HIPAA GENERAL OPERATING POLICY #2
ACCESS, AMENDMENT, AND ACCOUNTING OF DISCLOSURES
I. POLICY STATEMENT
Except as noted below, it is the policy of the University of Maine System ("UMS") Health Care Components ("HCCs") to allow individuals to inspect and obtain copies of their own health information and to request amendment of their health information that is stored in any UMS HCC file or depository, stored electronically, existing in any recording device, or in any clinical research data base hereafter collectively referred to as "health record." Additionally, UMS HCCs allow individuals to request information regarding disclosures of their health information made by the HCC to third parties. For the purposes of compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), employment records and UM System student records subject to the Family Educational Rights and Privacy Act (FERPA) and UM System student medical records, are specifically excluded from the definition of "protected health information."
II. POLICY PURPOSE
The purpose of this policy is to assure that individuals have both access to and a mechanism for inspecting their protected health information, have a mechanism for requesting that their protected health information be amended by the campus, and for requesting and receiving an accounting of disclosures of protected health information.
III. POLICY STANDARDS
Individuals may access, inspect, and copy their own health information that was obtained by a HCC and that is maintained in a Designated Record Set, except as set forth below or otherwise excepted by statute.
Individuals will typically be denied access to information contained in psychotherapy notes and information compiled in anticipation of litigation. Access may also be denied where the individual is a participant in a research project and has agreed prior to entering into the research project to suspend the right to access during the research study, though this agreement may be revoked.
A campus may otherwise choose to deny access to certain health information contained in the Designated Record Set if, in the judgment of a licensed health care professional, such access could cause harm to the individual or to a third person, provided that the individual is given a right to have the denial reviewed.
A campus will allow an individual to correct, clarify and amend information in their Designated Record Set. The HCC may add information to respond to the submitted correction, clarification or amendment. The HCC muse provide a copy of any such information to the individual. The HCC must permit the individual to submit a written statement disagreeing with the HCC's added information and the basis of such disagreement.
Except for information released pursuant to a signed authorization or otherwise excepted by statute, a HCC will, upon written request, provide an individual with information regarding the release of their protected health information made to third parties for non-routine purposes, i.e., for purposes other than treatment, payment, and health care operations. Reasonable attempts will be made to provide this information in a format requested by the individual. Otherwise, it may be provided in any format mutually agreed upon.
Requests for access to health information, requests to correct, clarify or amend health information, or requests for an accounting of disclosures of health information must typically be made in writing.
The Privacy Official of the campus housing the protected health information is responsible for establishing a protocol to respond to requests for access to, amendment of, and an accounting of disclosures of protected health information. He/She may either comply with or deny the request for access and such response will typically occur within 30 days. Requests to amend health information or for an accounting of disclosures will normally be answered within 60 days. In the event of any denial, the response will include the reasons therefore and will inform the individual of their rights and process of appeal, if any.
A System campus may, at its discretion, charge a requestor a fee not to exceed the actual cost of compiling, copying, and mailing requested information, except that the first accounting in any 12 month period will be provided free of charge.
This is a summary of the UMS policies regarding access, amendment and accounting. For specific information, see UMS HIPAA General Operating Policies 28, 29 and 30.
Revised 09/04/03