Home : Academic/Research : Health Sciences

Individuals have a right to access their individual health information under both HIPAA and Minnesota law. In each circumstance where access is authorized or limited by these laws, the law giving greater rights of access to the individual controls. Combining HIPAA and Minnesota law, the following rules apply.

Individuals have the right to inspect and obtain a copy of all individual health information contained in the designated record set, including complete and current information possessed by the provider concerning any diagnosis, treatment, and prognosis of the individual, except that the following are excluded from the right to inspect and copy:

1. Information that is not maintained by the health care component.
2. Health information, if the provider reasonably determines, based on professional judgment that the information is detrimental to the physical or mental health of the patient, or is likely to cause the patient to inflict harm to self or others and the provider specifies the information to be denied and the grounds for denial prior to receipt of the request for access.
3. Information created or compiled in anticipation of or for use in a civil, criminal or administrative action or proceeding.
4. Health information created and received by a covered health care provider in the course of research that includes treatment and the research is still in progress, provided the individual agreed to the denial of access when consenting to participate in the research.

LABORATORY RESULTS
Lab results should be released from the laboratory only to the authorized person (the person who ordered the test). Lab reports that are part of the health record are subject to access by the individual.

REVIEW OF DENIAL
The individual may request review of denial when the denial is based on number 2 above. Within a reasonable time after receipt of the request, the health care component will provide review of denials made on the above ground. The health care component will designate a licensed health care professional who did not participate in the original denial for review of the denial. The health care component will inform the individual in writing of the result of the review and will provide access to the extent determined by the reviewing health care professional.

WRITING REQUIREMENTS
Health care components may require that requests by individuals for access be in writing. If the health care component requires the request to be in writing, the health care component will respond to oral requests for access by instructing the individual to submit a written request. All denials to requests for access must be in writing.

TIME PERIOD FOR ACTION
Health care components of the University must provide access within 10 working days of the individual's request.

PROVIDING ACCESS
If the health care component provides access, it must allow both inspection and copying of all PHI in the designated record set for which there is not a basis for denial. Access will be provided in a timely manner and in the form or format requested by the individual if the information is readily producible in that format, or if not in hard copy or other agreed upon form. If information is maintained in more than one form or location, the health care component need only provide access to one copy of the information.

If the individual agrees in advance and agrees to pay the fees imposed, the health care component may provide the PHI to the individual in summary or explanation form.

Reasonable, cost-based fees may be imposed for copies, including cost of supplies and labor, postage and preparation of an explanation or summary if applicable.

DENYING ACCESS
All denials must be in writing and must include:

1. the basis for denial
2. a statement of whether the individual has a right to a review of the denial; and
3. a description of how the individual may complain to the Privacy Officer or the Secretary, including the name/title, and telephone number of the Privacy Officer.

When access is denied for a portion of the individual health information requested, access to the information for which there is not a ground for denial will be provided to the individual.

If a request is made for information not maintained by the health care component and the health care component knows where the information is maintained, inform the individual in writing of where to direct the request.