One important part of HIPAA is the right of an individual to have access to and request a copy of their protected health information (PHI). This section of HIPAA allows you to request a copy of your health information held in your medical records. Your medical records may include your billing and payment records that are maintained by either a provider or a health plan.
Under HIPAA requirements a record includes any item, collection or grouping of information that includes your PHI that is
- Maintained,
- Collected,
- Used, or
- Shared
by or for your doctor or health plan. Practically, your medical record includes your paper records, your records held electronically, your test results, any MRI or X-Ray files, and other similar information and documents.
Under some circumstances your medical information is used in research. You also have the right to ask for access and a copy of this special part of your medical record if it is kept in a designated record set. A designated record set is also a HIPAA term. It is the group of records that the researcher uses to make medical and service decision.
A covered entity, including health plans, health clearing houses and healthcare providers, must honor your request within 30 days of receiving the request. If a paper copy is requested, you can be charged a reasonable fee to cover the cost of the copying of the paperwork. If you agree to the proposed fee, usually you will be provided with a written summary of your requested information instead of the actual copies.
Under HIPAA neither FEP nor your doctor will release:
- Psychotherapy notes;
- Information gathered for reasonable anticipation for use in a civil, criminal or administrative action or proceeding; and
- Information obtained in the course of research, including treatments
It is important to remember that a health plan or provider can deny access to certain pieces of information. If they do, they must notify you with the reason for the denial.
If the information you requested is denied, you will have an opportunity to review the denial. Examples of denials:
- Access to the information could cause harm to the patient;
- The information that names another individual in the record; and
- The information is requested by a personal representative and releasing it could cause harm to patient.
A personal representative, including advocates and family members, may request access to a patient's medical records. For example, a wife may make decisions for her husband when he is incapable of doing it because of an accident, but she would not have access to medical records with information prior to this medical treatment.
Access to your health information can be a powerful tool for you, the consumer. By having access to your information, you can ensure that it is being used properly and is correct.