Accessing, Inspecting and Obtaining a Copy of Protected Health Information (PHI)

Title

Accessing, Inspecting and Obtaining a Copy of Protected Health Information (PHI)

Policy

Pursuant to the Health Insurance Portability and Accountability Act of 1996, as modified by the Health Information Technology for Economic and Clinical Health Act of 2009 ("HIPAA"), individuals have the right to access, inspect, and obtain a copy of their Protected Health Information ("PHI").

The University of North Carolina at Chapel Hill (UNC-Chapel Hill) covered University units are committed to allowing individuals to exercise their rights under HIPAA and other applicable federal and state laws. Covered University units will take necessary steps to address an individual's request to access, inspect, and/or obtain a copy of his/her health information or to transmit a copy of his/her PHI to a third party in a timely and professional manner.

Individuals do not have the right to access the following information, and a denial of access is not subject to review:

• psychotherapy notes;
• information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding;
• information maintained by a provider that is subject to the Clinical Laboratory Improvements
• Amendments of 1988, 42 USC 263a, to the extent the provision of access to the individual would be prohibited by law; or exempt from the Clinical Laboratory Improvements Amendments of 1988, pursuant to 42 CFR 493.3(a)(2);
• information obtained from someone other than a health care provider under a promise of confidentiality, if the access requested would be reasonably likely to reveal the source of the information.

Where information is created or obtained by UNC-Chapel Hill covered University units in the course of research that includes treatment and the individual has agreed to the temporary denial of access when consenting to participate in the research, the individual's right to access is suspended for as long as the research is in progress. In such cases a denial of access is not subject to review.

In denying access in whole or in part, to the extent possible, covered University unit Health Information Management ("HIM") personnel will give the individual access to any other PHI requested, after excluding the PHI that was denied.

Individuals do not have the right to access the following information, but a denial of access may be reviewed by another covered University unit licensed health care professional who has been designated by the covered University unit to act as a reviewing official and who was not involved in the original decision to deny access in the following situations:

• A licensed health care professional has determined, in the exercise of professional judgment, that the access requested (by the individual or their personal representative) is reasonably likely to endanger the life or physical safety of the individual or another person; or
• The PHI makes reference to another person (unless such other person is a health care provider) and a licensed health care professional has determined, in the exercise of professional judgment, that the access requested is reasonably likely to cause substantial harm to such other person.

Procedure

1. An individual must direct requests for access, inspection, or a copy of his/her PHI to the HIM department of the covered University unit and complete a form requesting access, inspection or a copy of his/her PHI.
2. Upon receipt of a request, HIM personnel of the covered University unit will review the request and the medical record. If, in their professional judgment, there is a risk that access to information contained in the medical record may cause harm to any individuals, HIM personnel of the covered University unit will forward the request and the medical record to a designated licensed health care professional for determination of whether the access can safely be granted.
3. HIM personnel of the covered University unit will respond to the request no later than 30 days after the request is made or, if HIM personnel of the covered University unit are unable to respond within 30 days, the covered University unit may extend such time for action by no more than 30 additional days and must provide the individual requesting his/her PHI with a written statement of the reasons for the delay and a date by which the covered University unit will provide the requested PHI.
4. The individual will be allowed access, inspection, and/or copies of the requested PHI in a secure and confidential manner, and in the form and format requested by the individual if the PHI is readily producible in this form. If the PHI is not readily producible in the form and format requested, the covered University unit will produce the PHI in its original electronic form, in a readable hard copy form, or another electronic form that is mutually agreeable to both the individual and the covered University unit. If an individual elects to review his/her PHI in person, a covered University unit representative may be present to ensure that no information is removed, altered, or destroyed.
5. A summary or written explanation of the requested PHI will be provided in lieu of access to the information only when the individual agrees in advance to a summary, and to any related fees imposed.
6. When denying an individual access to PHI, the denial will:
   1. be written in plain language;
   2. contain the basis for the denial;
   3. contain the following statement, if applicable:
      THE INDIVIDUAL HAS THE RIGHT TO HAVE THE DENIAL REVIEWED BY A LICENSED HEALTH CARE PROFESSIONAL WHO HAS BEEN DESIGNATED BY THE COVERED UNIVERSITY UNIT TO ACT AS A REVIEWING OFFICIAL AND WHO DID NOT PARTICIPATE IN THE ORIGINAL DECISION. INDIVIDUALS MAY EXERCISE THEIR REVIEW RIGHTS BY INFORMING THE HIM DEPARTMENT IN WRITING; and
   4. contain a description of how the individual may complain to UNC-Chapel Hill pursuant to its complaint procedures or to the HHS Secretary.
7. If requested and applicable, the review of a denial will be conducted by a licensed health care professional who is designated by the covered University unit to act as a reviewing official and who did not participate in the original decision to deny. The decision on review will be provide in writing to the individual.
8. HIM personnel of the covered University unit will appropriately document the request and delivery or denial of the PHI in the administrative section of the individual's medical record maintained in the HIM department of the covered University unit.
9. UNC-Chapel Hill covered University units will document and retain PHI that is subject to access by individuals for a period of at least 6 years from the date of its creation or the date when it last was in effect, whichever is later.
10. Knowledge of a violation or potential violation of this policy must be reported directly to the Privacy Officer.