Practice of Medicine

article

Accessing and Amending Medical Records

Executive Summary 

Patients have the ability to review and receive a copy of their medical and billing records and any other records used to make decisions about them. Patients also have the right to request an amendment or correction of their medical records. Healthcare organizations must provide records and timely responses to requests for amendments to avoid HIPAA violations.  

Recommended Actions  

  • When requested, provide patient records in a timely manner, but no later than 30 days after their request, in the form and format requested by the patient.  
  • Implement a protocol to approve or deny a medical record amendment request within 60 days of the request. 
  • Include a patient’s request to amend, the physician’s response and all correspondence regarding these requests with the patient’s medical records. 

The physician can charge a reasonable, cost-based fee for providing a paper copy, but can only charge for the following: 

  • The cost of labor for actual copying time. Time spent reviewing the request, retrieving the records, etc. cannot be charged 
  • The cost of supplies (e.g. paper and toner, or USB drive or DVD, if electronic); and 
  • Postage if the patient requests the records be mailed 

If the patient requests a summary or explanation of the records, a physician may charge for the labor involved in creating the summary if the patient agrees in advance to the proposed fee. 

Requests for Medical Records 

MagMutual receives frequent calls about patients requesting redaction or amendment of their medical records. In the era of open access, patients now have the ability to request documentation of their visits with medical providers. Workers’ compensation, divorce and custody controversies, life or disability insurance application reviews, and ongoing legal proceedings all periodically lead to these types of requests. In each situation, sensitive information and potentially adverse comments in the record may result in unfavorable consequences for the patient. 

Under HIPAA, patients have the right to review (free of charge) and receive a copy (for a fee) of their medical and billing records and any other records that are used to make decisions about them. Failure to comply with HIPAA’s access requirements is one of the top five most common violations of HIPAA. 

A partial list of the most common records that a provider is not required to produce (i.e. patients do not have a right of access) includes: 

  • Quality assurance or professional review materials 
  • Psychotherapy notes (personal notes of the therapist pertaining to counseling sessions; medications, dates of visits, billing information and other parts of the records are still subject to the right of access) 
  • Information compiled in anticipation of a civil, administrative or criminal action 
  • A medical record that, if released, would likely cause harm to the patient or another person (in the professional judgment of the provider) 
  • Research study records, but only if the patient agreed during the consent process and only while the clinical trial is in progress (patients must be informed that their right to access will be reinstated following the conclusion of the clinical trial) 
  • Information obtained from someone other than a healthcare provider, such as a family member or close friend, under a promise of confidentiality 

A common myth is that you cannot provide copies of another provider’s records that are contained in your records. This is not true. HIPAA FAQs for Professionals specifically states that a provider can produce such records. In fact, it may be a violation of the right of access if you do not do so when requested by the patient. 

A provider may require a patient to submit any request for access to records in writing, but only if the patient has been informed of this requirement, usually in the Notice of Privacy Practices. We recommend that providers have a requirement for a written request for access and that the request is signed and dated by the patient. 

Guidelines for Providing Records to Patients 

In general, physicians are required to provide the records in a timely manner (as soon as reasonably possible, but no later than 30 days after the request). In unusual situations beyond the control of the physician, an additional 30-day extension may be obtained if the patient is notified before the expiration of 30 days. These unusual circumstances may exist, for example, if the records are offsite and cannot be retrieved within the 30-day time frame. Being too busy, short-staffed or similar reasons will not suffice. It is important to note that some states have laws that require records to be produced in a shorter time frame. Be sure to know and comply with the laws and regulations applicable your state.    

The Privacy Rule requires physicians to produce the records in the form and format requested by the patient, if readily producible in that form and format, or if not, in a readable hard copy form. For example, if a patient requests an electronic copy of a paper record, the physician is required to scan the paper information into an electronic format if the office has scanning capabilities. 

The physician can charge a reasonable, cost-based fee for providing a paper copy, but can only charge for the following: 

  • The cost of labor for actual copying time. Time spent reviewing the request, retrieving the records, etc. cannot be charged. 
  • The cost of supplies (e.g. paper and toner, or USB drive or DVD, if electronic) 
  • Postage if the patient requests the records be mailed 

If the patient requests a summary or explanation of the records, a physician may charge for the labor involved in creating the summary if the patient agrees in advance to the proposed fee. 

Requests to Amend Records 

After accessing or obtaining a copy of their medical records, patients may also invoke another related right under HIPAA: the right to request an amendment or correction of their medical records. Providers must have a procedure in place to address this type of request. The request to amend must generally be approved or denied within 60 days, absent unusual circumstances. 

Providers should be careful about any complaint from a patient about the accuracy of the records and should treat the complaint as a request to amend the medical record or should at least ask the patient if they are requesting an amendment and then proceed accordingly. The federal agencies charged with enforcing HIPAA consider emails, letters and telephone calls complaining that the records are not correct as a “request to amend” and can sanction your practice if you do not follow the proper procedures. 

If the request to amend is approved, the patient must be advised and the amendment should be changed in the appropriate record. It should be clearly marked as an amendment and dated. Transparency is key to avoiding a later claim of alteration. Reasonable steps must be taken to get the amended information to individuals that the patient wants to be notified and to anyone to whom the provider previously sent the unedited record. 

If the request is denied, the patient must be advised in writing and in plain language of the reason for denial. A request to amend may only be denied for one of the four following reasons, which must be stated in the denial letter: 

  • The requested health information was not created by the physician’s office (a copy of another provider’s records). However, if the patient provides a reasonable basis to believe that the originator of the record is no longer available to act on the request, the amendment may be made. 
  • The patient does not have a right to access the records and therefore does not have the right to amend them. Examples of this include psychotherapy notes, ongoing research or confidential information obtained from a family member (see previous list). 
  • The request does not pertain to the patient’s medical and financial records. 
  • The health information is accurate and correct (the most common reason for denial). 

If the request is denied, the patient has the right to submit a statement of disagreement to the medical practice or facility. This statement must be included in the medical record and provided with any later request for those specific records. The right to file a statement of disagreement and the process for doing so must also be clearly stated in the denial letter. 

Alternatively, the patient may elect, in lieu of filing a statement of disagreement, to use the letter requesting amendment. If requested, the provider must comply and the letter requesting amendment must be included in the medical record and provided in any later disclosure of that record.  

The patient’s request to amend, the physician’s response and all correspondence of these requests should be retained by the provider and included in the medical record.  

Amendments by the Provider 

An ER physician evaluates a man with a respiratory illness and diagnoses influenza. The physician then sends the patient home. When the physician returns for his next shift, he learns the patient returned to the ER and is now in the ICU with sepsis. He reads his original note and feels it is inadequate and wants to add information that he didn’t include during the patient’s initial visit. He calls the MagMutual risk management hotline for advice. Guidelines we offer include: 

After an adverse outcome, a physician may wish that a note in the medical record was more complete. Perhaps the ER physician should have written more in the physical examination, discussed more in the differential, or given better discharge instructions. After-the-fact notes, especially in the setting of an adverse outcome, are tricky. It is virtually impossible to make these not appear defensive or a tacit admission of wrongdoing. These additions will not help your case and our advice in this situation is generally to avoid adding a note. 

If the record is incorrect, then it is reasonable to make a clear change of the record after the fact. This should be clearly marked as an addition or correction and noted as being added after the event. Never try to make it look like an added note is really part of the original. Besides appearing deceptive, the audit trail of the EHR will document when each entry is made. 

Lost notes occur in the written and digital world. Be clear that this is being written after the fact. If it’s a few days later, summarize the care provided since you may not be able to recall all the specific details. 

Some providers may add “dictated but not read” or other disclaimers about voice recognition software following a dictated note. There is no advantage to this addendum. In fact, it is more often a disadvantage. In essence, it is saying you didn’t care enough to take the time to read your own note to see if it was correct. More practically, the comment will not qualify as the required certification of your records for Medicare and your bills may be denied if this statement is in your notes. 

Lessons Learned:  

  • Inform patients in advance how much it will cost to supply their medical records, including costs for time copying, supplies, postage and summary of the records when requested.  
  • Make it clear that a medical record has been altered because it was incorrect to avoid appearing deceptive. 
  • Handle each complaint from a patient about the accuracy of the records as a request to amend the medical record or at least ask the patient if they are requesting an amendment and then proceed accordingly.  

Potential Damages 

Healthcare organizations that fail to provide medical records when requested or ignore patient requests for amendments or corrections to medical records could run the risk of a HIPAA violation with fines up to $50,000. Failure to comply with HIPAA’s access requirements is one of the most common violations of HIPAA.  

Quiz 

Answers are provided below 

True or false?  

Question 1: Providers are required to produce all types of records to a patient. 

Question 2: You can provide copies of another provider’s records that are contained in your records. 

Question 3: Requests to amend medical records can be denied for any reason. 

Answers 

Question 1: False. Providers are not required to produce quality assurance or professional review materials, psychotherapy notes, information compiled in anticipation of a legal action, or a medical record that, if released, would likely cause harm to the patient or another person. 

Question 2: True. HIPAA FAQs for Professionals states that a provider can produce such records and, in fact, it may be a violation of the right of access if you do not do so when requested by the patient. 

Question 3: False. A request to amend may only be denied if 1) the requested health information was not created by the physician’s office, 2) the patient does not have a right to access the records and therefore does not have the right to amend them, 3) the request does not pertain to the patient’s medical and financial records, or 4) the health information is accurate and correct. 

01/23

Want to learn more?

Interested in how MagMutual can help?

View our products

Disclaimer

The information provided in this resource does not constitute legal, medical or any other professional advice, nor does it establish a standard of care. This resource has been created as an aid to you in your practice. The ultimate decision on how to use the information provided rests solely with you, the PolicyOwner.