UW-Madison recognizes the patient’s/client’s right to request an amendment to his/her protected health information. The patient/client has the right to request an amendment of his/her protected health information for as long as that information is maintained in the designated record set. UW may grant or deny the request for amendment. If the request is granted, the information that is the subject of the request may be amended by the author of the entry, or by allowing the patient/client to insert a statement in the designated record set. Patients/clients are advised of their right to request amendments to their protected health information in the Notice of Privacy Practices. This document sets forth those procedures utilized by UW-Madison for appropriately amending, as required by law, protected health information in a designated record set based on a patient/client request.
- Each unit of the UW HCC must designate a Privacy Coordinator to receive and process requests for amendments.
- Patient/client requests for amendment of PHI must be made in writing by the patient/client or his/her legally authorized representative (if the patient is a minor or is incapacitated) and directed to the designated unit representative.
- The patient/client has the right to request an amendment of his/her protected health information for as long as that information is maintained in the designated record set.
- The requests must clearly identify the information to be amended, as well as the reasons for the amendment.
- Supporting documents, such as clinical records from other facilities, must be included with the request when appropriate.
- The Privacy Coordinator will notify the provider when his/her patient/client has requested an amendment. (If the provider who made the entry is no longer at UW, the appropriate Director/employee will be contacted to review the request.)
- A health care professional who did not participate in the care of the patient/client may amend entries in the clinical record when he/she is in receipt of clinical information that is consistent with the requested amendment, and he/she has overall clinical responsibility for that clinic treatment service or facility.
- UW HCC may deny amendment requests if the PHI that is the subject of the request:
- Was not created by UW HCC, unless the originator is no longer available to act on the request.
- Is not part of the patient/client’s designated record set.
- Is not accessible to the patient/client because federal and state laws do not permit it.
- Is accurate and complete.
- Within a reasonable time and no more than 30 days after receipt of the request, the Privacy Coordinator will notify the patient/client in writing whether the request was granted or denied. If, for any reason, UW HCC is unable to act on the amendment request within 30 days, it may extend the time to respond by no more than 30 days if it provides the patient/client with a written statement indicating the reasons for the delay and the date a decision on the request will be made.
- If the request is granted, after review and approval by the individual responsible for the entry to be amended, the UW HCC unit will:
- Insert the amendment or provide a link to the amendment at the site of the information that is the subject of the request for amendment;
- Inform the patient/client that the amendment is accepted;
- Obtain the patient/client’s identification of, and agreement to have the UW HCC unit notify, the relevant persons with whom the amendment needs to be shared; and
- Within a reasonable time frame, make efforts to provide the amendment to those who may have relied on or could foreseeably rely on the information to the detriment of the patient/client. Examples of these persons or organizations could include persons identified by the patient/client, business associates (see definition above), and other covered entities including hospitals, clinics and treatment providers UW HCC knows have the relevant PHI on this patient/client.
- To amend written (paper) entries:
- Line-out the inaccurate data with a single line in ink. The original entry must still be legible. Write the correct word(s) above the inaccurate or incomplete entry.
- Date and initial the lined-out portion.
- Note in the margin why the previous entry was replaced.
- Enter amendments in chronological order.
- Indicate which entry the amendment is replacing.
- Authenticated dictated entries may be amended by a dictated addendum.
- If the amendment involves the insertion of a patient statement the statement should be filed in the correct chronological order of the patient medical record and released according to normal procedures.
- If the request is denied:
- The UW HCC unit will provide the patient/client with a timely, written denial in plain language that contains:
- The basis for the denial;
- The patient’s/client’s right to submit a written statement disagreeing with the denial and how the patient/client may file such a statement;
- As an alternative to “B” above, the patient’s/client’s right to request that the patient’s/client’s request for amendment and the UW HCC unit’s denial be provided with any future disclosures of the PHI that was the subject of the request;
- A description of how the patient/client may file a complaint with UW.
- A description of how the patient/client may file a complaint with the Secretary of the U.S. Department of Health and Human Services; and
- The name or title and the telephone number of the designated contact person who handles this type of complaint for UW.
- Statement of disagreement: the UW HCC unit must permit the patient/client to submit to the UW HCC unit a written statement disagreeing with the denial of all or part of a requested amendment and the basis of such disagreement. The UW HCC unit may reasonably limit the length of a statement of disagreement.
- Rebuttal statement: The UW HCC unit may prepare a written rebuttal to the patient’s/client’s statement of disagreement. Whenever such a rebuttal is prepared, the UW HCC unit will provide a copy to the patient/client who submitted the statement of disagreement.
- Recordkeeping: the UW HCC unit will, as appropriate, identify the record of PHI that is the subject of the disputed amendment and append, or otherwise link to it, the patient/client’s request for amendment, the UW HCC unit’s denial of the request, the patient/client’s statement of disagreement (if any), and the UW HCC unit’s rebuttal (if any) to the patient’s request and statement of disagreement to the designated record set.
- Future disclosures:
- If a statement of disagreement has been submitted by the patient/client, the UW HCC unit must include the material appended in paragraph “4” above, or at the election of the UW HCC unit, an accurate summary of any such information, with any subsequent disclosure of the PHI to which the disagreement relates.
- If a statement of disagreement has not been submitted by the patient/client, the UW HCC unit must include the patient’s/client’s request for amendment and its denial, or an accurate summary of such information, with any subsequent disclosure of the PHI only if the individual has requested such action in accordance with X.1.C. above.
- When a subsequent disclosure is made in connection with a standard that does not permit the additional material to be included with the disclosure, the UW HCC unit may separately transmit the additional material to the recipient of the standard transaction.
- When UW HCC receives notification from another organization that a patient/client’s protected health information has been amended, UW HCC:
- Will make the appropriate amendment to the PHI or record that is the subject of the amendment by, at a minimum, identifying the records in the designated record set that are affected by the amendment and appending or otherwise providing a link to the location of the amendment.
- May inform a business associate that uses or relies on the patient’s/client’s protected health information of the amendment, depending on if the amendment is material to the use of PHI by the business associate.
Consequences for Non-Compliance
Failing to comply with this policy may result in discipline for the individual(s) responsible for such non-compliance.
Further, the US Department Health and Human Services (HHS) Office for Civil Rights (OCR) is responsible for enforcing the HIPAA Privacy and Security Rules, and an individual’s non-compliance may result in institutional noncompliance and/or an investigation by OCR. OCR attempts to resolve investigations by obtaining voluntary compliance and entering into Corrective Action Plans and Resolution Agreements. Failures to comply with HIPAA or cooperate with OCR in an investigation may result in civil and/or criminal penalties.