3.3 Patient Rights: Amendments, Accounting of Disclosures, and Restriction Requests

Patient Rights: Amendments, Accounting of Disclosures, and Restriction Requests

AHIMA CHPS Blueprint Focus: Beyond the initial right of access, HIPAA guarantees individuals three critical administrative rights over their health information: the Right to Amend (45 CFR § 164.526), the Right to an Accounting of Disclosures (45 CFR § 164.528), and the Right to Request Restrictions (45 CFR § 164.522). The CHPS examination rigorously tests the 60-day response timelines, the four statutory grounds for denying amendments, mandatory record-linking protocols, accounting exclusion categories, and the non-discretionary HITECH out-of-pocket restriction mandate.

---

1. Right to Amend Protected Health Information (45 CFR § 164.526)

Under 45 CFR § 164.526(a)(1), an individual has the right to have a covered entity amend protected health information or a record about the individual in a Designated Record Set for as long as the information is maintained.

The 60-Day Response Clock

Under 45 CFR § 164.526(b)(2), the covered entity must act on an amendment request within 60 calendar days of receipt:

• The Single 30-Day Extension: If unable to act within 60 days, the entity may extend the deadline by up to 30 calendar days, provided it delivers a written statement to the individual before day 60 stating the reasons for the delay and the expected completion date. Only one extension is permitted.

Workflow When Amendment Is Accepted (45 CFR § 164.526(c))

If the covered entity approves the amendment in whole or in part, it must execute three mandatory steps:

1. Append or Link the Correction: The entity must identify the affected records in the DRS and append or provide a direct link to the location of the amendment. Medical entries are never deleted, erased, expunged, or overwritten. Medicolegal principles dictate that the original note remains visible, while the amendment is clearly marked, dated, and attributed to preserve historical clinical integrity.
2. Inform the Individual: Provide timely written notice to the individual that the amendment has been accepted.
3. Notify Downstream Entities: Make reasonable efforts to notify and provide the amendment to:
   • Persons identified by the individual as having received PHI about the individual and needing the amendment, and
   • Persons, including business associates, that the covered entity knows have the PHI and who may rely or have relied on the unamended data to the detriment of the individual.

The Four Statutory Grounds for Denial (45 CFR § 164.526(a)(2))

A covered entity is legally permitted to deny a requested amendment if and only if it determines that the PHI or record:

1. Was not created by the covered entity, unless the individual provides a reasonable basis to believe that the originator is no longer available to act on the request;
2. Is not part of the Designated Record Set;
3. Would not be available for inspection under the right of access (§ 164.524, e.g., psychotherapy notes or legal work product); or
4. Is accurate and complete as determined by the clinical documentation and professional judgment of the treating practitioners.

                         [Patient Submits Written Amendment Request]
                                             |
                                             v
                              [60-Calendar-Day Clock Begins]
                         (Single 30-day written extension available)
                                             |
                                             v
                              [Clinical / HIM Review of Request]
                                             |
                 +---------------------------+---------------------------+
                 |                                                       |
          [APPROVE REQUEST]                                       [DENY REQUEST]
                 |                                                       |
     1. Append/link correction                               1. Written denial in 60 days
        (NEVER overwrite/delete)                                (State 1 of 4 legal grounds)
     2. Notify individual in writing                         2. Notify patient of right to file
     3. Distribute to identified                                Statement of Disagreement
        downstream parties & BAs                                         |
                                                                         v
                                                         [Patient Submits Disagreement?]
                                                             /                       \
                                                           YES                        NO
                                                           /                            \
                                            [Optional CE Rebuttal]          [Patient May Request That]
                                            [Append Request, Denial,        [Request & Denial Accompany]
                                            [Disagreement & Rebuttal]       [All Future Disclosures   ]

Denial Workflow and Dispute Resolution (45 CFR § 164.526(d))

If the entity denies the request, a highly structured statutory dispute process ensues:

1. Written Denial Notice: Must be delivered within 60 days in plain language, explaining: (a) the specific statutory basis for denial, (b) the individual's right to submit a written Statement of Disagreement, and (c) how to file a complaint with the entity and HHS OCR.
2. Statement of Disagreement: The individual may submit a written statement disagreeing with the denial and setting forth the basis of disagreement. The entity may set reasonable page-length limits.
3. Covered Entity Rebuttal: The covered entity may prepare a written rebuttal to the statement of disagreement and must provide a copy to the individual.
4. Future Record Disclosure Linking: Whenever the disputed portion of the record is disclosed in the future, the covered entity must append: (a) the original amendment request, (b) the denial notice, (c) the patient's statement of disagreement (if submitted), and (d) the entity's rebuttal (if prepared). If the patient chose not to submit a disagreement, they may still request that their request and the denial accompany future disclosures.

---

2. Right to an Accounting of Disclosures (45 CFR § 164.528)

Under 45 CFR § 164.528, an individual has the right to receive an accounting of the disclosures of protected health information made by a covered entity in the six (6) years prior to the date on which the accounting is requested.

Statutory Exclusions: What Is NOT Accounted For

The Privacy Rule expressly excludes the vast majority of routine healthcare data transfers from the accounting requirement. An accounting is not required for disclosures made:

• For Treatment, Payment, and Health Care Operations (TPO) under 45 CFR § 164.506.
• To the individual of their own PHI under § 164.524 or § 164.528.
• Incident to an otherwise permitted use or disclosure under 45 CFR § 164.502(b).
• Pursuant to a valid, signed HIPAA authorization under 45 CFR § 164.508.
• For the facility directory or to persons involved in the individual's care under § 164.510.
• For national security or intelligence purposes under § 164.512(k)(2).
• To correctional institutions or law enforcement officials having lawful custody of an inmate under § 164.512(k)(5).
• As part of a Limited Data Set under a Data Use Agreement under 45 CFR § 164.514(e).

Mandatory Inclusions: What MUST Be Accounted For

Any disclosure made outside TPO and without a signed patient authorization must be logged and reported in the accounting. High-yield exam examples include:

• Mandatory Public Health Reporting: Communicable disease surveillance (e.g., CDC/state health department COVID-19 or tuberculosis tracking), vital statistics, cancer registries.
• Child or Elder Abuse Reporting: State-mandated reports of suspected physical abuse, neglect, or domestic violence.
• Health Oversight Activities: Audits, civil or criminal investigations, and inspections by agencies such as HHS OCR, CMS, FDA, or state medical licensing boards.
• Judicial and Administrative Proceedings: Disclosures responding to court orders, subpoenas, or discovery requests served without patient authorization or protective order.
• Law Enforcement Inquiries: Responding to warrants, court-ordered grand jury subpoenas, or specific identification/location requests under § 164.512(f).
• Organ and Tissue Donation: Disclosures to organ procurement organizations (OPOs).
• Medical Research Without Authorization: Disclosures made under an Institutional Review Board (IRB) or Privacy Board waiver of authorization.
• Avert Serious Threat: Disclosures to prevent or lessen a serious and imminent threat to health or safety.

Content of the Accounting (45 CFR § 164.528(b))

For each accounted disclosure, the report must include:

1. The date of disclosure.
2. The name and address of the entity or person who received the PHI.
3. A brief description of the PHI disclosed.
4. A brief statement of the purpose of the disclosure that reasonably informs the individual of the basis, or a copy of the written request for disclosure.

Fee and Response Rules

• Timeline: The entity must act within 60 calendar days of receipt (with one 30-day written extension permitted).
• Fee Schedule: The entity must provide one free accounting per individual in any 12-month period. For subsequent requests within the same 12-month window, the entity may charge a reasonable, cost-based fee, provided it informs the individual in advance of the fee and gives them an opportunity to withdraw or modify the request to avoid the fee.

---

3. Right to Request Restrictions & Mandatory Out-of-Pocket Rule

Under 45 CFR § 164.522(a), an individual has the right to request that a covered entity restrict uses or disclosures of PHI to carry out Treatment, Payment, or Health Care Operations, or disclosures to family members and facility directories.

The General Discretionary Rule

For general requests, a covered entity is NOT required to agree to a restriction. A hospital or physician practice can evaluate the administrative burden or clinical risk and refuse the request. However, if the covered entity agrees to a restriction, it is legally bound by that agreement, except when the restricted PHI is needed to provide the individual with emergency medical treatment.

The Non-Discretionary Exception: Mandatory Out-of-Pocket Restriction

Under the HITECH Act amendments codified at 45 CFR § 164.522(a)(1)(vi), covered entities MUST AGREE to a requested restriction if both of the following statutory conditions are met:

1. The disclosure is to a health plan for the purposes of carrying out payment or health care operations (and is not otherwise required by law); AND
2. The protected health information pertains solely to a health care item or service for which the individual, or a person other than the health plan on behalf of the individual, has paid the covered entity in full out of pocket.

                            [Patient Requests Restriction to Health Plan]
                                                  |
                                                  v
                              [Is disclosure for Payment or Operations?]
                                         /                 \
                                       YES                  NO (Disclosure for Treatment)
                                       /                      \
                 [Paid in Full Out of Pocket?]         [CE NOT Required to Agree]
                     /                  \
                   YES                   NO (Unpaid Balance / Partial Pay)
                   /                       \
    [MANDATORY RESTRICTION APPLIES]    [CE NOT Required to Agree]
    * CE MUST restrict disclosure       * May bill health plan
    * CANNOT bill health plan           * May disclose for payment
    * Must flag EHR & billing system

Critical Operational and Exam Distinctions

1. Does Not Apply to Treatment: The mandatory restriction applies only to disclosures for Payment and Health Care Operations. A patient paying cash cannot force a physician to withhold records from a consulting physician or emergency specialist for treatment purposes.
2. Paid in Full Requirement: The item or service must be paid in full. If a patient pays only a copay, a partial deposit, or their payment check bounces, the covered entity is legally released from the restriction and may bill the insurer for payment.
3. Downstream Unbundling and Ancillary Services: In hospital and surgical encounters, care involves bundled services (e.g., pharmacy, anesthesia, reference labs). The covered entity must ensure that internal systems unbundle and suppress billing across all ancillary departments so that automated clearinghouse feeds do not inadvertently transmit diagnostic codes to the health plan.
4. Terminating a Restriction (45 CFR § 164.522(a)(2)): A covered entity may terminate an agreed restriction if:
   • The individual agrees to or requests the termination in writing;
   • The individual orally agrees to termination and the oral agreement is documented; or
   • The entity informs the individual that it is terminating its agreement (which is only effective for PHI created or received after the individual is notified, and cannot terminate a mandatory out-of-pocket restriction while the service remains paid in full).

---

Comparison of Core Patient Rights

---

Exam Tips and Candidate Traps

[!IMPORTANT] Never Alter the Medical Record: When an amendment is approved, the original clinical documentation is never deleted, whited out, or purged. The new information is appended or linked. In electronic health records, audit trails must preserve the original timestamped text alongside the linked amendment.

[!TIP] Accounting Lookback Is Always 6 Years: On the CHPS exam, question writers frequently present options for 3-year, 5-year, 7-year, or 10-year accounting periods. The statutory lookback period under 45 CFR § 164.528 is exactly 6 years prior to the date of the request.

[!WARNING] TPO Is Never in the Accounting: If an exam vignette asks whether disclosures to a consulting specialist (Treatment), a billing clearinghouse (Payment), or an internal quality committee (Operations) must be included in an accounting of disclosures, the answer is always NO. TPO disclosures are explicitly excluded by statute.