Skip to Main Navigation
Skip to Main Content
The University of Texas at Dallas

HIPAA Privacy Manual

Section 10: Patient Right to Amend PHI

Audience:

The information in this document applies to all UTD faculty, staff, students, volunteers, and any other contractors or agents granted access to Protected Health Information (PHI).

Definition:

Designated Record Set: A group of records maintained by or for UTD that are:

  1. The medical records and billing records about patients maintained by or for UTD;
  2. The enrollment, payments, claims adjudication, and case or medical management record systems maintained by or for a health plan; or
  3. Used, in whole or in part, by or for UTD to make decisions about patients.

Policy:

Patients have a right to amend information collected and maintained about them in their designated record set. An individual has the right to have UTD amend PHI or a record about the individual in a designated record set for as long as the PHI is maintained in the designated record set. UTD may deny an individual’s request for amendment, if it is determined that the PHI or record that is the subject of the request:

  • Was not created by UTD, unless the individual provides a reasonable basis to believe that the originator of the PHI is no longer available to act on the requested amendment;
  • Is not part of the designated record set;
  • Would not be available for inspection under the Access and Denial of Patient Request for PHI Policy; or
  • Is accurate and complete.

The individual must make the request to amend the PHI in writing with a reason to support a requested amendment. The request should be on the appropriate form. UTD must accept all requests to amend PHI in the designated record set; however, UTD is not required to act on the individual’s request as noted in this policy. UTD must act on the individual’s request for an amendment no later than 60 days after receipt of such a request. If UTD is unable to act on the amendment within the required 60 day time limit, UTD may extend the time for such action by no more than 30 days, provided that UTD provides the individual with a written statement of the reasons for the delay and the date by which action on the request will be completed; and UTD may have only one such extension of time for action on a request for an amendment.

If the amendment is granted, in whole or in part,

  • UTD must make the appropriate amendment to the PHI or record that is the subject of the request for amendment by, at a minimum, identifying the records in the designated record set that are affected by the amendment and appending or otherwise providing a link to the location of the amendment.
  • UTD must inform the individual in a timely manner that the amendment is accepted and obtain the individual’s identification of and agreement to have UTD notify the relevant persons with which the amendment needs to be shared.
  • UTD must make reasonable efforts to inform and provide the amendment within a reasonable time, to persons identified by the individual as having received PHI about the individual and needing the amendment; and to persons , including business associates, that UTD knows have the PHI that is the subject of the amendment and that may have relied, or could foreseeably rely, on such information to the detriment of the individual.

If the requested amendment is denied, in whole or in part, UTD must provide the individual with a timely, written denial. The denial must use plain language and contain:

  • The basis for the denial, in accordance with procedure two (2) on page one (1) in this policy;
  • The individual’s right to submit a written statement disagreeing with the denial and how the individual may file such a statement;
  • A statement that, if the individual does not submit a statement of disagreement, the individual may request that UTD provide the individual’s request for amendment and the denial with any future disclosures of the PHI that is the subject of the amendment; and
  • A description of how the individual may complain to UTD or the Secretary of the Department of Health and Human Services (HHS) in accordance with the UTD Privacy Complaint Process.

Additionally for denials:

  • UTD must permit the individual to submit a written statement disagreeing with the denial of all or part of a requested amendment and the basis of such disagreement.
  • UTD may reasonably limit the length of a statement of disagreement.
  • UTD may prepare a written rebuttal to the individual’s statement of disagreement. Whenever such a rebuttal is prepared, a copy of the rebuttal must be provided to the individual who submitted the statement of disagreement. UTD must, as appropriate, identify the record or PHI in the designated record set that is the subject of the disputed amendment and append or otherwise link the individual’s request for an amendment, the denial of the request, the individual’s statement of disagreement, if any, and the rebuttal, if any, to the designated record set.

For future disclosures:

  • If a statement of disagreement has been submitted by the individual, UTD must include the patient’s request for an amendment, the denial of the request, the patient’s statement of disagreement and the rebuttal, if any, or an accurate summary of any such information, with any subsequent disclosure of the PHI to which the disagreement relates. PHI to which the disagreement relates.
  • If the individual has not submitted a written statement of disagreement, UTD must include the individual’s request for amendment and its denial, or an accurate summary of such information, with any subsequent disclosure of the PHI only if the individual has requested such action.
  • When a subsequent disclosure is made using a standard transaction that does not permit the additional material to be included with the disclosure, UTD may separately transmit the material required to the recipient of the standard transaction.

If UTD is informed by another provider or payer of an amendment they have made to an individual’s PHI within the outside entities’ designated record set, UTD must amend the PHI in designated record sets that have been received from those outside entities. However, UTD does not have to amend the PHI in the UTD designated record set based upon an outside determination, unless UTD has relied on the outside entities’ findings.

Procedure: Patients may request to have their PHI amended by submitting the appropriate form.

Enforcement: Supervisors are responsible for enforcing this policy. Individuals who violate this policy will be subject to the appropriate and applicable disciplinary process, up to and including termination or dismissal.