TUSDM Policy on an Individual’s Right to Amendment

I. Purpose and Scope:

The purpose of this policy is to establish a process for responding to requests by individuals to amend PHI concerning their records maintained by Tufts University School of Dental Medicine (TUSDM).
This policy applies to TUSDM Workforce Members, including faculty, residents, students, staff, trainees, volunteers, and other persons as defined below.

II. Policy Statement:

It is TUSDM’s policy to respond in a prompt and courteous manner to an individual’s request for an amendment to his or her PHI held by TUSDM (and/or our business associates) in compliance with the Privacy Regulations.

III. Definitions:

Protected Health Information

IV. General Rules:

RIGHT TO AMENDMENT OF PROTECTED HEALTH INFORMATION.
1. Individual’s Right to Amendment. An individual has the right to request to have TUSDM amend PHI or a record about him or her contained in a designated record set for as long as the PHI is maintained by TUSDM in the designated record set.
2. Designated Record Set. TUSDM is not required to amend all types of information that it holds. Instead, TUSDM must allow the individual to request amendment of information maintained in a “designated record set” for as long as TUSDM keeps the records. The designated record set includes medical records, billing records, and any other records used by or for TUSDM to make decisions about patients. The TUSDM Security & Privacy Officer is responsible for identifying and documenting the patient records that make up the “designated record set.”
RESPONDING TO AMENDMENT REQUESTS.
1. Consideration of Amendment Requests. All requests for amendment should be forwarded to the TUSDM Security and Privacy Officer for consideration. Only the Security and Privacy Officer has the authority to agree to or deny requests for amendment on behalf of TUSDM. Once a decision is made, appropriate information will be forwarded to the relevant TUSDM employees for implementation of the amendment and/or notification of the individual.
2. Time Period for Acting on Requests. TUSDM must act on the individual’s request for an amendment within 60 days of receipt of the request. If TUSDM is unable to act on the amendment within 60 days, however, TUSDM may extend the time period for one 30-day period, so long as, within the original 60-day time limit, TUSDM provides the individual with a written statement of the reason for the delay and the date by which TUSDM will complete its action on the request.
3. Accepting a Patient’s Request for Amendment. If TUSDM has no grounds to deny the patient’s request for amendment TUSDM must:
  1. make the appropriate amendment to the individual’s PHI or record. TUSDM should, at a minimum, identify the records that are affected by the amendment and append or otherwise provide a link to the location of the amendment;
  2. inform the individual on a timely basis that the amendment is accepted and obtain the patient’s identification of an agreement to have TUSDM notify the relevant persons with whom the amendment needs to be shared; and
  3. make reasonable efforts to inform and provide the amendment within a reasonable time to:
    1. persons identified by the individual as having received PHI and needing the amendment; and
    2. persons, including business associates, that TUSDM knows have the unamended information and may have relied, or might rely in the future, on the information to the detriment of the individual.
4. Denying an Individual’s Request for Amendment. Under certain circumstances, TUSDM may deny the individual’s request for amendment to his or her PHI held by TUSDM.
  1. Permissible Reasons for Denial. TUSDM may deny a request for an amendment for the following reasons only:
    1. the PHI was not created by TUSDM (e.g., records received from other health care providers), unless the individual provides a reasonable basis to believe that the originator of the PHI is no longer available to act on the requested amendment;
    2. the PHI is not part of the patient’s designated record set;
    3. the PHI would not be available for inspection under TUSDM’s HIPAA Individuals’ Right to Access Policy; or
    4. the PHI is accurate and complete.
  2. Denial Procedures. If TUSDM denies the requested amendment, in whole or in part, TUSDM must take the following steps.
    1. TUSDM must provide the individual with a valid, written denial that includes:
      1. the basis for the denial;
      2. how the individual may file a written statement disagreeing with the denial and any limitations on the length of the statement;
      3. the individual’s options with respect to future disclosures of the disputed information; and
      4. how the individual may make a complaint to TUSDM or HHS, including specific contact information.
    2. TUSDM must permit the patient to submit to TUSDM a written statement disagreeing with the denial and the basis for the disagreement; however, TUSDM is permitted to reasonably limit the length of the statement.
      1. TUSDM may prepare a written rebuttal to the individual’s statement of disagreement.
      2. If TUSDM prepares a rebuttal, it must provide a copy to the individual.
    3. TUSDM must identify, as appropriate, the information in the individual’s designated record set that is the subject of the disputed amendment and append or otherwise link to this information the individual’s request for an amendment, TUSDM’s denial of the request, the individual’s statement of disagreement, if any, and TUSDM’s rebuttal, if any.
    4. TUSDM must adhere to the following guidelines if it makes future disclosures of the individual’s disputed PHI:
      1. if the individual has submitted a statement of disagreement, TUSDM must include either the material appended to the designated record set, or an accurate summary of it, with any subsequent disclosure of the PHI to which the disagreement relates; or
      2. if the individual has not submitted a written statement of disagreement, TUSDM must include the appended information with any subsequent disclosure only if the individual has requested that TUSDM do so.
5. Receiving a Notice of Amendment from Other Healthcare Providers or Health Plans. Other healthcare providers or health plans may contact TUSDM to let it know that they have made amendments to the individual’s PHI. When TUSDM is informed by another healthcare provider or health plan of an amendment to an individual’s PHI, TUSDM must make the necessary amendments to the PHI in its records.
DOCUMENTATION AND RECORDS RETENTION REQUIREMENTS.
1. TUSDM must document the titles of the persons or offices responsible for receiving and processing requests for amendments by individuals and retain this documentation for six years from the date of its creation or the date when it was last in effect, whichever is later. TUSDM must document any requests for amendment it receives and the resolution of such requests and retain this documentation for six years from the date of its creation or the date when it was last in effect, whichever is later.

V. Policy Compliance Monitoring and Enforcement:

The TUSDM Security and Privacy Officer is responsible for the monitoring and enforcement of this policy. However, directors and managers are also responsible for monitoring compliance with procedures specific to their areas.

VI. Potential Disciplinary Actions and Sanctions:

Failure to follow standard operating procedures may trigger review for potential disciplinary action under the Sanctions for HIPAA and MGL Violations Policy for TUSDM.

VIII. Approval and Review Cycle:

This policy shall be subject to annual review, revision, and approval by the TUSDM Compliance Committee