Vignette

1
Vignette 1 May deny amendment of records if PHI
or record

• 1. Was not created by the covered entity (unless
  the originator is no longer available to act on
  the request)
• 2. Is not part of the record set
• 3. Would not be available for inspection under
  164.524 or
• 4. Is accurate and complete.

2
Other Amendment Obligations

• Must permit the individual to request the
  amendment
• May require requests to be in writing
• May require a reason to support the requested
  amendment
• Must inform individual in advance of requirements
  for amendments

3
Amendment Denials contd

• Must act on request within 60 days after receipt
  of request
• If deny--must be in writing/plain language
• 1. Include the basis for denial
• 2. Inform individual of right to submit a written
  statement disagreeing with the denial and how to
  file such a statement
• 3. Statement about including request and denial
  with any future disclosures relating to the
  amendment
• 4. How individual can complain to the covered
  entity or Secretary (including name, title and
  telephone number of privacy contact)

4
Amendment Denials contd

• Individual has a right to file written statement
  of disagreement including basis of disagreement
• Covered entity may reasonably limit length
• Covered entity may prepare a written rebuttal but
  must provide a copy to the individual
• Recordkeeping requirements in 164.526
• Actions on notices of amendment
• Document persons responsible for receiving and
  processing requests for amendment

5
Vignette 2 Child Abuse Reporting

• 42 CFR Part 2 and HIPAA both allow a provider to
  make an initial report of child abuse/neglect to
  appropriate state authorities
• 42 CFR exception does not cover elder abuse,
  adult abuse or domestic violence
• Restrictions continue to apply to original
  patient records
• Additional information may not be disclosed
  except as allowed under 42 CFR Part 2 (i.e.
  written consent or court order)

6
Vignette 3 Search Warrant

• Search warrant not sufficient to compel
  disclosure under 42 CFR Part 2
• An appropriate court order meeting requirements
  of 42 CFR Part 2 is also required
• HIPAA Privacy Rule allows disclosure of PHI to
  law enforcement personnel under a search warrant
  (need to determine whether warrant is valid, is
  overly broad, etc.)
• Follow 42 CFR Part 2

7
Vignette 4 Crimes

• Any duty to report crimes under state law?
• Does it depend on the type of crime?
• Does it depend on whether the patient commits the
  crime?
• Does it depend on where the patient commits the
  crime (I.e. program premises)
• Non-patient identifying report?
• Does it constitute a confidential communication
  and can you disclose?