Patient Rights and Individual Access
The Access Right
Individuals have a right to inspect and obtain a copy of their PHI in a designated record set, in the form and format requested if readily producible, including electronic copies. The response deadline is 30 days, with one 30-day extension permitted if the individual is notified in writing of the reason and the date. Reasonable, cost-based fees may be charged for copies; fees for time and labor to fulfill access are constrained.
Other Individual Rights
Individuals may request amendment (the entity may deny under specified grounds and must allow the request to be appended), request an accounting of disclosures (generally covering six years, excluding disclosures for treatment, payment, and operations), request restrictions (entities must agree to certain restrictions, including restrictions on disclosure to a health plan when the individual pays out of pocket in full), request confidential communications by alternative means or locations, and receive a paper copy of the Notice of Privacy Practices.
Traps Candidates Miss
- Psychotherapy notes have special protections and are largely excluded from the access right.
- Denials must be reviewable; some denials (such as for safety) are reviewable by a licensed professional, others are not.
- The accounting excludes TPO disclosures, so candidates who list treatment disclosures in an accounting are wrong.
- Verification of identity is required before granting access, but that is not a basis to delay indefinitely.
Rule of Thumb
When a question asks what an individual may demand, default to "access, amendment, accounting, restrictions, confidential communications, and notice"-then check whether a specific exclusion (such as psychotherapy notes) applies.
Worked Example
A patient requests an electronic copy of records in a specific file format. If the format is readily producible, provide it; if not, offer a readable electronic form and explain the options. Do not simply refuse because the format is inconvenient.