HIPAA: Medical Information Privacy but also Patient Access

In the United States, HIPAA is the Health Insurance Portability and Accountability Act which together with the Federal Privacy Regulations of April 2001 and the Joint Commission on Accreditation of Healthcare Organizations (JCAHO) has established the law and standards which are aimed at protecting the privacy of an individual’s healthcare information and regulating access to it. HIPAA defines who has access to the information and establishes the patient’s rights. This thread will deal with patient’s rights with regard to their medical information, one of which includes the right (with minimal limitation) of the patient to access and read medical records which contain their personal medical information.

To get started on this topic, here is a recent e-mail I received from a visitor. By the way, in keeping with HIPAA regulations I am not identifying the writer or providing any other personal identifying information in order to protect patient privacy. I am assuming that the scenario itself is common and the few details presented are not specific enough to provide such personal identification for someone who is not already aware of the individual and the details.

I am trying to find out more information on the topic of transferring one patients records from one PCP to another PCP.

The original PCP had been my fiancees PCP since childhood. In the last two years my fiancee had developed several symptoms and the original PCP had run an EKG and an MRI two years ago and let it go at that. The symptoms still bothered him and continually grew worse. The originally PCP treated it more like drug seeking behavior and whining and never addressed the issues or pursued more testing. My fiancee has insurance through his employer and payment was not the concern. At much badgering from me my fiancee finally switched PCP's. Upon requesting the transfer of his medical records to the new PCP the old PCP only sent a letter and a copy of the most recent blood work and the EKG, no other history was included.

Is this considered with the parameters of medical history for a patient considering the extent of time he was with the original PCP?

The new PCP has found several very alarming conditions that have been untreated and undiagnosed because of the other PCP's lack of time with my fiancee. At this point she is looking for all the information she can get her hands on to develop a treatment plan that is aggressive.

I am extremely concerned because ethically I thought all of the patients case history was to be sent once the patient released it and the PCP was not allowed to pick and choose.

Please clarify if at all possible.

I wrote the patient back the following:

If a summary of a patient's medical condition is inadequate, to my knowledge, the patient has every right to access to a copy of the entire chart for transfer to another physician. In the U.S., patients can read their own chart except for psychoanalysis commentary. Check with a lawyer regarding transfer of records in your community.

Here are the details pertinent to this topic as obtained from the Los Angeles County Department of Health Services HIPAA Privacy and Security Comprehensive Self-Study Guide (content adapted from Health Care Compliance Strategies, Inc. revised November 2005.)

A. HIPAA empowers patients by guaranteeing them access to their medical records, giving them more control over how their protected health information is used and disclosed and providing a clear avenue of recourse if their medical privacy is compromised. The Privacy Standards protect medical records and other personal health information maintained by health care providers, hospitals, health plans and health insurers.

B. HIPAA and the Federal Privacy Regulations (April 2001) established the patient’s right to maintain the privacy of their health information. These rights give the patient a right to access their personal health information (PHI), amend their PHI, receive an accounting of disclosures of the PHI, request restrictions on the use of their PHI, file complaints and receive notice.

1. Right to Access: Patients have the right to access and inspect their health record and obtain a copy from their health care provider. Patients may access or copy their health records for as long as the information is retained. There are few exceptions to access related to psychotherapy notes and protections under state law.

(HIPAA requires that requests be granted within 30 days if the information is located on-site and within 60 days if the information is located off-site. However, California state law is more stringent and requires requests be granted with 15 days regardless of where the information is located.)

2. Right to Amend: Patients have the right to request an amendment to their medical record. The request must be put in writing and submitted to whoever maintains the medical record. The organization will then review the request and determine agreement or disagreement. The request for amendment becomes part of the permanent medical record.

3. Right to Account for Disclosures: Patients have the right to request a list of when and where their confidential information was released (within the last 6 years but not prior to April 16 2003), the date of disclosure, the name and address of the person or entity who received the information and a brief description of the reason for disclosure. Disclosure is permitted for treatment, payment or healthcare operations.

4. Right to Request Restrictions: Patients have the right to request their provider or hospital to restrict the use and disclosure (release) of their PHI. However, the provider or hospital is not required to comply with the request if the use and disclosure does not otherwise violate HIPAA Privacy Standards.

5. Right to File a Complaint: Patients have the right to file a complaint if they believe their privacy rights have been violated.


6. Right to Receive Notice: Patients have the right to receive a Notice of Privacy Practices handout, which describes how medical information may be used and disclosed and how to access and obtain a copy of their medical record. It also provides a summary of patient rights under HIPAA, describes how to file a complaint and gives relevant contact information.

OK, so those visitors to this blog who live within the United States know your rights. You may want to check with governmental resources within individual states regarding state changes as noted above with California. Those from outside of the United States should check with their local governmental agencies regarding the rules or laws applying to personal medical information. Keeping personal medical information private and restricted only to those who need to know is not only an ethical practice but is now the law in the United States.

Now, I would like to pose an ethical question to my visitors. The fact that the HIPAA law allows patients to have access to their medical record and to read it, do you think that this right is always in the best interest of the patient and also would this right, at times, be unpractical? Doctors notes and records can be difficult to read not only by handwriting (if handwritten) but also the meaning and significance of the words may be obscure to the patient unless reviewed along with the physician. This would require additional time spent with the patient for the doctor to provide this guidance to the patient. How should the doctor balance this time with the duty to the ill patients awaiting a visit in the waiting area? Should the doctor charge for this service to the patient? Beyond psychiatry notes restricted to be accessed by law, would there be other parts of the doctor's notes which should be off-limits to the patient? Think about it.. and let us know. ..Maurice.

Graphic: My ArtRage combination of graphics to form "Zippered Lips".