2.3 Individual Privacy Rights: Access, Amendment & Accounting of Disclosures

Individual Privacy Rights: Access, Amendment & Accounting of Disclosures

Part 164, Subpart E of the HIPAA Privacy Rule grants individuals a robust package of statutory civil rights over their personal healthcare information. Rather than treating health records as the exclusive intellectual property of healthcare facilities, HIPAA establishes that patients have legal authority to inspect, copy, amend, and track the dissemination of their Protected Health Information.

For privacy compliance officers, operationalizing these rights is among the most scrutinized compliance responsibilities. The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) actively enforces individual privacy rights through targeted compliance initiatives, resulting in significant monetary penalties and mandated Corrective Action Plans (CAPs) for organizations that fail to satisfy regulatory timelines or fee restrictions.

+---------------------------------------------------------------------------------------------------+
|                         INDIVIDUAL PRIVACY RIGHTS TIMELINES & PARAMETERS                          |
|                                                                                                   |
|   RIGHT OF ACCESS                RIGHT TO AMENDMENT              ACCOUNTING OF DISCLOSURES        |
|   (45 CFR § 164.524)             (45 CFR § 164.526)              (45 CFR § 164.528)               |
|   +--------------------------+   +---------------------------+   +----------------------------+   |
|   | TIMELINE: 30 days        |   | TIMELINE: 60 days         |   | TIMELINE: 60 days          |   |
|   | EXTENSION: +30 days      |   | EXTENSION: +30 days       |   | EXTENSION: +30 days        |   |
|   | SCOPE: Designated Record |   | SCOPE: Designated Record  |   | SCOPE: 6-Year Lookback     |   |
|   |        Set (DRS)         |   |        Set (DRS)          |   | EXCLUSIONS: TPO, Author-   |   |
|   | FEES: Cost-based labor & |   | MANDATE: Must append      |   |             izations,      |   |
|   |       supplies only      |   |          Statement of     |   |             Incidentals,   |   |
|   | BANNED: Search/retrieval |   |          Disagreement if  |   |             Limited Data   |   |
|   |         fees             |   |          denied           |   | COST: 1 free per 12 months |   |
|   +--------------------------+   +---------------------------+   +----------------------------+   |
+---------------------------------------------------------------------------------------------------+

---

1. The Right of Access & OCR Right of Access Initiative (45 CFR § 164.524)

Under 45 CFR § 164.524, an individual has the right to inspect and obtain a copy of PHI about the individual in a Designated Record Set (DRS) for as long as the information is maintained.

The Designated Record Set (DRS) Defined (45 CFR § 164.501)

A Designated Record Set comprises:

1. Medical records and billing records maintained by or for a covered healthcare provider;
2. Enrollment, payment, claims adjudication, and case management record systems maintained by or for a health plan; or
3. Any records used, in whole or in part, by or for the covered entity to make decisions about individuals.

Records NOT in the DRS: Incident reports, attorney-client privileged work product, peer review committee minutes, clinical quality assurance files, and research data prior to trial completion.

Operational Fulfillment Timelines

• Standard Response Window: Must fulfill access requests within 30 calendar days of receipt.
• One-Time Extension: If the entity is unable to provide access within 30 days, it may extend the deadline by up to 30 additional calendar days (maximum 60 calendar days total) only if it provides the individual with a written explanation of the delay and the expected delivery date before the initial 30 days expire.

Form, Format & Electronic Delivery Mandate

• The entity must provide the PHI in the form and format requested by the individual if readily producible (e.g., PDF via secure email, patient portal export, physical paper copies, encrypted flash drive).
• Unencrypted Email Requests: If an individual requests that their PHI be transmitted via unencrypted email, the covered entity must honor the request, provided the entity first warns the individual of the security risks inherent in unencrypted email transmission and the patient confirms their preference in writing.

Allowable vs. Prohibited Access Fees (45 CFR § 164.524(c)(4))

Covered entities may charge only a reasonable, cost-based fee encompassing:

1. Labor for copying the PHI (whether paper or electronic);
2. Supplies for creating the paper copy or electronic media (e.g., paper, toner, USB drives);
3. Actual postage, when the individual requests mailing.

+---------------------------------------------------------------------------------------------------+
|                         HIPAA ACCESS FEE RESTRICTIONS MATRIX                                      |
|                                                                                                   |
|   PERMISSIBLE COST-BASED CHARGES                     STRICTLY PROHIBITED CHARGES (Illegal)        |
|   +--------------------------------------------+     +------------------------------------------+ |
|   | - Actual labor for copying/scanning into   |     | - Search and retrieval fees              | |
|   |   electronic format                        |     | - Data maintenance or IT licensing fees  | |
|   | - Cost of physical media (CD, USB drive)   |     | - General facility overhead / storage    | |
|   | - Paper and toner used for printing        |     | - Fees for viewing records in person     | |
|   | - Actual postal delivery charges           |     | - Per-page fees for electronic records   | |
|   | - Flat fee up to $6.50 for EHR extracts    |     |   exceeding actual labor cost            | |
|   +--------------------------------------------+     +------------------------------------------+ |
+---------------------------------------------------------------------------------------------------+

Third-Party Direct Access Requests & Ciox Health v. Azar (2020)

Under 45 CFR § 164.524(c)(3)(ii), an individual may direct a covered entity in a signed writing to transmit their PHI directly to a designated third party (e.g., personal injury attorney, life insurance company). In the landmark federal ruling Ciox Health, LLC v. Azar (2020), the D.C. District Court struck down HHS's attempt to apply the HIPAA fee cap to third-party directives. Consequently:

• When records are delivered directly to the patient, HIPAA reasonable cost-based fee limits apply strictly.
• When records are transmitted to a commercial third party at the patient's direction, state-mandated medical record fee schedules may be applied.

OCR Right of Access Enforcement Initiative

Launched in 2019, OCR's Right of Access Initiative actively investigates patient access complaints. OCR has penalized over 50 healthcare organizations—ranging from sole practitioners to massive academic medical centers—with Civil Monetary Penalties (CMPs) reaching hundreds of thousands of dollars for failing to provide records within 30 days or demanding unlawful retrieval fees.

---

2. Unreviewable vs. Reviewable Grounds for Denial of Access

When a covered entity denies access to all or part of a Designated Record Set, HIPAA strictly categorizes the legal grounds into unreviewable and reviewable denials (45 CFR § 164.524(a)).

+---------------------------------------------------------------------------------------------------+
|                         GROUNDS FOR DENIAL OF ACCESS ARCHITECTURE                                 |
|                                    (45 CFR § 164.524(a))                                          |
|                                                                                                   |
|   UNREVIEWABLE GROUNDS (45 CFR § 164.524(a)(2))     REVIEWABLE GROUNDS (45 CFR § 164.524(a)(3))   |
|   [No Right to Independent Appeal]                  [Mandatory Right to Independent Clinical      |
|                                                      Review by Uninvolved Healthcare Professional]|
|   1. Psychotherapy Notes (§ 164.501)                                                              |
|   2. Information compiled in reasonable             1. Clinical Determination of Endangerment:    |
|      anticipation of civil, criminal, or               Licensed professional determines access is |
|      administrative proceedings (Work Product)         reasonably likely to endanger the life or  |
|   3. CLIA-exempt laboratory records                    physical safety of patient or another.     |
|   4. Clinical Research in Progress (where           2. Third-Party Substantial Harm:              |
|      participant agreed to temporary suspension        Record references another person (other    |
|      of access during trial)                           than provider) and access is likely to     |
|   5. Inmate Access (where access jeopardizes           cause substantial harm to that person.     |
|      health, safety, security of institution)       3. Personal Representative Harm:              |
|   6. Confidentiality Promise to Source                 Access by personal representative is       |
|      (identifying third-party informants)              likely to cause substantial harm.          |
+---------------------------------------------------------------------------------------------------+

Review Procedure for Reviewable Denials (45 CFR § 164.524(a)(4))

If access is denied on reviewable grounds, the individual has the right to designate an independent review. The covered entity must promptly designate a licensed healthcare professional who did not participate in the original denial decision to serve as the reviewing official. The covered entity must abide by the reviewing official's clinical determination.

---

3. Right to Request Amendment of PHI (45 CFR § 164.526)

An individual has the statutory right to request that a covered entity amend PHI or a record about the individual in a Designated Record Set for as long as the information is maintained.

Response Timelines

• Standard Response: The covered entity must act on an amendment request within 60 calendar days of receipt.
• One-Time Extension: May extend by up to 30 calendar days with written notice to the individual stating the reasons for delay before the initial 60 days expire.

Statutory Grounds for Denial (45 CFR § 164.526(a)(2))

A covered entity may deny a requested amendment only if it determines that the PHI:

1. Was not created by the covered entity (unless the individual provides a reasonable basis to show the originator is no longer available);
2. Is not part of the Designated Record Set;
3. Would not be available for inspection under the Right of Access rule (§ 164.524); or
4. Is accurate and complete as determined by the clinical author.

Operational Process Upon Denial (45 CFR § 164.526(d))

If an amendment is denied, the covered entity must execute a strict four-part procedure:

1. Written Denial Notice: Issue a timely written denial in plain language stating the clinical/legal basis for denial and instructions on how to file a complaint.
2. Statement of Disagreement: The individual must be permitted to submit a written Statement of Disagreement detailing their position (the entity may set reasonable page limits).
3. Entity Rebuttal: The covered entity may prepare a written Statement of Rebuttal, providing a copy to the patient.
4. Mandatory Record Linking: The covered entity must append or link the amendment request, the denial letter, the Statement of Disagreement, and any rebuttal to the Designated Record Set, ensuring that all subsequent disclosures of the contested medical record include all four documents.

+---------------------------------------------------------------------------------------------------+
|                         AMENDMENT DENIAL: MANDATORY RECORD LINKING                                |
|                                                                                                   |
|   +-------------------------------------------------------------------------------------------+   |
|   |                             DESIGNATED RECORD SET (EHR CHART)                             |   |
|   |                                                                                           |   |
|   |   [ORIGINAL CLINICAL ENTRY] <---+ (Remains unchanged; never deleted or obliterated)       |   |
|   |                                 |                                                         |   |
|   |   [PATIENT AMENDMENT REQUEST] --+                                                         |   |
|   |                                 |                                                         |   |
|   |   [COVERED ENTITY DENIAL] ------+----> MANDATORY PERMANENT ATTACHMENT:                    |   |
|   |                                 |      All future disclosures of this record must         |   |
|   |   [STATEMENT OF DISAGREEMENT]---+      transmit all linked documentation!                 |   |
|   |                                 |                                                         |   |
|   |   [ENTITY REBUTTAL STATEMENT] --+                                                         |   |
|   +-------------------------------------------------------------------------------------------+   |
+---------------------------------------------------------------------------------------------------+

---

4. Right to an Accounting of Disclosures (45 CFR § 164.528)

Under 45 CFR § 164.528, an individual has the right to receive a written accounting of disclosures of PHI made by a covered entity in the 6 years prior to the date of the request.

Accountable vs. Exempt Disclosures

Mandatory Accounting Content Elements

For each accountable disclosure, the log must contain:

1. Date of disclosure;
2. Name of entity or person who received the PHI (and address, if known);
3. Brief description of the PHI disclosed;
4. Brief statement of the purpose of disclosure that reasonably informs the individual of the statutory basis (or a copy of the written request/order).

Fulfillment Rules & Fees

• Response Timeline: Within 60 calendar days of receipt (one 30-day extension allowed with written notice).
• Cost Structure: The covered entity must provide one free accounting in any 12-month period. For subsequent requests within the same 12 months, the entity may charge a reasonable, cost-based fee, provided it informs the individual in advance and allows them to withdraw or modify the request to avoid the fee.