TITLE:

EXERCISING PATIENT RIGHTS RELATED TO PROTECTED HEALTH INFORMATION

POLICY:
Columbia University Medical Center will respond appropriately to patients' requests to exercise the rights granted to them by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) in accordance with city, state, and federal laws and regulations.

PURPOSE :
Patients are granted numerous rights as regards their protected health information (PHI) by HIPAA:

1. The right to inspect their PHI and to obtain a copy of it;



2. The right to request an amendment to their PHI;



3. The right to an Accounting of Disclosures made by Columbia University Medical Center;



4. The right to request restrictions on the uses and disclosures of their PHI made by Columbia University Medical Center;



5. The right to request that Columbia University Medical Center communicate with them about their PHI at an alternative location (i.e., at work instead of at home) or via alternative means (i.e., mail only); and



6. The right to receive a paper copy of Columbia University Medical Center's Notice of Privacy Practices even if the patient has requested the Notice electronically.

Each of these rights is described in some detail in the Columbia University Medical Center's Notice of Privacy Practices, including a description of any limitations to a specific right. In addition, some of the rights require action on the part of the patient before Columbia University Medical Center can respond. This Policy describes each of the rights granted to patients under HIPAA, what the patient must do to exercise each right, further details about the limitations, if any, associated with each right, and how Columbia University Medical Center will respond to patients who want to exercise their rights.

PROCEDURES:

1. Right to Inspect and Receive a Copy of the Patient's PHI.
1. Patients have the right to inspect and to obtain a copy of their PHI. This right, however, has some limitations:
1. A patient must request to access, inspection, or obtain a copy of his/her PHI in writing. (See 1.b below)



2. The patient may only access, inspect, and/or obtain a copy of his/her PHI in a "designated record set." The designated record set does not include, and the patient may not access:
1. Psychotherapy notes about the patient;



2. Personal notes and observations about the patient created by a health care provider (provided such notes and observations are not included in the patient's medical record);



3. PHI that is compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding; and



4. PHI that is subject to the Clinical Laboratory Improvements Amendments of 1988 (CLIA).


3. The patient's provider can provide a summary of the patient's PHI in lieu of granting access to all the patient's PHI if, in the professional judgment of the patient's provider, providing the patient with unlimited access to his/her PHI would endanger the life or physical safety of the patient or another person.



4. Columbia University Medical Center will not provide the patient with access to, the opportunity to inspect, or a copy of any PHI created by a provider or entity outside of Columbia University Medical Center.



5. If the patient wants to access or inspect his/her PHI, Columbia University Medical Center can:
1. require the patient to come to Columbia University Medical Center during normal business hours in order to access or inspect his/her PHI; and



2. have a records custodian or other employee be physically present for the access or inspection.


2. If a patient requests access to his/her PHI, the individual receiving the request must obtain a completed Request for Access to Health Information form from the patient prior to processing his/her request.
   
   The Request for Access to Health Information form is available on the Columbia University Medical Center website. Click on Administrative Services or "Patient Care" from the home page, then click on the link to HIPAA on the right side of the page. Select the form from the list of forms available on the left side of the page.



3. All completed Request for Access to Health Information forms will be maintained by the office processing the patient's request for a minimum of six (6) years. (The completed Request for Access to Health Information form(s) may be stored in the patient's file, but completed forms will not be considered part of the patient's designated record set.)


2. Right to Request Amendments
   Right to an Accounting of Disclosures
   Right to Request Restrictions
1. A patient's request to exercise any of these rights will be processed by the HIPAA Privacy Office within the timeframes required by law once the appropriate request form is received by the HIPAA Privacy Officer.



2. If a patient requests an amendment of his/her PHI, an accounting of the disclosures made by Columbia University Medical Center of his/her PHI, or a restriction on the use or disclosure of his/her PHI, the individual receiving the request must ask the patient to complete the appropriate request form and send it to the HIPAA Privacy Officer.
   
   Each of the specific request forms, Request for an Amendment to Health Information, Request for an Accounting of Disclosures, and Request for Restrictions on Uses and Disclosures of Health Information, are available on the Columbia University Medical Center website. Click on Administrative Services or "Patient Care" from the home page, then click on the link to HIPAA on the right side of the page. Select the form from the list of forms available on the left side of the page.



3. Patients who have questions about how to complete the form or whether their request has been granted should be directed to contact the HIPAA Privacy Officer at 212-305-7315.


3. Request for Communications at an Alternative Location or by Alternative Means
1. Patients may request Columbia University Medical Center communicate with them about medical matters in a certain way (e.g., by mail only) or at a certain location (e.g., at work). The individual receiving a request from the patient for communications at an alternative location or by alternative means should ask the patient to complete the Request for Communications at an Alternative Location or by an Alternative Means form before processing the request.
   
   The Request for Communications at an Alternative Location or by an Alternative Means form is available on the Columbia University Medical Center website. Click on Administrative Services or "Patient Care" from the home page, then click on the link to HIPAA on the right side of the page. Select the form from the list of forms available on the left side of the page.



2. All completed Request for Communications at an Alternative Location or by an Alternative Means forms will be maintained by the office processing the patient's request for a minimum of six (6) years. (The completed Request for Communications at an Alternative Location or by an Alternative Means form(s) may be stored in the patient's file, but completed forms will not be considered part of the patient's designated record set.)


4. Right to a Paper Copy of the Columbia University Medical Center Notice of Privacy Practices. Any person who requests a copy of the Columbia University Medical Center Notice of Privacy Practices should be given a copy.



5. Minors.
1. A minor is an individual who is younger than 18 years of age.



2. A minor's personal representative is the minor's parent, legal guardian, or another person who has documentation proving he/she has legal custody of the minor (e.g., a stepparent who presents valid custody papers).



3. Unless the minor's PHI is or includes a category of PHI described in the Rights of Minors to Keep Certain Categories of Protected Health Information Confidential Policy, a minor's personal representative may exercise any of the patient rights defined in this Policy as if he/she were the patient.


6. Document Retention. All documentation relating to requests for a patient's PHI will be maintained for a minimum of six (6) years.



7. Definitions

Protected Health Information (PHI) means information that relates to the past, present or future physical or mental health or condition of an individual, the provision of health care to an individual or the past, present or future payment for the provision of health care to an individual and identifies or could reasonably be used to identify the individual.

Designated Record Set (DRS) means the set of clinical and/or financial information, records, and documents the healthcare provider would provide to the patient upon a request from the patient to access his/her PHI at that healthcare provider's office.

RESPONSIBILITY:         HIPAA Privacy Officer, Department Administrators