Privacy Policy Individual Right: Access to Protected Health Information

FULL POLICY LANGUAGE:

Policy Purpose:

It is the policy of Shenandoah Pain and Palliative Care Clinic (SPPCC/ ”Organization”) to honor an individual’s right to access, inspect, and obtain a copy of their PHI contained in the designated record set and to charge only allowable fees for such access.

Policy Description:

This policy describes SPPCC responsibility for providing access to a designated record set to individuals for as long as the record is maintained and the procedures for ensuring individuals' timely rights to access, inspect and copy their protected health information and seek review of some denials of access.  Additionally, the policy establishes the requirements for determining and charging reasonable fees related to access requests by individuals.

Procedures:

Accessing and Inspecting PHI: Timing and Process

1. An individual must make a request to a member of the workforce to access, copy, or inspect their PHI. Whenever possible, this request shall be made in writing, using a “Patient Request for Access to Patient Medical Records” form. SPPCC will make a note, in the patient’s health record, of the request.
2. The workforce member who receives the request should direct it to the individual designated to handle such requests.  If no such person is available and the workforce member is unsure of whether access is appropriate, they should contact their supervisor or the Privacy Officer to help make that determination prior to allowing or denying access.
3. When access is granted, SPPCC will provide access to the requested PHI and furnish a copy if requested within a reasonable time but no later than 30 days from the date of the request unless the Organization is not able to provide access within 30 days.  See below for the requirements on the form and fees for copies. 
4. Where it cannot provide access within the 30-day time limit, before the 30 days expire, Organization will provide the individual a written notice of the reasons for the delay and include a date when access will be available.  Organization will respond to all requests for access within 60 days of the individual’s request.  A second extension beyond 60 days is not available.
5. SPPCC must document and retain the Designated record sets containing the PHI that is subject to access. SPPCCmust document and retain the titles of persons or offices responsible for receiving and processing requests for access.  These records must be maintained for a minimum of six years form the date of creation or the date it was last in effect.  

 

When Access, Inspection and/or Copy Request is Granted:

1. Individual and SPPCC will arrange a mutually convenient time and place for the individual to inspect and/or obtain a copy of the requested PHI within the designated record set.  Inspection and/or copying will be carried out on site at the SPPCC with staff assistance if necessary.
2. The patient may choose to inspect the PHI, copy it, or both, in the form or format requested. If the PHI is not readily producible in the requested form or format, SPPCC must provide the patient with a readable hard copy form, or other form or format as agreed to by SPPCC and the individual.

1. If the individual chooses to receive a copy of the PHI, SPPCC may offer to provide copying services. The patient may request that this copy be mailed.
2. If the individual chooses to copy their own information, SPPCC may supervise the process to ensure that the integrity of the patient record is maintained.
1. Whenever the PHI in the designated record set is maintained electronically, if the individual requests an electronic copy, SPPCC will provide access in the electronic form and format requested unless it is not readily producible that way.  If it is not readily producible in the requested format, SPPCC and the individual will agree to a different readable electronic format for production. 
2. Upon prior approval by the patient, SPPCC may provide a summary of the requested PHI and charge an agreed upon fee (must not exceed the fees allowed – see fee section below).
3. If, upon inspection of the PHI, the patient believes the PHI is inaccurate or incomplete, the patient has the right to request an amendment to the PHI. SPPCC shall process requests for amendment as outlined in Privacy Policy 17.0: Individual Right: Request Amendment to Designated record set. 

Fees

SPPCC may charge a reasonable cost-based fee for the production of copies (including electronic copies) or a summary of PHI pursuant to the request of an individual (or their personal representative) for their own personal use.  SPPCC may decide to waive such fees.  For electronic record requests, SPPCC may decide to charge a flat fee in lieu of a cost-based fee.

Such fees may only include the actual or average cost of:

1. Labor for copying the protected health information, whether in paper or electronic form;
2. Supplies for creating the paper copy if paper is requested;
3. Electronic media if the individual requests an electronic copy be provided on portable media;
4. Postage when the individual requests that the phi or summary be mailed; and
5. Preparation of a Summary or Explanation of the PHI when the individual was informed in advance and agreed to the stated fee.

SPPCC, unless charging the flat fee for electronic records, elects to utilize the actual cost associated with the requests rather than determining average or per page costs in determining fees.  

Such fees may not include:

1. costs associated with verification; documentation; searching for, handling, or retrieving the PHI; processing the request; maintaining systems; or recouping capital for data access, storage, or infrastructure, even if such costs are authorized by State law. 
2. Fees established by state law where such fees are in excess of that allowed under HIPAA.  State laws typically permit providers to charge a per-page copy fee, of up to a certain dollar value, or to charge a flat fee of up to a certain amount for the entire medical record. These fees are untethered to the actual costs of reproduction and can be in excess of that allowed under HIPAA.
3. Costs for providing, releasing, or delivering medical records or copies of medical records, where the request is for the purpose of supporting the application, claim, or appeal for any government benefit or program requested by the relevant government entity or at the individual’s request.

Flat Fee

SPPCC, in its discretion, may charge individuals a flat fee for all requests for electronic copies of PHI maintained electronically, provided the fee does not exceed $6.50, inclusive of all labor, supplies, and any applicable postage.SPPCC may charge this fee in lieu of going through the process of calculating actual or average allowable costs for requests for electronic copies of PHI.

Access, Inspection, and/or Copy Request is Denied in Whole or in Part:

SPPCC will deny access to any PHI without the opportunity for review if it contains:

1. Psychotherapy notes (See Privacy Policy 19.0: Psychotherapy notes for further details); or
2. Information compiled in reasonable anticipation of, or for use in, civil, criminal, or administrative action or proceeding. 

If any part of the designated record set is separate from psychotherapy notes or information compiled in anticipation of legal proceedings, Organization shall allow access to that part of the record.  

SPPCC May Deny Access without Providing the Individual an Opportunity for Review, in the Following Circumstances:

1. When SPPCC is acting under the direction of a Correctional Institution and may deny an inmate’s request if it were to jeopardize the health, safety, security, custody, or rehabilitation of the individual, other inmates, or any other person at the correctional institution.
2. When PHI created in the course of research that is still in progress, provided the individual has agreed to the denial of access when consenting to participating in the research that includes treatment, and the covered health care provider had informed the individual that the right of access would be reinstated upon completion of the research.
3. When PHI in the designated record set was obtained under promise of confidentiality from someone other than a healthcare provider and giving access would reveal the source of the information.
4. An individual’s access to PHI that is contained in records that are subject to the Privacy Act (also known as the Freedom of Information Act) may be denied, if the denial of access under the Privacy Act would meet the requirements of that law.

SPPCC May Deny Access but will Provide the Opportunity for Review of Denials in the following Circumstances:

1. When a licensed healthcare professional (exercising their professional judgment) has determined that the accessrequested is reasonably likely to endanger the life or physical safety of the individual or another person.
2. When the PHI makes reference to another person (unless that person is a healthcare provider) and a licensed healthcare professional has determined in exercise of professional judgment, that the access requested is reasonably likely to cause substantial harm to the person.
3. When request for access is made by a personal representative of an individual and a licensed healthcare professional has determined in exercise of professional judgment that providing access to that representative can reasonably be expected to cause substantial harm to the individual or another person.

Denials of Access: Timing, form and Review:

If SPPCC denies access in whole or in part in any of the circumstances described above, the following requirements will apply to the denial:

Making Other information Accessible:  SPPCC will give the individual access to the protected health information that is not excluded under the denial to the extent that it is possible to separate the information for which SPPCC has a basis for denial.  

Denials will be in writing:

SPPCC must provide a written denial in plain language to the individual. The denial will contain the following elements:

1. The basis for the denial;
2. A statement of the individual's review rights for reviewable denials; and
3. A description of how the individual may complain to SPPCC or to the Secretary of Health and Human Services (HHS) including at a minimum the title and telephone number of the individual designated to handle complaints for SPPCC.

Other Responsibilities When Access is Denied:

1. If access is denied because SPPCC does not maintain the PHI that is the subject of the request, and SPPCC knows where that PHI is maintained, SPPCC must inform the individual where to direct the request for access.
2. If access is denied under a situation where that denial may be reviewed, an individual has the right to have the denial reviewed by a licensed healthcare professional who is designated by SPPCC to act as a reviewing official.  Organization will designate a licensed professional to review the original access decision.   The reviewing professional must be someone who did not participate in the original decision to deny access.
3. The patient must initiate the review of a denial by making a request for review to SPPCC. If the patient has requested a review, SPPCC must provide or deny access in accordance with the determination of the reviewing professional, who will make the determination within a reasonable period of time.
4. SPPCC will promptly provide written notice to the individual of the determination of the reviewing professional and also act promptly on the reviewer’s decision if they have granted access. 

RELEVANT HIPAA REGULATIONS:

45 CFR 164.524 Access of Individuals to Protected Health Information