Right of Access Rule & HIPAA | AdvancedMD

Features Navigation

Live Chat (800) 825-0224 Live Demo

← Back

Right of Access Rule & HIPAA


Home Office

When we discuss HIPAA most of the articles have been on security and breaches, but HIPAA goes well beyond privacy and security. One aspect of the HIPAA rule is the “Right of Access”.

OCR (The Office for Civil Rights – the branch of HHS the enforces HIPAA) is enforcing this law even more strongly since the 21 Century Cures Act was published. OCR has begun to levy fines against organizations that are in violation of the “Right of Access” rule.

What is the Right of Access Rule?

When a request is made for access to medical records, HIPAA-covered entities must provide access or supply a copy of the requested medical records as soon as possible, but no later than 30 days after the request is received.

Each state may have its own requirements on responding to a request for medical records, but the HIPAA regulations are probably the most stringent. Under HIPAA you MUST provide a patient with access to their requested records or a copy of the records within 30 days of the request.

Back in the days of paper this was relatively simple. All we had to do was copy the paper chart and provide that copy to the patient. In the world of electronic records this can become much more complicated. Now the medical record can include:

  • Your notes
  • Laboratory reports
  • Examinations that may be outside your notes
  • Notes from referring doctors or reports from doctors you referred the patient to. Are these part of your note or are they technically part of the other doctors note?
  • The data you may have pulled back from a drug benefit plan into your EHR
  • Problem lists
  • Medication lists

Now would be a very good time to develop an office manual and policy defining what we consider part of the medical record when a request comes in. For example, you may wish to determine that a generic request for medical records only includes encounter notes and anything that is not specifically requested is not sent out. How to define your medical record is a conversation best had with your medical malpractice carrier or health care attorney in your state.

Now that you have defined what will be provided when you get a request for a ‘medical record’ you must provide that information to the patient within 30 days. You also want to have clear documentation and proof that it was provided within the specified time period. If you are sending out paper copies or electronic copies on media (such as a flash drive), this is best done by requiring a signature and getting the signed slip back as proof of delivery. Another method of providing the requested information is to use a patient portal. To push the requested documents to the portal and send the patient a message that the documents are available for them gives you an electronic time stamp of when the documents were made available at the portal, and you would also have a time date stamp when the patient accessed the patient portal.

If the patient happens to come into the office to pick up the records, have them sign for the records along with a time and date on the form. If the patient sends somebody to pick up the forms, there creates another HIPAA issue to deal with:

  • Is the person who is coming to pick up the forms one of the individuals you are allowed to share patient information with?
  • If the patient is sending a third party, require that the individual have a signed letter from the patient authorizing them to receive the information.
  • Compare the signature on the form to copies of the patient’s signature you have on other documents.

Providing patient information to an unauthorized individual is a HIPAA violation. You do not want to commit one type of HIPAA violation while trying to avoid a different type of HIPAA violation.

HIPAA is complex and goes well beyond just the privacy and security of the medical records at your practice. You need to have a HIPAA manual that addresses how you will deal with the various aspects of HIPAA and you need to have a consultant available to help you determine what to do with something unexpected happens.

Your job is to be a doctor, and when it comes to HIPAA, don’t try to do it yourself. Focus on the one activity that enables you to earn an income, treating patients and bring in a capable team of specialists to assist you for every other aspect of your practice.

For more information about TLD Systems, please visit the AdvancedMD Integration Partner Marketplace page.

Michael Brody, DPM
Dr Brody has been actively involved in Computers and Medicine since the 1980’s. Dr Brody as a Residency Director at a VA hospital on Long Island and was present as the VA moved from paper records to computerized records. During this time, he was exposed to the stringent rules and regulations that government employees need to adhere to when protecting patient information. He co-founded TLD Systems with Warren Melnick to create a platform that doctors who wish to work in private practice have a cost-effective method of implementing HIPAA compliance in their practices in a manner that does not interfere with their ability to practice medicine. He has served on the Health Information Technology Standards Panel (HITSP), the Standards and Interoperability Framework (S&I), as a member of the Ambulatory Care Committee at the Certification Commission on Health Information Technology (CCHIT), and numerous other organizations. He is currently a member of the Physicians Committee at the Healthcare Information and Management Systems Society (HIMSS) and a co-Chair of the EHR workgroup at Health Level Seven International (HL7)


Other Resources Related to This Topic


Driving Practice Outcomes with Integrated Remote Patient Monitoring

Did you know remote patient monitoring (RPM) benefits include better clinical as well as financial...


Remote Patient Monitoring Product Sheet

Remote patient monitoring (RPM) is a rapidly-evolving program where healthcare providers are able to manage...


AdvancedMD and Doctorsoft

Ophthalmology practices using Doctorsoft EHR now have a powerful billing software option through a unique...

“The money I have invested in AdvancedMD is miniscule compared to the return. I have never been more efficient – ever – in my professional life as I am now.”

Jed Shay, MD
The Pain Care Center

Read the story  ›

“[Our] patients are very well-educated and well-informed, and they want to see results quickly. The practice has to run extremely efficiently and be accessible to them. The nice thing about [AdvancedMD] is it has allowed me to be more efficient both in and out of the office. Now I don’t have to come back into the office, which is great for my family and everything else. It saves me a lot of time – probably an hour a day on the three days I work in the second office.”

Keith Berkowitz, MD
Center for Balanced Health

Read the story  ›

“The best thing I ever did in private practice was getting AdvancedMD—it has liberated me.”

Estaban Lavato, MD
La Loma Medical Center

“Having integrated practice management and EHR is absolutely wonderful, you don’t have to flip back and forth between systems—all of your information is at hand when needed.”

Raju Raval, MD

Read the story  ›