I. Purpose and Scope:
- The purpose of this policy is to establish a process for individuals to access, inspect, and obtain a copy of certain protected health information (“PHI”) maintained by Tufts University School of Dental Medicine (TUSDM).
II. Policy Statement:
- TUSDM shall process, in accordance with these procedures, an individual’s (or his or her authorized representative’s) request to access, inspect, or obtain a copy of certain PHI maintained by TUSDM.
III. Definitions:
IV. General Rules:
- RIGHT OF ACCESS TO PROTECTED HEALTH INFORMATION.
- Basic Right to Access. The individual has a right of access, to inspect and obtain a copy of his or her PHI held by TUSDM, for as long as the PHI is maintained by TUSDM. As of February 17, 2010, if TUSDM maintains an EHR, the individual has the right to request that TUSDM send a copy of the PHI in electronic format to the individual or to a third party identified by the individual. There are, however, some exceptions to the right of access, which are set forth below.
- Designated Record Set. TUSDM is not required to provide patients with access to all types of information that it holds. Instead, TUSDM must allow the patient access to information maintained in a “designated record set” for as long as TUSDM keeps the records. The designated record set includes medical records, billing records, and any other records used by or for TUSDM to make decisions about patients. The TUSDM Security & Privacy Officer is responsible for identifying and documenting the patient records that make up the “designated record set” (Appendix A: Designated Record Set Standards).
- Limits on the Right to Access. TUSDM must permit an individual to request access to inspect or to obtain a copy of the PHI about the individual that is maintained by or for TUSDM. TUSDM may require the individual to make requests for access in writing, provided that TUSDM informs individuals of this requirement in advance and applies the policy uniformly.
- Denials Without an Opportunity for Review. TUSDM may deny the individual’s request for access without providing the individual an opportunity for review of the decision in the following circumstances:
- the PHI was compiled by TUSDM in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding;
- the PHI is contained in psychotherapy notes;
- if applicable, the Clinical Laboratory Improvement Amendments prohibit TUSDM from giving patients access to the particular PHI;
- if applicable, the PHI is held by a TUSDM facility that only performs testing for forensic purposes, a TUSDM research laboratory that does not report patient-specific results for the diagnosis, treatment or assessment of individual patients, or a TUSDM laboratory certified by the National Institutes on Drug Abuse;
- the PHI was obtained by TUSDM in the course of research that includes treatment of the research participants, while such research is in progress, and the individual previously agreed to this temporary suspension;
- the PHI is contained in records that are subject to the federal Privacy Act, and the individual could be denied access to the records under the Privacy Act; or
- the PHI was obtained from someone other than a healthcare provider under a promise of confidentiality and the access requested would be reasonably likely to reveal the source of the information.
- Denials with an Opportunity for Review. With respect to records of healthcare treatment, TUSDM may deny the patient access, so long as the patient is given a right to have the denial reviewed, in the following circumstances:
- a licensed healthcare professional has determined, in the exercise of professional judgment, that the access requested is reasonably likely to endanger the life or physical safety of the patient or another person;
- the PHI makes reference to another person (other than a healthcare provider) and a licensed healthcare professional has determined, in the exercise of professional judgment, that the access requested is reasonably likely to cause substantial harm to such other person; or
- the request for access is made by the patient’s personal representative and a licensed healthcare professional has determined, in the exercise of professional judgment, that the provision of access to the personal representative is reasonably likely to cause substantial harm to the patient or another person.
- Right to Review of Denial. If TUSDM denies the patient access to his or her PHI for one of the reasons described above, the patient has the right to have the denial reviewed by a licensed healthcare professional who is designated by TUSDM to act as a reviewing official and who did not participate in the original decision to deny access. TUSDM must provide or deny access in accordance with the determination of the reviewing official.
- Verification. Prior to disclosing PHI to a person unknown to TUSDM, TUSDM must verify the identity of the person requesting the PHI and the authority of the person to have access to the PHI requested. In addition, TUSDM must obtain any documentation, statements, or representations, oral or written, from the requestor when such information is a condition of the disclosure.
- RESPONDING TO A REQUEST FOR ACCESS.
- Consideration of Access Requests. All requests for access should be forwarded to the Security & Privacy Officer for consideration. Only the Security & Privacy Officer has the authority to agree to or deny requests for access on behalf of TUSDM. Once a decision is made, appropriate information will be forwarded to the relevant TUSDM employees for implementation of the request for access and/or notification of the patient.
- Access to PHI Created or Obtained Prior to the Compliance Date. Information created prior to the compliance date of the Privacy Regulation must be accessible to the individual. However, since TUSDM is not required to maintain PHI in accordance with the Privacy Regulation until the compliance date of April 14, 2003, TUSDM is not required to recreate any PHI that is destroyed prior to that date. Thus, if an individual requests access to PHI created prior to the compliance date, TUSDM must provide access if it still maintains the information, but if TUSDM no longer maintains the information, it is not required to recreate it in order to grant the individual’s request.
- Acting on the Request. TUSDM must act on a request for access within 30 days of the date TUSDM received the request.
- If TUSDM grants the individual’s request for access, in whole or in part, it must inform the individual that the request has been granted and provide access to the PHI.
- If TUSDM denies the individual’s request for access, in whole or in part, it must provide the individual with a written denial.
- If TUSDM cannot act on a request within the applicable deadline, it may extend the deadline by no more than 30 days by providing the individual with a written statement of the reasons for the delay and the date by which TUSDM will complete its action on the request. TUSDM must provide the written statement within the original time period and may only extend the time period once.
- Provision of Access. If TUSDM grants a request for access, it must comply with the following requirements.
- TUSDM must notify the individual and provide the access as requested, including inspection or obtaining a copy, or both, of the PHI. If the same PHI that is the subject of the individual’s request is maintained in more than one record or at more than one location (including by a business associate), TUSDM is only required to produce the PHI once in response to the request for access.
- TUSDM must provide the individual with access to the PHI in the form or format requested by the individual, if it is readily producible in this form or format; or if not, in a readable hard copy form or other form that is agreed upon by TUSDM and the individual. For example, if TUSDM maintains PHI electronically and the individual requests an electronic copy, TUSDM must accommodate this request if the PHI is readily producible in this format or, alternatively, must provide the PHI in another electronic format as agreed upon between the TUSDM and the individual.
- If the individual requests or agrees at TUSDM’s suggestion, including agreeing to any fees, TUSDM may provide the individual with a summary and/or explanation of the PHI requested instead of providing access to the actual PHI. However, an individual retains the right of access to the underlying information even if he or she requests access to, or production of, a summary or explanation.
- TUSDM must provide access in a timely manner, including arranging with the patient for a convenient time and place to inspect or obtain a copy of the PHI, or mailing the copy of the PHI at the individual’s request. TUSDM may discuss the scope, format, and other aspects of the request for access with the individual as necessary to timely provide access.
- If the individual requests a copy of the PHI or agrees to a summary or explanation, TUSDM may charge a reasonable, cost-based fee, provided that the fee includes only the cost of copying, postage, and preparing an explanation or summary of the PHI (if a summary is requested by the patient).
- TUSDM may charge a reasonable fee for labor and supplies (such as portable media) for sending an electronic copy of the PHI.
- An individual may request, in writing, that TUSDM transmit the PHI to another person designated by the individual and TUSDM must comply with this request.
- Denial of Access. If TUSDM denies access to PHI, it must:
- to the extent possible, give the individual access to any other PHI requested, after excluding the PHI as to which TUSDM has grounds to deny access;
- provide a timely, written denial to the individual. The denial must be in plain language and contain (a) the basis for the denial; (b) if applicable, a statement of the patient’s right to review of the decision, including a description of how the individual can exercise these review rights; and (c) a description of how the individual may complain to TUSDM or the Secretary of Health and Human Services, including the name or title and telephone number of the contact person or designated office;
- inform the individual where to direct the request for access, if TUSDM does not maintain the PHI that is the subject of the individual’s request for access, and TUSDM knows where the requested information is maintained; and
- if the patient has requested a review of a denial, TUSDM must designate a licensed healthcare professional who was not directly involved in the denial to review the decision to deny access. TUSDM must promptly refer the review request to the reviewing official. The reviewing official must determine, within a reasonable period of time, whether or not to deny access. TUSDM must promptly provide written notice to the patient of the reviewing official’s decision and carry out the decision accordingly.
- DOCUMENTATION AND RECORDS RETENTION REQUIREMENTS.
- TUSDM must document the records that are subject to access by individuals and the titles of the persons or offices responsible for receiving and processing requests for access. TUSDM must retain this documentation for six years from the date of its creation or the date when it was last in effect, whichever is later. TUSDM must document any requests for access it receives and the resolution of such requests and retain this documentation for six years from the date of its creation or the date when it was last in effect, whichever is later.
V. Policy Compliance Monitoring and Enforcement:
- The TUSDM Security & Privacy Officer is responsible for the monitoring and enforcement of this policy; however, directors and managers are also responsible for monitoring compliance with procedures specific to their areas.
VI. Potential Disciplinary Actions and Sanctions:
- Failure to follow standard operating procedures may trigger review for potential disciplinary action under the Sanctions for HIPAA and MGL Violations Policy for TUSDM.
VIII. Approval and Review Cycle:
- This policy shall be subject to annual review, revision, and approval by the TUSDM Compliance Committee.