When a Patient Requests to Amend their Medical Record
How to fulfill their legal right, legally.
Patients have a federal right to “request to amend” their medical record. This right is conferred by the Standards for Privacy of Individually Identifiable Health Information, otherwise known as the HIPAA Privacy Rule of 2001 (45 C.F.R. § 164.526). Let’s review legal details so you can best formulate policy and practice for your medical setting.
Know the Rule for Privacy
Per the Privacy Rule, a provider may require the patient to make a request for amendment in writing and provide a reason to support the request. In receipt of the patient’s written request, the provider has 60 days to respond with written notification. If needed, the provider may extend time to respond for another 30 days.
If the provider accepts the patient’s request to amend the record, the provider must make the change in the medical record, and then inform the patient that the change has been made.
“Link and Notify” All Affected Parties
The provider must review the chart to see who else may be affected by the change. Another provider who shares in caring for the patient, for example, may need to be alerted of the content change. Other parties, such as business associates and the insurance carrier, also may need to be informed of the amendment. This “link and notify” obligation helps to prevent detriment to the patient due to inaccurate information in the medical record. This is crucial if, for example, the medical record mistakenly identified the wrong extremity or omitted the prescription use of an anticoagulant medication.
Understand Patients’ Rights and Options
The provider may deny a patient’s request to amend. In denying the amendment, the provider must provide an explanation to the patient for the denial in plain language and in a timely manner. In this notification, the patient must be given the option to submit a statement of disagreement. The patient must also be given options to further complain, such as the name and telephone number of the health system’s compliance officer and relevant government agencies. If the patient submits a statement of disagreement, then the provider may issue a rebuttal statement.
Recordkeeping is crucial because ignoring a patient’s request to amend the record is a HIPAA violation. The Office for Civil Rights (OCR) has an online complaint portal and a toll-free number to trigger investigations. The OCR is empowered to assign civil money penalties and, with the Department of Justice, to enforce criminal prosecutions to medical providers.
If the record is amended, be sure to note the amendment in the medical record. Providers should never delete any portion of the medical record. Penalties skyrocket if there is evidence of retaliation against the patient. Retaliation could be evident if something derogatory is written about the patient in the chart because of the request to amend the medical record.
The Privacy Rule does not allow the provider to charge a fee to the patient for any work performed to receive, deny, or approve a patient’s request to amend the health record.
Discuss, Chart, and Implement Policy
At an upcoming compliance meeting, consider discussing rules regarding a patient’s request to amend the medical record. Create flow charts to track what happens, and develop policy by role playing a few scenarios. For example:
- A patient discovers that his magnetic resonance imaging (MRI) order lists the wrong shoulder after he gets home from a visit to your office.
- A patient reads his medical record and states the documented history does not match what he expressed at his medical encounter.
- A patient requests to amend the record by adding “back pain.” He cannot remember if he discussed it at the medical visit, but he would like it added. In addition, he would like an order for an MRI.
Example 1 seems easy to remedy, but changing the diagnosis from left shoulder pain to right is more complicated because a diagnostic code needs to be changed from M25.512 Pain in left shoulder to M25.511 Pain in right shoulder. From a link and notify perspective, do other providers need to know of this change?
Example 2 is likely to occur with the prolific use of electronic health record templates and copy forward functions.
Example 3 demonstrates the need to evaluate and manage patient concerns with a history, examination and medical decision-making.
Chart and establish policy based on this summary of information:
- The patient should submit a written request to amend the health record.
- The provider has 60 days to respond with written notification, and may extend the time frame an additional 30 days, if necessary.
- The provider may deny the patient’s request to amend the record with written explanation to the patient in plain language.
- If the provider denies the amendment, then the provider must give the patient the option to submit a statement of disagreement to a compliance officer or government agency.
- The patient should be aware the OCR operates an online portal www.ocrportal.hhs.gov and toll-free number (800)368-1019 to receive complaints.
- If the provider accepts the patient’s request to amend, then the amendment must be made and the record must be reviewed for link and notify obligations.
- If a provider receives a notification of the amendment from another provider, then the provider who receives the notification must review the patient’s record to determine whether the amended information alters the assessment and plan for the patient’s problems.
- The HIPAA Privacy Rule prohibits charging a patient for any work related to a request to amend the medical record.
By establishing a consistent policy among staff members, you will be able to handle patient amendment scenarios.
Cornell Law School, 45 CFR 164.526 – Amendment of Protected Health Information: