A consumer has a right to adequate notice of the uses and disclosures of PHI that may be made by the covered entity, and of the individual’s rights and the covered entity’s legal duties with respect to protected health information.

The Notice of Privacy Practices summarizes all the rights of the consumer related to his identifiable health information.

  1. The consumer has the following rights:
  2. Right to Request Restrictions of Uses and Disclosures of PHI. A covered entity must permit a consumer to request that the covered entity restrict
  3. Uses or disclosures of PHI to carry out TPO; and
    Listing consumer in its directory of individuals in the facility. (The person has a right to object to this information being shared with clergy.
    Sharing information with the consumer’s family member, relative or close personal friend.
    Elm City Center is not required to agree to the above restriction, but if it does, it may not use PHI in violation of such restriction except for emergency treatment
  4. To request to receive communications of PHI by alternative means or at alternative locations. This must be permitted if the consumer clearly states that the disclosure of all or part of that information could endanger the individual. The covered entity can condition the provision of a reasonable accommodation on assurances of how payment will be handled.
  5. Right to copy of record. This right currently exists for all consumers under various Illinois statutes, including those seeing general health care providers, those receiving specialized care for mental health, substance abuse, or AIDS treatment. An individual’s access may be denied if the PHI was obtained from someone other than a health care provider under a promise of confidentiality and the access requested would be reasonably likely to reveal the source of the information.
  6. Denial of Access. Although there are various circumstances where HIPAA allows the provider to deny access, these provisions are preempted by Illinois law, which allows the consumer access to his record in almost all circumstances.
  7. Timely Access. Under HIPAA, copies of records are to be provided within 30 days.
  8. Right to Amend PHI. The consumer has a right to have the Provider amend PHI as long as it is maintained in the designated record set. The Provider can deny making the amendment based on:
  • The record was not created by the Provider; or
  • The information is not part of the designated record set; or
  • The information is accurate and complete

Elm City Center is to act within 60 days. See Request for Amendment of Clinical Record Form. A provider can deny an amendment. The consumer can disagree with the denial, and then submit a statement, and the Provider can submit a rebuttal statement. This can all become part of the record. Generally, if the consumer is disputing something in the record and it is questionable, then the Provider should include in the record the consumer’s comments and make that part of the record. If the Provider accepts amending the record, then the Provider should also notify others identified by the consumer as having received the PHI and needing the amendment.

Accounting for Disclosures of PHI. The consumer has a right to receive an accounting of the disclosures made of his PHI for a period of six years prior to the date the accounting is requested. This does not include giving an accounting when the disclosures were for:

  1. Used to carry out treatment, payment and health care operations.
  2. Released due to a consumer’s authorization.
  3. To persons involved in the individual’s care.
  4. That occurred prior to the compliance date for the covered entity.
  5. Disclosures that are part of a limited data set.
  6. Disclosures that are merely incidental to another permissible use or disclosure.

The six years begins to run forward starting with the effective date of April 14, 2003 or the first date of treatment by the consumer after April 14. 2003. The accounting must include the date of the disclosure and who it was released to and a brief description of the PHI that was disclosed. Keep in your HIPAA notebook any responses to accounting for disclosures.