Access by Individuals to
Protected Health Information

Statement of Policy

Washington University and its member organizations (collectively, “Washington University” or “WU”) are committed to conducting business in compliance with all applicable laws, regulations and WU policies. As part of this commitment, WU has adopted a policy to allow Individuals to access Protected Health Information (PHI).

Scope of Policy

The scope of this Policy covers an Individual’s right to access that portion of the Individual's PHI that is contained in a Designated Record Set (as defined herein) for inspection or to obtain a copy. WU is required to provide this access. This right of access by an Individual to that Individual's PHI contained in a Designated Record Set, and the exceptions to it, are outlined in this Policy.

Policy

1) The Right of Access.

a) An Individual has the right to request access to his or her PHI that is maintained in a Designated Record Set. Such right of access may be for inspection or to obtain a copy.

b) In general, a Designated Record Set should contain the following information from the medical and billing records, if any:

Medical Record:
i) Face Sheet (Admission Information, Registration, Insurance)
ii) Physician Orders
iii) Vital Sign Work Sheet
iv) Admission, Progress and Discharge Notes
v) History and Physical
vi) Nurses Notes and Other Ancillary Provider Notes
vii) Radiology Reports
viii) Pathology, Laboratory and other Ancillary Reports
ix) Operative Reports
x) Discharge Summary
xi) Consultation Reports or Notes
xii) Treatment Record such as problem lists, medication lists, plan of care

Billing Record:
xiii) Patient Name, Address
xiv) Plan (Insurer) Name, Patient ID Number
xv) Provider Name, Address, Tax ID
xvi) Ordering/Referring Physician Name
xvii) Charge, Allowable, Paid by Plan, Paid by Patient, Paid by Other Source
xviii) Contract Amount/Write Off/Disallowed/Denied Amount
xix) Diagnosis Codes
xx) Procedure Codes and Modifiers
xxi) Units of Service
xxii) Dates of Service

A Designated Record Set for a Health Plan should include the enrollment, Payment, claims adjudication and case or medical management record systems maintained by or for the Health Plan.

2) Exclusions.

Individuals may NOT access PHI maintained outside the Designated Record Set and the following types of PHI:

• Psychotherapy Notes


Information compiled in reasonable anticipation of civil, criminal, or administrative action or other proceeding

• PHI maintained for compliance with Clinical Laboratory Improvement Amendments (CLIA) and which is prohibited from access or is exempt from Disclosure under CLIA


• PHI created or obtained by a Health Care Provider in the course of Research that includes treatment where the Individual consented to the denial of access when he or she consented to participate in the research and WU informed the Individual that access would be restored upon completion of the research.

3) Procedure for Processing Requests for Access.

a) HIPAA Privacy Liaison. Each Business Unit within WU will identify the title(s) of the person(s) who will receive requests for access from Individuals and who will be authorized to Disclose PHI pursuant to such requests.

b) Request Form. WU will inform Individuals that all requests for access must be submitted in writing. See Form, Exhibit A.

c) Response Time Frames and Extension. WU will take action on a request for access by granting or denying the requested access no later than 30 days after receipt of the request. If the requested PHI is maintained off-site in storage or is not accessible on-site, WU will have 60 days after receipt of the request to act on it. WU may obtain a one-time extension of no more than 30 days. To obtain the extension, WU will contact the requesting Individual within 30 days (or 60 days for off-site storage) after the date of the request and provide the Individual with a written statement containing the reasons for the delay in responding and the date by which WU will complete its action on the request. See Form, Exhibit B.

d) Reviewing Requests. The HIPAA Privacy Liaison for the WU Business Unit that receives an Individual’s written request for access will review such request and determine whether the request will be granted or denied in accordance with this Policy.

e) Designation of Reviewing Official. WU will designate a licensed health care professional who shall serve as the reviewing official for denials of access. Such designated licensed health care professional may not participate in the initial review and decision to either grant or deny access.

f) Current Care Requests. If an Individual is requesting access to his or her PHI while receiving Treatment from a provider within a WU Business Unit, the Individual must make such request in writing and submit the request to the applicable business unit’s HIPAA Privacy Liaison. The Business Unit’s HIPAA Privacy Liaison will facilitate the Individual’s access. Immediate inspection and copying of the PHI is not required under this Policy.

a) If the request for access is granted, WU will provide the requesting Individual access through inspection, copying or both, and will provide the information in the form requested if readily producible in such form, and if not, then in hard copy.

b) If the requested PHI is maintained in more than one Designated Record Set or at more than one location, WU shall produce the requested PHI once in response to the request.

c) WU may provide a summary or an explanation of the PHI in lieu of providing a copy of the PHI if it first obtains the Individual’s consent to receive such summary or explanation and the Individual’s agreement to pay for any fees related to the summary. Summaries or explanations of PHI should be prepared by the involved health care professional or other designated health care professional. WU’s fees related to the summary shall not be greater than that provided under state law.

d) WU may request payment of a reasonable, cost-based fee incident to the copying of PHI that includes only the cost of copying, including labor and supply costs, and postage.

5) Denial of Access.

a) Process for Denying Access.
The WU Business Unit will review the request and determine whether a ground for denial exists and, if so, whether the Individual is entitled to an appeal of the denial. The WU Business Unit will inform the Privacy Office of any intention to deny access. If appeal of the decision to deny access is anticipated, WU Privacy Office may contact the attending physician for his or her guidance with regard to the request for access and the intended denial.

b) Denials of Access that may be Appealed.

If a request for access is denied for any of the following reasons, the denial may be appealed.

i) a licensed health care professional has determined that the access requested is reasonably likely to endanger the life or physical safety of the Individual or another person;
ii) the PHI contains references to another person (excluding other licensed health care providers) and a licensed health care professional has determined that the access requested is reasonably likely to cause substantial harm to such other person; or
iii) the request is made by the Individual’s personal representative (including a minor’s) and a licensed health care professional has determined that the access by the personal representative is reasonably likely to cause substantial harm to the Individual or another person.

c) Denials of Access that may Not be Appealed.

i) information requested is Psychotherapy Notes;
ii) information requested is compiled in reasonable anticipation of litigation;
iii) information requested is maintained for compliance with CLIA and prohibited from access or is exempt from disclosure under CLIA;
iv) request is from an inmate because WU is rendering services under the direction of the correctional facility and the PHI would jeopardize the health or safety of the Individual or of other inmates or any others having contact with the inmate;
v) the information requested has been created or obtained by a Health Care Provider in the course of Research that includes treatment where the Individual consented to the denial of access when he or she consented to participate in the research and WU informed the Individual that access would be restored upon completion of the research;
vi) the information requested is contained in records subject to the Privacy Act where access could be denied under the Privacy Act;
vii) the information requested has been obtained from someone other than a Health Care Provider under a promise of confidentiality and the access would be reasonably likely to reveal the source of the information.

d) Communication of Denials.

Regardless of whether a denial for access is appealable or not appealable, WU will provide the following to the Individual:


i) to the extent possible, access to non-excluded PHI;
ii) written notice of denial (See Form, Exhibit C ) stating, in plain language,
• the ground(s) for the denial;
• the appeal rights, if any, available to the Individual including a description of how the Individual may initiate an appeal; and
• a description of the complaint process that an Individual may follow with WU concerning his or her privacy, including the name or title and telephone number of the contact person at WU responsible for receiving complaints of privacy concerns, or with the Secretary; and
iii) the location of the PHI if WU does not maintain the requested PHI.

e) Process to Review of Appealed Denials.

An appeal of a denial shall be made by the Individual in writing and shall include the reason for the appeal. If an Individual whose request for access is denied and there are grounds for an appeal of the denial decision, WU will promptly refer the request for review of the appeal to the designated licensed health care professional. The designated licensed health care professional must determine, within a reasonable period of time and based upon criteria allowing such an appeal, whether to uphold or reverse the original decision to deny the access. The WU Business Unit will be bound by the determination of the designated licensed health care professional and will promptly provide written notice of the designated licensed health care professional determination to the Individual and to the WU Privacy Office and take the appropriate action, if any.

Creation Date: November 22, 2002
Effective Date: April 14, 2003
Last Revision Date: February 21, 2003


EXHIBIT A


REQUEST FOR ACCESS TO HEALTH INFORMATION

Individual (Patient) Name: ____________________________________________________________

Date of Birth:___________________________________ SSN:______________________________

Address: ________________________________________________________________________

Telephone Number: (H)(____)______________ (W) (____ )________________

Medical Record No.: ____________________________________

Would you like your records to be mailed: Yes__ No__

To the above address : Yes__ No__

To another address (please indicate): _______________________________________

                                                         ________________________________________

_____________________________________          ______________
Signature of Individual or Personal Representative                Date

Processing Your Requested Information:
Washington University may charge a fee for the copying of requested Protected Health Information (PHI). This fee will be based on the cost of the labor and supplies involved in copying the requested PHI, the postage for mailing the copies to you, and a retrieval fee to obtain the requested PHI. In addition, if you request a summary of the requested PHI in lieu of or in addition to the copies, Washington University may charge you a reasonable cost for the preparation of a summary. Washington University will, however, inform you of the cost of preparing a summary in advance of its preparation. If you do not want the requested records mailed, you may pickup your records after thirty (30) days, unless Washington University has notified you that an extension of time is required.

Washington University will respond to your request for PHI within 30 days of our receipt of your request. If, however, your health information is not readily accessible by Washington University or is maintained in an off-site storage location, Washington University has 60 days to respond to your request. If it requires additional time to respond to your request, Washington University will contact you to inform you of this extension of time.

__________________________________________________________________________________

Washington University Use Only:
Date Received: ________________________
Date Access Granted: __________________________
Date Access Denied:___________________________ (Must Complete Denial of Access Form)

EXHIBIT B

EXTENSION OF TIME NOTICE
Response to Request for Access to Health Information

[Date]

To: [Individual]

We have received your request for access to your Designated Record Set held by Washington University. We are responding to your request within [30 days for On-Site Storage or 60 days for Off-Site storage] to advise you that we will need an additional 30 days to review and respond to your request. This extension of time is necessary to better ensure that your request is appropriately addressed and responded to. We appreciate your patience in this matter and will provide you with a response to your request for access no later than [Date that is not greater than 60 days from the receipt date for On-Site storage or 90 days for Off-Site Storage].

If you have questions concerning your request, please contact [name or title of person] at Washington University.

Sincerely,

EXHIBIT C

DENIAL OF REQUEST FOR ACCESS TO HEALTH INFORMATION

BY US MAIL

[Date]
[Individual]
[Address]

Re: Request for Access to Designated Record Set dated ______________________________

Dear [Individual]:

In response to your recent request for access to certain health information, we are advising you within [30 days for On-Site Storage or 60 days for Off-Site Storage, unless a 30 days extension had already been obtained] of our denial of your request. We will, to the extent possible, provide you with any requested information that is not otherwise excluded consistent with federal regulations.

We are denying your request for access for the following reason(s):

• Washington University does not maintain the requested information.
• Requested information is located:
_______________________________________

• Location of requested information is unknown.

Reason for Denial: Denial may not be appealed.

• The requested information is not a part of the Designated Record Set and is not available for access;
  
• The requested information is prohibited from disclosure under federal laboratory regulations;
  
• The information is being requested by an Inmate and access to such information would jeopardize the health or safety of the inmate or others;
  
• The requested information is part of a research study that required the participating patient’s consent to non-disclosure until after the conclusion of such research;
  
• The requested information is contained in records subject to the Privacy Act;
  
• The requested information contains confidential sources from non-Health Care Providers; or
  
• The requested information is considered psychotherapy notes.
  

Reason for Denial: Denial may be appealed.

• The requested information is reasonably likely to endanger the life or safety of the patient or another;
  
• The requested information contains references to other person(s) (non-health-care providers) and access to such information may cause substantial harm to such person(s); or
  
• The request is made by the Individual’s personal representative and access to the information by the personal representative is reasonably likely to cause substantial harm to the Individual or another person.
  
• If we have indicated that a reason for the denial of your request for access is subject to an appeal, you may have the decision to deny access reviewed by returning this Notice to Washington University stating your request for such an appeal. Washington University will forward your request to a licensed health care professional who will review the circumstances of the denial of your request for access. Washington University will abide by the conclusions made by the designated health care professional and will promptly provide you with written notice of his or her determinations and take the appropriate action, if any, indicated by those results.
  
• You may contact either the Privacy Officer at Washington University or the Secretary of Health and Human Services with any concerns that you may have regarding access to your records. The Privacy Officer may be reached at telephone number (314) 747-4975 or (866) 747-4975 Toll Free.
  

Sincerely,
______________

______________