Home : Academic/Research : Health Sciences

Individuals have the right to request amendment to individual health information under both HIPAA and Minnesota law. In each circumstance where amendment is authorized or limited by these laws, the law giving greater rights of amendment to the individual controls. Combining HIPAA and Minnesota law, the following rules apply.

WRITING REQUIREMENT
Health care components may require that requests for amendment be made in writing and may require the individual to provide a reason to support the requested amendment.

TIME PERIOD FOR ACTION
Health care components must act on an individual's request to amend information within 30 days from receipt of the request.

ACCEPTING AMENDMENTS
If the health care component grants the request for amendment in whole or part:

1. The individual should be informed that the amendment is accepted.
2. The individual health information or record must be amended by identifying the records in the designated record set that are affected and appending or otherwise providing a link to the location of the amendment.
3. The individual's identification of persons who have received PHI about the individual and needing the amendment must be obtained.
4. The individual's agreement to have the health care component notify the persons they have identified for the purpose of informing the persons of the amendment must be obtained.
5. Reasonable efforts must be made to inform and provide the amendment within a reasonable time to the following:
   • persons identified by the individual;
   • persons, including business associates, that the health care component knows have the individual health information that is the subject of the amendment and that may have relied, or could foreseeably rely upon the information to the detriment of the individual.
6. The process for denying amendments as to any portion of the amendment that is not accepted should be followed.

DENYING REQUESTS FOR AMENDMENT
Requests for amendment may be denied if:

• The health care component determines the information is accurate and complete; and/or
• The individual health information or record was not created by the health care component, unless the individual provides a reasonable basis to believe that the creator of the individual information is no longer available to act on the request.

CONTENT REQUIREMENTS FOR DENIALS
All denials must be in writing and must include:

1. the basis for denial;
2. statement of the individual's right to submit a written statement disagreeing with the denial and where to file the statement of disagreement;
3. statement that the individual may request that the health care component provide the request for amendment and denial with any future disclosures of the individual health information that is the subject of the denied amendment; and
4. a description of how the individual may complain to the Privacy Officer or the Secretary, including the name/title, and telephone number of the Privacy Officer.

DISPUTED AMENDMENTS
If the amendment is denied, the individual must be permitted to submit a written statement of reasonable length disagreeing with the denial and stating the basis for disagreement. Under Minnesota law, the individual also may request a hearing to challenge the data. If the individual prepares a written statement of disagreement, the health care component may prepare a rebuttal statement in response. If a rebuttal statement is prepared by the health care component, a copy must be provided to the individual who submitted the statement of disagreement.

The record or individual health information in the designated record set that is the subject of the disputed amendment should be identified and the individual's request for amendment, the denial of the request, the individual's statement of disagreement and the rebuttal must be appended or otherwise linked to the designated record set.

FUTURE DISCLOSURES OF INDIVIDUAL HEALTH INFORMATION RELATED TO A REQUEST FOR AMENDMENT
If the amendment is accepted, the amendment information must be provided with any subsequent disclosures.

If the request is denied and the individual submits a written statement, the appended material related to the disputed amendment or an accurate summary of the appended information must be provided with any subsequent disclosure of the information to which the request for amendment relates.

If the request is denied, and the individual does not submit a written statement of disagreement, the request for amendment and denial must be provided with future disclosures, only if the individual so requests.

When subsequent disclosures related to a disputed amendment are part of a standard transaction that does not allow provision of the required information as part of the transaction, the amendment information may be sent separately to the recipient of the standard transaction.

AMENDMENTS MADE BY OTHER COVERED ENTITIES
If the health care component is informed by another covered entity of an amendment to an individual's individual health information agreed to by the other covered entity, the individual health information in the designated record set which was created by the covered entity that agreed to the amendment must be amended accordingly.