Patient rights under HIPAA

Patient Rights - The Core Six

• Access: Right to inspect & receive a copy of their Protected Health Information (PHI).
• Amendment: Right to request corrections to inaccurate or incomplete PHI.
• Accounting of Disclosures: Right to a list of who their PHI was shared with (for non-routine purposes) over the past 6 years.
• Restriction: Right to request limits on PHI use/disclosure.
  • Mandatory for providers if patient pays out-of-pocket for a service.
• Confidential Communications: Right to choose how and where they receive PHI.
• Notice of Privacy Practices: Right to a written notice of how their PHI is used and shared.

⭐ A key testable timeline: Providers have 30 days to provide patients with their medical records upon request.

Access & Amendment - See and Fix

• Right of Access: Patients can inspect & obtain a copy of their Protected Health Information (PHI).
  • Providers must respond within 30 days.
  • A reasonable, cost-based fee for copies is allowed.
  • Access can be denied for specific records like psychotherapy notes or information gathered for legal action.
• Right to Amend: Patients can request corrections to inaccurate or incomplete PHI.
  • Providers must act on the request within 60 days.
  • If denied, a written explanation is required, and the patient may file a statement of disagreement to be included in the record.

⭐ Psychotherapy notes are specially protected and are not subject to a patient's general right of access to their medical records.

Disclosure & Restriction - Who Sees What

• Minimum Necessary Rule: Default is to disclose only the minimum Protected Health Information (PHI) needed for a given purpose.
• No Authorization for TPO: PHI can be used and disclosed without patient authorization for:
  • Treatment (e.g., consulting with another provider)
  • Payment (e.g., submitting claims)
  • Operations (e.g., quality assessment, training)
• Patient Authorization: Required for most non-TPO disclosures (e.g., marketing). Must be specific and time-limited.
• Right to Restrict: Patients can request restrictions on disclosures. A covered entity must agree if the patient pays 100% out-of-pocket for a service and requests the information not be sent to their health plan.

⭐ The right to restrict disclosure to a health plan for services paid fully out-of-pocket is a key patient empowerment rule.

Breach Notification - Sound the Alarm

• Definition: An impermissible use or disclosure of Protected Health Information (PHI) is presumed to be a breach unless a low probability of compromise is demonstrated through a risk assessment.

• Individual Notice: Must be provided without unreasonable delay, and in no case later than 60 calendar days following the discovery of a breach.

• HHS Notification:

  • Breaches affecting ≥500 individuals: Notify the HHS Secretary without unreasonable delay (and no later than 60 days).
  • Breaches affecting <500 individuals: Log and notify HHS annually.

• Media Notice: If a breach affects more than 500 residents of a single state or jurisdiction, a prominent media outlet must be notified.

⭐ The burden of proof is on the covered entity to demonstrate that a breach did not occur or that all required notifications were made.

High-Yield Points - ⚡ Biggest Takeaways

• Patients have a right to access, inspect, and obtain a copy of their Protected Health Information (PHI).
• They can request amendments to correct errors in their medical records.
• Patients are entitled to an accounting of disclosures, listing who has received their PHI.
• They can request restrictions on PHI use, especially for services paid out-of-pocket.
• The right to request confidential communications allows them to specify contact methods.