PHI Access Guidelines: General Access
General Right to Access
When a patient wants to request their medical records, many wonder what exactly their rights are under HIPAA guidelines. What parts of a medical record are patients allowed to access? What are patients allowed to do with those records? As stated on HHS.gov, the HIPAA Privacy Rule "establishes national standards to protect individuals’ medical records and other personal health information and applies to health plans, health care clearinghouses, and those health care providers that conduct certain health care transactions electronically."
Broken down, under the HIPAA Privacy Rule:
- A patient or personal representative of the patient has permission to access their own medical record
- A patient or personal representative of the patient has the right to inspect and/or receive a copy of their medical record
- A patient or personal representative of the patient is allowed to have a copy of their medical record sent to a third party of their choosing
What is a Designated Record Set?
HIPAA guidelines refer to a patient's obtainable medical records as a "designated record set", which is a group of records maintained by or for a covered entity. But what exactly is included in a designated record set and what documents are excluded?
A designated record set DOES include:
- Medical records, billing records and any other records used to make health care decisions
A designated record set DOES NOT include:
- Psychotherapy notes - any notes taken during a psychotherapy session, which are kept separate from the medical recordset
- Quality assessment or improvement records, patient activity safety reports, business planning, development or management documents
Personal Representative of a Patient
A patient's personal representative is an individual that has the authority under state law to make healthcare decisions for a patient. As discussed above, a personal representative also has the same rights under HIPAA as a patient to access that patient's medical record. Examples of personal representatives under the law: a parent to a child under the age of 18 or an adult child as the power of attorney for a parent.
Requesting Medical Records
MediCopy is a health information management company that partners with physician practices and hospitals across the country to handle their medical record requests. If you find that your physician's practice is partnered with MediCopy to complete medical records requests, you can fill out a request to obtain them here.
If you have questions or comments, please feel free to reach out to our office anytime via our Contact Us form.
______________________________________________________________________________