Access by Individuals to Protected Health Information

Statement of Policy (Download Policy) (Download Procedure)

Washington University and its member organizations (collectively, “Washington University” or “WU”) are committed to conducting business in compliance with all applicable laws, regulations and WU policies. As part of this commitment, WU has adopted a policy to allow Individuals to access Protected Health Information (PHI).

Scope of Policy

The scope of this Policy covers an Individual’s right to access that portion of the Individual’s PHI that is contained in a Designated Record Set (as defined herein) for inspection or to obtain a copy. WU is required to provide this access. This right of access by an Individual to that Individual’s PHI contained in a Designated Record Set, and the exceptions to it, are outlined in this Policy.

Policy

1) The Right of Access.

a) An Individual has the right to request access to his or her PHI that is maintained in a Designated Record Set. Such right of access may be for inspection or to obtain a copy.

b) In general, a Designated Record Set should contain the following information from the medical and billing records found in Allscripts and/or GE Centricity, if any:

Medical Record:
i) Face Sheet (Admission Information, Registration, Insurance)
ii) Physician Orders
iii) Vital Sign Work Sheet
iv) History and Physical Exam
v) Office visit notes
vi) Nurses Notes and Other Ancillary Provider Notes
vii) Radiology Reports
viii) Pathology, Laboratory and other Ancillary Reports
ix) Operative Reports
x) Consultation Reports or Notes
xi) Treatment Record such as problem lists, medication lists, plan of care
xii)Photos, videos, or other recordings used for treatment

 

Billing Record:
xii) Patient Name, Address
xiii) Plan (Insurer) Name, Patient ID Number
xiv) Provider Name, Address, Tax ID
xv) Ordering/Referring Physician Name
xvi) Charge, Allowable, Paid by Plan, Paid by Patient, Paid by Other Source
xvii) Contract Amount/Write Off/Disallowed/Denied Amount
xviii) Diagnosis Codes
xix) Procedure Codes and Modifiers
xx) Units of Service
xxi) Dates of Service

A Designated Record Set for a Health Plan should include the enrollment, Payment, claims adjudication and case or medical management record systems maintained by or for the Health Plan.

2) Exclusions.

Individuals may NOT access PHI maintained outside the Designated Record Set and the following types of PHI:

• Psychotherapy Notes
• Information compiled in reasonable anticipation of civil, criminal, or administrative action or other proceeding
• PHI created or obtained by a Health Care Provider in the course of Research that includes treatment where the Individual consented to the denial of access when he or she consented to participate in the research and WU informed the Individual that access would be restored upon completion of the research.

3) Procedure for Processing Requests for Access.

a) For most requests, the WU Health Information Release Service will receive and process requests for access from Individuals. If the Business Unit handles patient requests for access, the Business Unit within WU will identify the title(s) of the person(s) who will receive requests for access from Individuals and who will be authorized to Disclose PHI pursuant to such requests.

b) Request Form. WU will inform Individuals that all requests for access must be submitted in writing. See Form, Exhibit A.

c) Response Time Frames and Extension. WU will take action on a request for access by granting or denying the requested access no later than 30 days after receipt of the request. If the requested PHI is maintained off-site in storage or is not accessible on-site, WU may obtain a one-time extension of no more than 30 days. To obtain the extension, WU will contact the requesting Individual within 30 days after the date of receipt of the request and provide the Individual with a written statement containing the reasons for the delay in responding and the date by which WU will complete its action on the request. Once the extension is requested, WU must complete its action on the patient’s request for access within 60 days of receipt of the patient’s initial request.  See Form, Exhibit B.

d) Reviewing Requests. The Health Information Release Service and/or the HIPAA Privacy Liaison for the WU Business Unit that receives an Individual’s written request for access will review such request and determine whether the request will be granted or denied in accordance with this Policy.

e) Designation of Reviewing Official. WU will designate a licensed health care professional who shall serve as the reviewing official for denials of access. Such designated licensed health care professional may not participate in the initial review and decision to either grant or deny access.

4) Granting of Access.

a) If the request for access is granted, WU will provide the requesting Individual access through inspection, copying or both, and will provide the information in the form requested if readily producible in such form, and if not, then in hard copy.

b) If the requested PHI is maintained in more than one Designated Record Set or at more than one location, WU shall produce the requested PHI once in response to the request.

c) WU may provide a summary or an explanation of the PHI in lieu of providing a copy of the PHI if it first obtains the Individual’s consent to receive such summary or explanation and the Individual’s agreement to pay for any fees related to the summary. Summaries or explanations of PHI should be prepared by the involved health care professional or other designated health care professional. WU’s fees related to the summary shall not be greater than that provided under Missouri state law.

d) WU may request payment of a reasonable, cost-based fee incident to the copying of PHI that includes only the cost of copying, including labor and supply costs, and postage. We may not charge patients a fee related to search and retrieval.  WU’s fees related to the release of information shall be based on average labor costs to fulfill standard types of access requests.  Please refer to Exhibit D, Cost Sheet for the Release of Records to Individual or Individual’s Personal Representative.

5) Denial of Access.

a) Process for Denying Access.
The WU Business Unit will review the request and determine whether a ground for denial exists and, if so, whether the Individual is entitled to an appeal of the denial. The WU Business Unit will inform the Privacy Office of any intention to deny access. If appeal of the decision to deny access is anticipated, WU Privacy Office may contact the attending physician for his or her guidance with regard to the request for access and the intended denial.
b) Denials of Access that may be Appealed.
If a request for access is denied for any of the following reasons, the denial may be appealed.
i) a licensed health care professional has determined that the access requested is reasonably likely to endanger the life or physical safety of the Individual or another person;
ii) the PHI contains references to another person (excluding other licensed health care providers) and a licensed health care professional has determined that the access requested is reasonably likely to cause substantial harm to such other person; or
iii) the request is made by the Individual’s personal representative (including a minor’s) and a licensed health care professional has determined that the access by the personal representative is reasonably likely to cause substantial harm to the Individual or another person.
c) Denials of Access that may Not be Appealed.
i) information requested is Psychotherapy Notes;
ii) information requested is compiled in reasonable anticipation of litigation;
iii) request is from an inmate because WU is rendering services under the direction of the correctional facility and the PHI would jeopardize the health or safety of the Individual or of other inmates or any others having contact with the inmate;
iv) the information requested has been created or obtained by a Health Care Provider in the course of Research that includes treatment where the Individual consented to the denial of access when he or she consented to participate in the research and WU informed the Individual that access would be restored upon completion of the research;
v) the information requested is contained in records subject to the Privacy Act where access could be denied under the Privacy Act;
vi) the information requested has been obtained from someone other than a Health Care Provider under a promise of confidentiality and the access would be reasonably likely to reveal the source of the information.

d) Communication of Denials.
Regardless of whether a denial for access may be appealed or not,  WU will provide the following to the Individual:
i) to the extent possible, access to non-excluded PHI;
ii) written notice of denial (See Form, Exhibit C) stating, in plain language,
• the ground(s) for the denial;
• the appeal rights, if any, available to the Individual including a description of how the Individual may initiate an appeal; and
• a description of the complaint process that an Individual may follow with WU concerning his or her privacy, including the name or title and telephone number of the contact person at WU responsible for receiving complaints of privacy concerns, or with the Secretary; and
iii) the location of the PHI if WU does not maintain the requested PHI.

d) Process to Review of Appealed Denials.

An appeal of a denial shall be made by the Individual in writing and shall include the reason for the appeal. If an Individual whose request for access is denied and there are grounds for an appeal of the denial decision, WU will promptly refer the request for review of the appeal to the designated licensed health care professional. The designated licensed health care professional must determine, within a reasonable period of time and based upon criteria allowing such an appeal, whether to uphold or reverse the original decision to deny the access. The WU Business Unit will be bound by the determination of the designated licensed health care professional and will promptly provide written notice of the designated licensed health care professional determination to the Individual and to the WU Privacy Office and take the appropriate action, if any.
Creation Date: November 22, 2002
Effective Date: April 14, 2003
Last Revision Date: February 21, 2003; July 9, 2012; September 5, 2014; August 31, 2015; April 1, 2016