Health Information Compliance Alert

Expert tips to help you follow the rules

Scenario: A patient asks you to correct a mistake in his medical record. You note the request and get back to work. If that sounds familiar, you could be well on your way to a privacy rule violation. Here's some professional guidance to get you on the right path.

Play It Straight

HIPAA obligates your organization to acknowledge a patient's request to correct information in her file (Section 164.526). Once you've accepted the request, you have to decide whether the amendment is necessary.

But your duty doesn't stop there. You must follow up the request by either fulfilling or denying the request no later than 60 business days from when it was received. And whether you make the amendment in full, make it in part or choose to deny it, you must inform your patient of both your decision and how you came to it.

Find A Traffic Controller

To keep your PHI amendment process swift and efficient, you've got to decide who will be responsible for managing the amendment requests you receive. Tip: Send all amendment requests to a central person so she can filter and screen the requests before farming them out to the appropriate physician, counsels William Hubbartt, a consultant with Hubbartt & Associates in St. Charles, IL.

"The privacy officer should control the process to maintain quality," recommends Kevin Troutman, an attorney with New Orleans-based Fisher & Phillips. But, the privacy officer could develop the process and then delegate the responsibilities to another skilled professional, offers attorney Gina Cavalier of Sonnenschein, Nath & Rosenthal in Washington, DC.

Don't Assume

Before you accept any amendment forms, you have to be absolutely positive the person making the request is authorized to do so. While it might seem obvious, asking for a patient's identification or proper legal documents will keep you out of the privacy rule violation hot seat.

For example, if a parent asks you to change information in his child's medical record, you must first ensure he really is that child's parent. Then you must determine that he is the legal guardian who is authorized to make changes, explains Troutman.

Key: Keep your physicians involved in the amendment process so they can determine whether the information is correct. Example: Patients who find potentially damaging information in their records (such as drug-seeking behavior or other types of substance or physical abuse) usually demand that it be changed. The physician is in the best position to know whether that information must remain, or whether that data is a mix-up, Troutman says.

Warning: "You cannot revise the diagnosis just because the patient doesn't like it," Troutman reminds. What you can do, however, is append the record with an explanation or clarification of the information.

Failure to stand up for a correct diagnosis, or allowing patients to doctor their medical records to reflect inaccuracies, could lead you into bigger trouble than a mere HIPAA violation, Troutman cautions. "There could be medical malpractice implications with a false diagnosis," he contends.

Accept That Mistakes Happen

Of course, medical errors do show up in patients' records. Perhaps the information was transcribed incorrectly or John H. Doe's information winds up in John K. Doe's medical record. In those cases, you'll want to expedite the amendment request, Troutman says.

You can't change information that you didn't create, experts remind. "If you only received the medical information, you aren't in a position to know if it's accurate," Troutman explains. In that situation, you should send the patient to the official or office that can decide whether to make the amendment.

"The purpose of patients' right to amend is to correct errors, not create a way to avoid disclosing information that might be necessary for care or treatment," asserts Hubbartt. If the information is correct, but the patient doesn't want it included in non-covered disclosures, "allow her to revoke any authorizations," he offers.

Put It In Writing

Documentation of your amendment interaction with patients is crucial to compliance. You could keep copies of your response to the request, along with the request itself, with your HIPAA material, Troutman suggests. Without detailed record-keeping, you won't be able to show proof that you upheld your end of the HIPAA bargain.

Remember: Though you don't need to include all documentation in the record, the privacy rule does maintain that some documentation be linked to the patient's file. The rule states that you must attach "the individual's request for an amendment, [your] denial of the request, the individual's statement of disagreement, if any, and [your] rebuttal" to the record.

The Bottom Line: Once you've made your decision and taken the right steps to inform your patient, "you shouldn't vary the process," Cavalier affirms. Consistency will help you target and fix problem areas before a complaint is filed, she says.

And don't forget that HIPAA isn't the only regulation you must abide by. Before you make amendments to your patients' records, be sure your state hasn't already set guidelines for how you must handle sensitive information.