A client who has, is receiving, or was denied services, a parent of a minor, and/or a personal representative or legal guardian as relevant to their representation, may request an amendment or correction of health information. Additionally, a personal representative or legal guardian must have written authorization from the client to amend or correct PHI. Individuals making this type of request should complete the Request for Amendment/Correction of Protected Health Information, MO 886-4450 to record the request, unless the information involves minor discrepancies, as described below.
Minor Discrepancies
For minor discrepancies such as typing errors, misspelled names, wrong dates, etc., staff may correct the entry by drawing a single line through the error, adding a note that explains the error, dating it, initialing it, and by making the correction as close as possible to the original entry in the record. In this situation, the individual is not required to fill out the Request for Amendment/Correction of Protected Health Information form.
Additions to the file should not be treated as amendments. For example, the name of a client’s new primary physician would not be considered an amendment.
Other Requests
All other requests for amendment of PHI must be in writing and include the reason to support the amendment. The request should include any documentation that explains or verifies the incorrect or incomplete information. As noted above, the client should be instructed to complete the Request for Amendment/Correction of Protected Health Information form to record this request. Immediately forward the form and all documentation to the CD Privacy Officer. The CD Privacy Officer will act on the request no later than 60 days after receipt of the request. The CD Privacy Officer may request an extension of 30 days by notifying the client in writing.
If the amendment request is accepted, staff must upon notification by the CD Privacy Officer:
- Insert the amendment or link the amendment to the site of the information that is the subject of the request for amendment, and then document the change in the same section of the record as the original information; and
- Inform the individual that the amendment is accepted; and
- Obtain the authorization of the individual to notify all relevant persons or entities with whom the amendment needs to be shared; and
- Within 60 days, make reasonable efforts to provide the amendment to the persons identified by the client and any persons that staff knows that have been provided the PHI that is the subject of the amendment and who may have relied on or could possibly rely on the information to the detriment of the client.
Denying Requests for Amendment of Protected Health Information
The request for amendment of the PHI may be denied if:
- Staff did not create the information (however, if the individual can provide reasonable proof that the person or entity that created the information is no longer available to make the amendment, and the request is not denied on other grounds, the amendment is permissible);
- The information is not part of the medical information kept in the client’s case record;
- The information is not part of the information that the client would be permitted to inspect and copy; and
- The information is accurate and complete.
If the amendment request is denied, the CD Privacy officer notifies the client and staff. The denial notice explains:
The reason for the denial:
- the person’s right to submit a written statement disagreeing with the denial and how the individual may file such a statement;
- the name, title, address, and telephone number of the DSS Privacy Officer to whom a statement of disagreement should be addressed;
- the steps to file a complaint with the Secretary of the Department of Health and Human Services;
- a statement that if the client does not submit a statement of disagreement, the client may request that DSS provide the Request for Amendment/Correction of Protected Health Information and the denial notice with any future disclosures of PHI.
Client Disagrees with the Denial
The individual has the right to submit a written statement disagreeing with the denial of all or part of a requested amendment and the basis for the disagreement. This statement of disagreement shall be limited to one page and be submitted to the DSS Privacy Officer. DSS will complete a written response to the statement of disagreement and send it the to client and staff.
Staff must identify the record of PHI that is the subject of the disputed amendment and append or link the request for an amendment, the denial of the request, the individual’s statement of disagreement, if any, and DSS’ response statement if any. If the client has submitted a statement of disagreement, staff must include the documents listed in the prior sentence, or an accurate summary of the information, with any subsequent disclosure of the PHI to which the disagreement relates.
If the person has not submitted a written statement of disagreement, DSS must include the person’s request for amendment and its denial, or an accurate summary of the information, with any subsequent disclosure of PHI only if the client has requested it.