HIPAA GENERAL OPERATING POLICY #28
ACCESS OF INDIVIDUALS TO PHI
I. Right of Access
Except as otherwise provided below, an individual has a right of access to inspect and obtain a copy of PHI about the individual in a Designated Record set ("DRS"), for as long as the PHI is maintained in the record, except for:
a. Psychotherapy notes, as defined in HIPAA General Operating Policy #3 and in 45 CFR ' 164.501, as may be amended from time to time;
b. Information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding;
II. Unreviewable Grounds for Denial
A HCC may deny an individual access without providing the individual an opportunity to review, in the following circumstances:
a. The PHI is excepted from the right of access by section (I.) above.
b. Where the individual is a participant in a research project and has agreed prior to entering into the research project to suspend the right to access during the research study, provided that the individual will have access to PHI after the research project is completed and that the individual may revoke the agreement at any time and have access to the PHI. If the individual revokes the agreement to suspend the right to access during the research project, the individual's participation in the research study may be discontinued.
III. Reviewable Grounds for Denial
A HCC may deny an individual access, provided the individual is given a right to have the denial reviewed, in the following circumstances:
a. A licensed health care professional has determined that the access requested is likely to endanger the life or physical safety of the individual or another person, provided that the individual is notified that copies of the records or a narrative will be provided to the individual's authorized representative, designated for this purpose, upon written authorization signed by the individual and the copies or narrative are released to the authorized representative within a reasonable time;
b. The PHI makes reference to another person, (other than a health care provider) and a licensed health care professional has determined that the access requested is likely to cause substantial harm to the other person, provided that the individual is notified that copies of the records or a narrative will be provided to the individual's authorized representative, designated for this purpose, upon written authorization signed by the individual and the copies or narrative are released to the authorized representative within a reasonable time; or
c. If the request for access is made by an individual's personal representative, in the circumstances under paragraphs (a) or (b) of this section III, the request should be handled in the same manner as a request by the individual.
The HCC should consult with the Privacy Official and University counsel in all situations under this section III before denying or providing access. Where provision of access under this section III may present a direct threat of imminent harm to the health or safety of any individual, the HCC may need to warn such individual in accordance with 22 M.R.S.A. ' 1711-C(6)(D) and 45 CFR 164.512(j).
IV. Review of a Denial of Access
If access is denied under section (III), the individual has the right to have the denial reviewed by a licensed health care professional who is designated by the HCC as a reviewing official and who did not participate in the original decision to deny. The HCC must provide or deny access in accordance with the decision of the reviewing official, who shall make such a decision in consultation with the Privacy Official and University Counsel.
V. Requests for Access and Timely Action
a. Requests for Access - The HCC must permit an individual to request access to inspect or obtain a copy of PHI about the individual in a Designated Record Set. The HCC should obtain a written authorization from the individual to release the information to the individual and should inform individuals of this requirement.
b. Timely Action by the HCC
i. Except as provided in the subsection (ii) below, the HCC must act on a request for access no later than 30 days after receipt of the request by either informing the individual of the acceptance of the request and providing the access requested or providing a written denial of the request.
ii. If the request is for PHI that is not maintained or accessible to the HCC on-site, the HCC must take an action required under subsection (i) no later than 60 days from the receipt of the request.
iii. If the HCC is unable to take action within the time required, the HCC may extend the time for such actions by no more than 30 days, provided that it provides a written statement to the individual within the original time limit stating the reasons for the delay and the date by which it will complete its action, and the HCC may have only one such extension.
VI. Provision of Access
If the HCC provides an individual with access to PHI, the HCC must comply with the following requirements:
a. Providing the Access Requested - The HCC must provide the access requested by individuals, including inspection or obtaining a copy, or both, of the PHI about the individual in a Designated Record Set. If the same PHI is maintained in more than one record set or location, the HCC need only produce the PHI once in response to a single request. Repeated requests over time for the same DRS should be handled in the same manner as the original request.
b. Form of Access Requested
i. The HCC must provide the access in the form or format requested by the individual, if readily producible, or, if not, in a readable hard copy or other format as agreed to by the HCC and the individual. If access is provided in electronic form or format, it shall be in a form or format which cannot be altered subsequently.
ii. The HCC may provide summary of the PHI in lieu of providing access or may provide an explanation of the PHI requested, if the individual agrees in advance to such a summary or explanation and the individual agrees in advance to any fees imposed for such summary or explanation.
c. Time and Manner of Access - The HCC must provide access in a timely manner, including arranging for a convenient time and place for the individual to inspect or obtain a copy of the PHI or mailing a copy at the individual's request. The HCC may discuss the aspects of the request to facilitate timely access. Access shall occur at the HCC and only in the presence of a person designated by the HCC.
d. Fees - If the individual requests a copy of the PHI or agrees to a summary or explanation, the HCC may impose a reasonable, cost-based fee, provided the fee includes only the cost of:
i. Copying, including the cost of supplies and labor;
ii. Postage, when the individual has requested the copy be mailed; and
iii. Preparing an explanation or summery of the PHI, if agreed to by the individual or the individual's personal representative, if applicable.
VII. Denial of Access
If a HCC denies access, in whole or in part, to PHI, the HCC must comply with the following requirements:
a. Making Information Accessible - The HCC must, to the extent possible, give the individual access to any other PHI requested, after excluding the PHI from the DRS to which the HCC has a ground to deny access.
b. Denial - The HCC must provide a timely, written denial to the individual. The denial must be in plain language and contain:
i. The basis for denial;
ii. If applicable, a statement of the review rights, including a description of how to exercise such review rights; and
iii. A notice that the individual may complain to the HCC about this decision or that a complaint may be made to the Secretary of DHHS. The notice must include the name, or title, and phone number of the designated contact person or office at the University for such a complaint.
c. Other Responsibility - If the HCC does not maintain the PHI requested, and the HCC knows where the PHI is maintained, the HCC must inform the individual where to direct the request for access.
d. Review of Denial Requested - If the individual has requested a review of the denial, the HCC must designate a licensed health care professional, who did not participate in the original decision to deny, to review the decision to deny and must promptly refer the request for review to such designated reviewing official. The designated reviewing official must determine within a reasonable time whether or not to deny access. This decision shall be made in consultation with the Privacy Official and University Counsel. The HCC must promptly provide written notice to the individual of the decision of the designated reviewing official and provide or deny access in accordance with that decision.
VIII. Documentation
A HCC must document the following and retain the documentation as required by the regulations:
a. The original Designated Record Sets that are subject to access by individuals;
b. The titles of persons or offices responsible for receiving and processing requests for access by individuals;
c. The request for access; and
d. All documents relating to the processing of a request for access.
Revised 09/04/03