Patient Requests Amendment of a Diabetes Diagnosis
A 45-year-old patient requests an amendment to her medical record. She states that the 2022 visit note incorrectly lists type 2 diabetes (E11.9) because a single A1c was 6.6% and no repeat test was done. The record contains the lab report, the physician's note, and a diagnosis code E11.9. The practice's privacy officer receives the written request on March 3. The physician reviews the record and believes the diagnosis was accurate at the time, based on the lab and documented symptoms, and does not want to remove the entry. The patient also asks for a copy of her entire record, and the practice receives a subpoena from an attorney for the same record. The privacy officer must decide how to respond, what must be documented, and what can be released. The practice is a covered entity and does not have a state law that is more stringent.
1. What must the privacy officer do with the amendment request, and what timeline applies?
Read the worked answer
The patient has a HIPAA right to request an amendment. The privacy officer must accept the written request, review it, and respond in writing within 60 days. One 30-day extension is allowed if the practice notifies the patient in writing before the original deadline and gives the reason for the delay. The response must state whether the amendment was accepted or denied, and if denied, the basis for the denial and the patient's rights.
The practice must document the request, the review, the decision, and the response date. The physician's disagreement does not eliminate the patient's right to ask; it supports a denial if the practice determines the record is accurate and complete. The original lab report and note must not be deleted.
2. Can the practice deny the amendment? What happens if it does?
Read the worked answer
Yes. A covered entity may deny an amendment if it determines that the record is accurate and complete, or if the information was not created by the practice and the originator is available. Here the physician believes the diagnosis was accurate based on the A1c and documented symptoms, so the practice may deny. The denial must be in writing, explain the basis, and tell the patient about the right to submit a statement of disagreement.
If the patient submits a statement of disagreement, the practice must include it in future disclosures, or include an accurate summary of the disagreement. The practice may also include a rebuttal. The original entry remains in the record; the patient's statement and the practice's response become part of the record. The privacy officer should document all of this.
3. How should the subpoena and records request be handled?
Read the worked answer
The patient's request for a copy of her record is a right-of-access request. The practice should provide the requested record within the required timeframe and may charge only a reasonable, cost-based fee as permitted by HIPAA. The practice should not condition access on the amendment request.
The attorney's subpoena is not the same as a HIPAA authorization. The practice may disclose in response to a subpoena if it receives a court order, or if it receives satisfactory assurances that the patient has been notified and has not objected, unless state law is stricter. The practice should release only the minimum necessary information and should verify the validity of the subpoena. Psychotherapy notes, if any, require a separate authorization. The privacy officer should log the disclosure and retain the subpoena and assurances.