consumer has a right to adequate notice of the uses and disclosures of PHI
that may be made by the covered entity, and of the individualís rights and
the covered entityís legal duties with respect to protected health
The Notice of Privacy Practices
summarizes all the rights of the consumer related to his identifiable health
The consumer has the
- Right to
Request Restrictions of Uses and Disclosures of PHI. A covered entity must
permit a consumer to request that the covered entity restrict
To request to receive
communications of PHI by alternative means or at alternative locations.
This must be permitted if the consumer clearly states that the disclosure
of all or part of that information could endanger the individual. The
covered entity can condition the provision of a reasonable accommodation
on assurances of how payment will be handled.
- Right to copy of record. This
right currently exists for all consumers under various Illinois statutes,
including those seeing general health care providers, those receiving
specialized care for mental health, substance abuse, or AIDS treatment. An
individualís access may be denied if the PHI was obtained from someone
other than a health care provider under a promise of confidentiality and
the access requested would be reasonably likely to reveal the source of
- Denial of Access. Although
there are various circumstances where HIPAA allows the provider to deny
access, these provisions are preempted by Illinois law, which allows the
consumer access to his record in almost all circumstances.
- Timely Access. Under HIPAA,
copies of records are to be provided within 30 days.
Right to Amend PHI. The consumer
has a right to have the Provider amend PHI as long as it is maintained in
the designated record set. The Provider can deny making the amendment
Elm City Center is to act within 60 days. See
Request for Amendment of Clinical Record Form. A provider can deny an
amendment. The consumer can disagree with the denial, and then submit a
statement, and the Provider can submit a rebuttal statement. This can all
become part of the record. Generally, if the consumer is disputing
something in the record and it is questionable, then the Provider should
include in the record the consumerís comments and make that part of the
record. If the Provider accepts amending the record, then the Provider
should also notify others identified by the consumer as having received
the PHI and needing the amendment.
Accounting for Disclosures of PHI. The
consumer has a right to receive an accounting of the disclosures made of
his PHI for a period of six years prior to the date the accounting is
requested. This does not
include giving an accounting when the disclosures were for:
Used to carry out treatment, payment and health care operations.
due to a consumerís authorization.
To persons involved in the individualís care.
That occurred prior to the compliance date for the covered entity.
Disclosures that are part of a limited data set.
Disclosures that are merely incidental to another permissible use or
The six years begins to run
forward starting with the effective date of April 14, 2003 or the first
date of treatment by the consumer after April 14. 2003. The accounting
must include the date of the disclosure and who it was released to and a
brief description of the PHI that was disclosed. Keep in your HIPAA
notebook any responses to accounting for disclosures.