HHS Guidance on Rights to Access Medical Records

DHHS logoThe U.S. Department of Health and Human Services (HHS) Office for Civil Rights recently issued guidance on individuals’ rights to access medical records under the Privacy Rule (45 C.F.R. 160; 45 C.F.R. 164, Subparts A & E) of the Health Insurance Portability and Accountability Act (HIPPA; Pub. L. 104-191).  HIPPA covered entities are required to provide requesting individuals with access to “protected health information” (PHI) about them within “designated record sets” (DRS), as long as the information is maintained by the entity or a business associate on behalf of the entity, regardless of when the information was created, whether the information is maintained in paper or electronic format, and whether the information is maintained onsite or remotely.  An individual’s personal representative (eg, medical power of attorney) also has the right to access that individual’s PHI in DRS.  DRS include medical and billing records; enrollment, payment, claims adjudication, and case/medical management records; and other records used to make decisions about patients, whether or not the records were used to make a decision about the specific individual requesting access.  Individuals do not have rights to psychotherapy notes and information compiled for use in a civil, criminal or administrative action.  Also, individuals do not have rights to PHI not part of a DRS, because such information is not used to make decisions about individuals.  Such PHI include quality assessment records, patient safety activity records, and management records used for business decisions.  For additional information, see the HHS Individuals’ Right under HIPAA to Access their Health Information page.