hipaa logo

Part 2: Basic Patient Rights (FAQ 24 of 65)

 

Right to Inspect and Copy Your Record

24. Can Covered Entities Withhold some Medical Records?

Yes. In some situations, a covered entity can withhold records.

First, the right of access under HIPAA does not extend to psychotherapy notes, materials compiled for litigation, and some laboratory records (non-CLIA labs). A non-CLIA lab is typically a lab that does research work. By the way, CLIA stands for the Clinical Laboratory Improvement Amendments, and you can find more information at www.cms.hhs.gov/clia. It is a complicated law, and most patients don't have to worry about CLIA issues.

Second, a covered entity can deny you access to some records, including records maintained by a prison, some records of research participants, and records obtained from someone other than a health care provider under a promise of confidentiality. The HIPAA privacy rule does not require a health care institution to allow you to appeal the denial of these records, but some institutions might accept an appeal if you file one. Read the notice of privacy practices to learn if there is an appeal option. We recommend that you appeal to the head of the institution even if you don't have the right to do so. An appeal may result in a review of the initial decision. If it doesn't, then you only invested the energy of writing a letter.

Third, a covered entity can deny you access to some records if a licensed health professional determines that access is reasonably likely to endanger the life or physical safety of you or another individual. Records about other people can be withheld if a licensed health professional has determined that access is reasonably likely to cause substantial harm to that individual or another person. Requests made by an individual's personal representative can also be denied if disclosure would cause substantial harm. If an institution withholds records for any of these reasons, it must provide a written denial explaining the reason for the denial. It must also explain any appeal rights that you have.

RULE OF THUMB:

Remember that state law may grant you greater access rights than HIPAA. If state law has an access provision -- and many states do -- then you may be able to obtain records exempt under HIPAA. If a federal agency has your records, rights of access under the Privacy Act of 1974 may be greater than the rights under HIPAA.

SIDEBAR:

To be complete, we will tell you that HIPAA has a complex definition for something called a designated record set. You can get access to records that meet this definition and that aren't otherwise exempt. There may be some records about you that are not part of the designated record set, but they are likely to duplicate the records that you can see. This limitation in the rule solves some administrative problems, and it isn't a sinister plot to deny you access. We suggest that you not worry about it. For example, if you had surgery, some of the records about your operation may be kept in the operating room records in addition to being in your personal medical record. A patient doesn't need to see the same information twice.

 

Jump to list of FAQs 1-65 | See all of Part 2