hipaa
My rights as a Patient
<p>Hello:  I have never had an issue with obtaining any test result from any lab or imaging facility until now.  My doctor ordered x-rays to be taken in his office on 1/24/19.  The only appointment available to speak with him about the results isn't until 4/3/19.  I went to his office and spoke to the office manager about getting a copy of my test results and she denied me a copy.  I had my ID in my hand and I said that I have never been denied a copy of ANY test results and I shouldn't have to wait until April to get them.  She replied that it is office policy and that the only way a patient will have access to their results is when they see the doctor.  I was furious!!  I called my insurance company and I informed them of this and they called the doctor's office and was told the same thing.  My insurance company said that unfortunately they don't get involve with the policies or rules set by doctors' offices.  Is this legal?  And what can I do about it without starting another fight "in person" at the doctor's office? Thank you!</p>

<h2><strong>This is not Legal</strong></h2>
<p>Under HIPAA, a patient has a right to prompt access to all PHI, including medical records, maintained by a provider, with some very limited exceptions, none of which seem to apply based on the statements in the question. Access must be provided within 30 days at most, and the provider is encouraged to provide it as quickly as possible. If the provider denies such a request, they must do so in writing within 30 days.</p>
<p>The provider can require that the request be in writing. The provider can charge a reasonable fee for the actual costs of providing access. The provider can require the patient to verify his or her identity. The provider cannot require that the patient (or the patient's representative) appear in person to make the request.</p>
<p>HHS's Office of Civil Rights (OCR) will accept complaints and enforce these rights.</p>
<p>According to <a href="https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html" rel="nofollow noreferrer">Individuals’ Right under HIPAA to Access their Health Information 45 CFR § 164.524</a>:</p>
<blockquote>
<p>The Privacy Rule generally requires HIPAA covered entities (health plans and most health care providers) to provide individuals, upon request, with access to the protected health information (PHI) about them in one or more “designated record sets” maintained by or for the covered entity. This includes the right to inspect or obtain a copy, or both, of the PHI, as well as to direct the covered entity to transmit a copy to a designated person or entity of the individual’s choice.</p>
</blockquote>
<p>...</p>
<blockquote>
<p>Individuals have a right to access PHI in a “designated record set.” A “designated record set” is defined at 45 CFR 164.501 as a group of records maintained by or for a covered entity that comprises the:</p>
<ul>
<li>Medical records and billing records about individuals maintained by or for a covered health care provider;</li>
</ul>
</blockquote>
<p>...</p>
<blockquote>
<p>Thus, individuals have a right to a broad array of health information about themselves maintained by or for covered entities, including: medical records; billing and payment records; insurance information; clinical laboratory test results; medical images, such as X-rays; wellness and disease management program files; and clinical case notes; among other information used to make decisions about individuals. In responding to a request for access, a covered entity is not, however, required to create new information, such as explanatory materials or analyses, that does not already exist in the designated record set.</p>
</blockquote>
<p>...</p>
<blockquote>
<p>An individual’s personal representative (generally, a person with authority under State law to make health care decisions for the individual) also has the right to access PHI about the individual in a designated record set (as well as to direct the covered entity to transmit a copy of the PHI to a designated person or entity of the individual’s choice), upon request, consistent with the scope of such representation and the requirements discussed below. See 45 CFR 164.502(g) and <a href="http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/personalreps.html" rel="nofollow noreferrer">http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/personalreps.html</a> for more information about the rights that can be exercised by personal representatives.</p>
</blockquote>
<p>...</p>
<blockquote>
<p>A covered entity may require individuals to request access in writing, provided the covered entity informs individuals of this requirement.  See 45 CFR 164.524(b)(1).    Covered entities also may offer individuals the option of using electronic means (e.g., e-mail, secure web portal) to make requests for access.  In addition, a covered entity may require individuals to use the entity’s own supplied form, provided use of the form does not create a barrier to or unreasonably delay the individual from obtaining access to his PHI ...</p>
</blockquote>
<p>...</p>
<blockquote>
<p>The Privacy Rule requires a covered entity to take reasonable steps to verify the identity of an individual making a request for access.  See 45 CFR 164.514(h).  The Rule does not mandate any particular form of verification (such as obtaining a copy of a driver’s license), but rather generally leaves the type and manner of the verification to the discretion and professional judgment of the covered entity, provided the verification processes and measures do not create barriers to or unreasonably delay the individual from obtaining access to her PHI ...</p>
<p>... a covered entity may not impose unreasonable measures on an individual requesting access that serve as barriers to or unreasonably delay the individual from obtaining access. ...</p>
</blockquote>
<p>...</p>
<blockquote>
<p>The Privacy Rule requires a covered entity to provide the individual with access to the PHI in the form and format requested, if readily producible in that form and format, or if not, in a readable hard copy form or other form and format as agreed to by the covered entity and individual.  See 45 CFR 164.524(c)(2)(i). If the individual requests electronic access to PHI that the covered entity maintains electronically, the covered entity must provide the individual with access to the information in the requested electronic form and format, if it is readily producible in that form and format, or if not, in an agreed upon alternative, readable electronic format. See 45 CFR 164.524(c)(2)(ii).</p>
</blockquote>
<p>...</p>
<blockquote>
<p>A covered entity also must provide access in the manner requested by the individual, which includes arranging with the individual for a convenient time and place to pick up a copy of the PHI or to inspect the PHI (if that is the manner of access requested by the individual), or to have a copy of the PHI mailed or e-mailed, or otherwise transferred or transmitted to the individual to the extent the copy would be readily producible in such a manner. ... . However, mail and e-mail are generally considered readily producible by all covered entities. It is expected that all covered entities have the capability to transmit PHI by mail or e-mail (except in the limited case where e-mail cannot accommodate the file size of requested images), and transmitting PHI in such a manner does not present unacceptable security risks to the systems of covered entities, even though there may be security risks to the PHI while in transit (such as where an individual has requested to receive her PHI by, and accepted the risks associated with, unencrypted e-mail). Thus, a covered entity may not require that an individual travel to the covered entity’s physical location to pick up a copy of her PHI if the individual requests that the copy be mailed or e-mailed.</p>
</blockquote>
<p>...</p>
<blockquote>
<p>In providing access to the individual, a covered entity must provide access to the PHI requested, in whole, or in part (if certain access may be denied as explained below), no later than 30 calendar days from receiving the individual’s request. See 45 CFR 164.524(b)(2). The 30 calendar days is an outer limit and covered entities are encouraged to respond as soon as possible.</p>
</blockquote>
<p>...</p>
<blockquote>
<p>The Privacy Rule permits a covered entity to impose a reasonable, cost-based fee if the individual requests a copy of the PHI (or agrees to receive a summary or explanation of the information).</p>
</blockquote>
<p>...</p>
<blockquote>
<p>If the covered entity denies access, in whole or in part, to PHI requested by the individual, the covered entity must provide a denial in writing to the individual no later than within 30 calendar days of the request (or no later than within 60 calendar days if the covered entity notified the individual of an extension). See 45 CFR 164.524(b)(2). The denial must be in plain language and describe the basis for denial; if applicable, the individual’s right to have the decision reviewed and how to request such a review; and how the individual may submit a complaint to the covered entity or the HHS Office for Civil Rights. See 45 CFR 164.524(d).</p>
</blockquote>
<p>In short, a US patient has a legal right to prompt access to information in his or her medical record, and may not be required to wait until an appointment with a doctor. Penalties for violating these regulations may be severe. &quot;Office policy&quot; is not a valid reason for denying such a request.</p>
<p>According to HHS's web page &quot;<a href="https://www.hhs.gov/hipaa/filing-a-complaint/index.html" rel="nofollow noreferrer">Filing a Complaint</a>&quot;</p>
<blockquote>
<p>If you believe that a HIPAA-covered entity or its business associate violated your (or someone else’s) health information privacy rights or committed another violation of the Privacy, Security, or Breach Notification Rules, you may file a complaint with the Office for Civil Rights (OCR). OCR can investigate complaints against covered entities (health plans, health care clearinghouses, or health care providers that conduct certain transactions electronically) and their business associates.</p>
</blockquote>
<p>That site provides online forms with which to file such a complaint, and a detailed description of the complaint process and th4 information required in a complaint.</p>
<p>This answer is based on the patient and provider being in the US, as indicated by the &quot;hipaa&quot; tag.</p>
