The Access Request That Arrived in Three Parts
A 34-year-old patient submits a portal request for 'my complete record,' including counseling notes from 2019 when she saw a hospital-employed therapist, and asks that a copy be sent to a consumer health app she uses. Separately, she requests an amendment: she says the 'history of alcohol dependence' entry on her problem list is wrong and asks that it be deleted. State law allows 45 days to respond to access requests, and the release-of-information vendor charges $0.75 per page plus a $25 search fee. The designated record set includes two pages of psychotherapy notes and a 2018 note referencing a genetic test ordered by an outside physician. The patient has called twice asking why it is taking so long.
1. Address the deadline, the fee, and what must be included in the copy she receives.
Read the worked answer
Three issues: deadline, fee, and scope.
- Deadline. HIPAA gives 30 days with one 30-day extension on written notice. The state's 45-day rule does not extend the federal deadline; comply with the shorter one. The clock started when the portal request was received, and her two calls should have produced a status letter, not silence.
- Fee. Only a reasonable, cost-based fee is allowed: labor for copying, supplies, and postage. A flat $25 search fee plus $0.75 per page will typically exceed actual cost for an electronic record, and many states cap the charge lower still. Recalculate or waive it, and tell her in writing.
- Scope. The designated record set includes records used to make decisions about her - problem list, visit notes, labs, and the 2018 note referencing the outside genetic test. It excludes the two pages of psychotherapy notes, which require a separate authorization, and it excludes information compiled in reasonable anticipation of a legal proceeding.
Response: deliver the electronic copy within 30 days, explain in writing why the psychotherapy notes are withheld and how to authorize their release, and correct the invoice.
2. She directs that a copy go to a consumer health app. Must the hospital comply, and what are its obligations afterward?
Read the worked answer
The right to direct a copy to a third party is a real right, and the app is not the hospital's business associate for this purpose.
- The patient may direct in writing, including electronically, that the copy go to a designated app or device. The hospital must honor a clear direction and may not condition access on using its own portal.
- The fee for a directed copy is the same cost-based fee; the hospital cannot bill the app.
- Once the copy is delivered, the information is outside the hospital's control. The developer is not acting on the hospital's behalf, so no BAA is required and the hospital is not liable for the app's downstream use. Tell the patient plainly that the app's handling of the data is outside HIPAA's protections.
- The directive covers a one-time copy. Any ongoing data feed is a separate arrangement needing its own analysis.
- Log the directive and the disclosure for accounting purposes, and keep a copy of the direction itself.
3. How should the amendment request be handled, given that she wants the entry deleted?
Read the worked answer
Amendments are not deletions, and deletion is not an option the rule offers.
The process:
- The patient has a right to request an amendment; the hospital has 60 days, with one 30-day extension, to act.
- The clinician who recorded the history decides whether the entry is accurate and complete in light of the whole record - not whether the patient dislikes it.
- If it is wrong, amend it, notify the author and anyone the patient identifies as needing the correction.
- If the clinician still believes the entry is accurate, deny in writing with the reason, and explain the right to submit a statement of disagreement. Include that statement in future disclosures, with the option of a rebuttal.
- Never delete the original entry. The legal record requires the correction to be visible as a correction.
Practical step: offer a conversation with the clinician before issuing a formal denial. Most amendment disputes are documentation disputes, and a clarifying addendum - 'patient reports no history of alcohol dependence; prior entry reflects self-report at intake' - resolves them faster and more honestly than a denial letter.