HIPAA GENERAL OPERATING POLICY #29
AMENDMENT OF PHI
I. Right to Amend
An individual has the right to have a HCC correct, clarify and amend PHI about an individual in a Designated Record Set for as long as the PHI is maintained in the Designated Record Set.
II. Requests for Correction, Clarification or Amendment and Timely Action
a. Request for Amendment - The HCC must permit an individual to request that the HCC correct, clarify or amend the PHI maintained in the Designated Record Set. The HCC should require that such requests be in writing.
b. Timely Action by the HCC - The HCC must act on a request for correction, clarification or amendment no later than 60 days after receipt of the request, as follows:
i. If it adds the correction, clarification or amendment, in whole or in part, it must take the actions required by section III below.
ii. If it is unable to act within the time required, the HCC may extend the time for such action by no more than 30 days, provided that it provides a written statement to the individual within the original time limit stating the reasons for the delay and the date by which it will complete its action, and the HCC may have only one such extension.
III. Adding the Correction, Clarification or Amendment - If an individual requests a correction, clarification or amendment, the HCC must comply with the following requirements:
a. Adding the Correction, Clarification or Amendment - The HCC must add the appropriate correction, clarification or amendment to the PHI by identifying the records affected by the correction, clarification or amendment and appending or otherwise linking to the correction, clarification or amendment. Such correction, clarification or amendment must be retained with the PHI. Nothing shall be deleted from the PHI as part of this process; however, PHI may be corrected, clarified or amended.
b. Informing the Individual - The HCC must timely inform the individual that the correction, clarification or amendment has been added and obtain the individual's identification of and written authorization to have the HCC notify the relevant persons to whom the correction, clarification or amendment needs to be disclosed.
c. Informing Others - The HCC must make reasonable efforts to inform and provide the correction, clarification or amendment within a reasonable time to:
i. Persons identified by the individual as having received the PHI and needing the correction, clarification or amendment; and
ii. Persons, including business associates, that the HCC knows have the PHI that is the subject of the correction, clarification or amendment and that may have relied, or could foreseebly rely, on such information to the detriment of the individual.
IV. Response to the Correction, Clarification or Amendment
If the HCC wishes to add information to the PHI to respond to the requested correction, clarification or amendment, in whole or in part, the HCC must consult with the Privacy Official and University Counsel in all such circumstances and also comply with the following requirements.
a. Response - The HCC may add information to the PHI to respond to the submitted correction, clarification or amendment. The HCC must provide a copy of any such information to the individual.
b. Statement of Disagreement - The HCC must permit the individual to submit a written statement disagreeing with the HCC's added information and the basis of such disagreement. The HCC may reasonably limit the length of a statement of disagreement.
c. Rebuttal Statement - The HCC may, at its option, prepare a written rebuttal to the statement of disagreement. Whenever a rebuttal is prepared and added to the PHI, a copy must be provided to the individual.
d. Record-keeping - The HCC must, as appropriate, identify the record of PHI that is the subject of the disputed correction, clarification or amendment and append or otherwise link the request, the correction, clarification or amendment, the response, the statement of disagreement and the rebuttal to the record.
e. Future Disclosures
i. If a correction, clarification or amendment has been submitted, the HCC must include all of the information appended to the record in accordance with sections III(a) and IV(d), or any accurate summary of such information, with any subsequent disclosure of the PHI to which the correction, clarification or amendment relates.
ii. When a subsequent disclosure is made using a standard transaction that does not permit the additional material to be included with the disclosure, the HCC may separately transmit the material required to be sent, to the recipient of the standard transaction.
V. Actions on Notices of Correction, Clarification or Amendment
A HCC that is informed by another Covered Entity of a correction, clarification or amendment to an individual's PHI, must correct, clarify or amend the PHI in Designated Record Sets.
VI. Documentation
A HCC must document the titles of the persons or offices responsible for receiving and processing requests for corrections, clarifications or amendments by individuals and retain the documentation as required by the regulations.
Revised 09/04/03