HIPAA provides patients with several rights, all described in our Notice of Privacy Practices. The Health Information Management Department and Health Information Release Services Department both work with our HIPAA Privacy Office, clinical departments, and physicians to facilitate requests related to patient rights under HIPAA. Patients have the right to:

Ask to see and/or get a copy of their health records or other PHI
  • HPP-0002 Access by Individuals to Protected Health Information

An individual has the right to request access to their PHI that is maintained in a Designated Record Set. Such right of access may be for inspection in person or to obtain a copy.

Access may be provided electronically through the ‘Patient Portal’.

Individuals may also request access through our Health Information Release Services Department (HIRS). To obtain a copy, the Individual may be asked to complete the Request for Access to Protected Health Information by Individual Patients form.

Ask for a report on when and why their PHI was disclosed for certain purposes
  • HPP-0003 Accounting for Disclosures of Protected Health Information

An individual has the right to request an Accounting of certain types of Disclosures made of their PHI including Uses or Disclosures by or to our Business Associates. This does not include Uses or Disclosures for the purpose of Treatment, Payment, or Health Care Operations or Disclosures made pursuant to an Authorization.

Business Units/Departments are responsible for reporting Disclosures to the HIPAA Privacy Office using the Accounting of Disclosure of Protected Health Information Electronic Log.

Individuals may request an Accounting of Disclosure from the HIPAA Privacy Office by completing the Request for Accounting of Disclosures of Protected Health Information form.

Ask to have corrections added to their PHI
  • HPP-0004 Amendment of Protected Health Information

An individual has the right to request an Amendment of their PHI maintained in our Designated Record Set.

Individuals may request an Amendment through our Health Information Management Department (HIM). Individuals will be asked to complete the Request for Amendment of Protected Health Information form.

Ask for appropriate and confidential communication of their PHI
  • HPP-0007 Appropriate Methods of Communicating Protected Health Information

Washington University Workforce Members who communicate PHI are responsible for ensuring that the communication is appropriate and reasonably designed to protect the PHI to the greatest extent possible without interfering with the intended purpose of the communication. Individuals may complete the Washington University Patient Communication Form to designate options for providing communication of PHI.

Receive a notice that tells them how their PHI may be used or disclosed
  • HPP-0012 Notice of Privacy Practices

Individuals have the right to receive a Notice that contains information concerning the Uses and Disclosures of PHI. The Notice also informs the Individual of their rights with respect to their PHI, WU’s duties, how to contact WU, and how the individual may make a complaint.

The Notice of Privacy Practices should be prominently displayed for all Individuals to see and read. Individuals should be provided a copy upon request. The Notice of Privacy Practices is available on the Washington University Physicians Web site in electronic format and also available in other languages.

Ask for restrictions of certain uses and disclosures of their PHI
  • HPP-0016 Restrictions on Use or Disclosure of Protected Health Information

Individuals have the right to request restrictions on the Use or Disclosure of their PHI for purposes of Treatment, Payment, or Health Care Operations, on Disclosures made to persons involved in the Individual’s care, or on prior authorized research data. WU is required to receive the request but is not required to agree to any requested restriction(s) from an Individual. Individuals must complete and submit the Request for Restrictions on Use or Disclosure of Protected Health Information form to the HIPAA Privacy Office for review.

Ask for restrictions on disclosure of their PHI to their health plan for a service that they pay for in full out of pocket
  • HPP-0016 Restrictions on Use or Disclosure of Protected Health Information

Individuals may request that their Protected Health Information not be Disclosed to their health plan or health insurance provider if, the Disclosure is not required by law and the Individual or someone on their behalf, pays in full for the service or health item out-of-pocket at the time of service. Individuals must complete and submit the Request for Restrictions on Use or Disclosure of Protected Health Information to a Health Plan for Services Paid in Full Out of Pocket form prior to health services being rendered.

WU must agree with the request if the Disclosure is not required by law and the health information pertains solely to a health item or service for which the Individual (or someone on their behalf) has paid WU in full at the time the service was provided.

Ask for an alternate means or location to receive confidential communications
  • HPP-0016 Restrictions on Use or Disclosure of Protected Health Information

Individuals may request for alternative means or alternate locations to receive confidential communication(s) of their Protected Health Information. WU will accept for review and accommodate reasonable written requests from Individuals. WU may condition accommodating a request on its receipt of information as to how the Individual will handle Payment if any, and specification of an alternate address or other methods of contact. Individuals must complete and submit the Request for Alternate Method of Confidential Communications form to the HIPAA Privacy Office for review.

Receive notification of a breach of their PHI
  • HPP-0022 Breach Notification Policy

Affected Individuals will be notified of a Breach by the HIPAA Privacy Office. The HIPAA Privacy Office will keep an electronic log detailing any Breach to be submitted to HHS annually.

Business Associates also must communicate any Breach of PHI to Washington University and may be required to perform notification to affected Individual(s).

File a complaint

If an Individual believes their privacy rights are being denied or that their health information is not being protected, they may file a complaint with the WU HIPAA Privacy Officer.

They may also file a complaint with the Secretary of the Department of Health and Human Services (HHS), Office for Civil rights.