paid out of pocket and requested restriction
• Solution: Clear billing system flags, staff training

Mistake 6: Requiring Explanations for Confidential Communications

 

• Problem: Asking “why” patient wants alternative contact
• Solution: Train staff to simply accommodate reasonable requests

Mistake 7: Ignoring Complaints

 

• Problem: Not investigating or responding to patient concerns
• Solution: Formal complaint process, prompt investigation

Mistake 8: Retaliation

 

• Problem: Treating patients differently after they exercise rights
• Solution: Non-retaliation policy, staff training, monitoring

Mistake 9: Making Requests Too Difficult

 

• Problem: Complex forms, requiring in-person requests, excessive documentation
• Solution: Simple processes, multiple request methods, patient-friendly approach

Mistake 10: Not Updating Processes

 

• Problem: Policies don’t reflect current HIPAA requirements
• Solution: Regular policy review, stay current on regulations

TECHNOLOGY AND PATIENT RIGHTS

 

Patient Portals:

 

• Give patients 24/7 access to records
• Satisfy access requests efficiently
• Can reduce administrative burden
• Must still honor requests for specific formats or delivery methods

Electronic Requests:

 

• Accept requests via patient portal, email, website
• Verify identity
• Respond electronically if requested

Mobile Health Apps:

 

• Patients may request data from apps
• Covered entities responsible for data they maintain
• App developers may be business associates

Interoperability:

 

• Patient right to access includes right to direct information to third parties
• Must support patient-directed exchange
• APIs and modern interfaces required (21st Century Cures Act)

KEY TAKEAWAYS

 

• Patients have six major rights under HIPAA
• Notice of Privacy Practices must be provided at first service and be readily available
• Patients have right to access records within 30 days; can extend once to 60 days
• Can only charge reasonable, cost-based fees for copying – not retrieval or search
• Patients can request amendments; you can accept or deny with proper justification
• Accounting of disclosures doesn’t include TPO or disclosures to patient
• MUST honor restriction if patient pays out of pocket in full
• MUST accommodate reasonable confidential communications requests
• Patients can complain to you and/or HHS
• Cannot retaliate against patients who exercise their rights