The Patient Who Wants the Whole Chart
A patient, Mr. Okafor, requests 'everything you have on me' from a behavioral health clinic that also provides primary care. The clinic has: (1) psychotherapy notes from his counselor; (2) progress notes and medication records from his psychiatrist; (3) lab results from his primary care visits; and (4) billing records. He asks for the records by email to a personal address he shares with his adult son. He is requesting on a Friday; the clinic's policy says 'up to 60 days.' The clinic uses a certified EHR and has not yet adopted the information-blocking rules in its written policy. The clinic's privacy officer wants to know what must be produced, in what form, and by when.
1. Which of the requested records must be produced, and which may be withheld or handled differently?
Read the worked answer
Break the chart into categories:
- Psychotherapy notes - these are separately protected under §164.508(a)(2) and require a separate, specific authorization to disclose. They are not part of the general right of access. The clinic may withhold them absent that authorization, but it must not lump them in with the rest of the record as if they were ordinary notes.
- Psychiatrist's progress notes and medication records - these are not psychotherapy notes. They are part of the designated record set and must be produced. This is the most common error: treating all behavioral health notes as psychotherapy notes.
- Lab results and billing records - part of the designated record set; produce them.
So the answer is: produce everything except the psychotherapy notes, and explain the withholding in writing with the patient's appeal rights.
2. Evaluate the email request and the clinic's 60-day policy. What must the clinic do differently?
Read the worked answer
Email: The patient may request delivery by email, and the clinic must accommodate a reasonable request for form and format if it can. But the clinic should not simply send PHI to a shared address without addressing the risk. The Privacy Rule permits email if the patient is advised of the risks and still requests it; the clinic should document that conversation. Sending to an address the patient shares with his son is a real risk the clinic should flag, not silently accept. The clinic may also offer a secure portal as an alternative.
Timeline: The 60-day policy is out of date and, for the access right, the standard is 30 days, with a single 30-day extension permitted if the clinic notifies the patient in writing of the reason and the date by which it will respond. A blanket 'up to 60 days' policy is not a permissible default. The clinic must act within 30 days, and if it needs the extension, say so in writing.
Fee: The clinic may charge a reasonable, cost-based fee for copies, but not for the labor of searching or reviewing.
3. The clinic's written policy does not reflect the information-blocking rules. Does that change the answer?
Read the worked answer
It changes the risk profile, not the underlying access obligation. The right of access exists independently of information-blocking rules. But the absence of information-blocking provisions in the written policy is itself a governance gap: the clinic should review and update its policies, and the privacy officer should not treat 'our policy says 60 days' as the legal standard.
The practical takeaway: the clinic should (a) produce the non-psychotherapy records within 30 days, (b) document the email risk discussion, (c) explain the psychotherapy-notes withholding and appeal rights in writing, and (d) fix the policy. Each of these is a separate deliverable, and a regulator will look for all four.