HIPAA and HITECH patients’ rights to health records

May 7, 2018 By

HIPAA requires more than security of protected health information. Patients have a right to review and obtain a copy of protected physical health information contained in a designated record set, which simply means a group of records maintained by the covered entity.  Medical and billing records  of a medical provider comprise the designated record set.   Enrollment, payment and claims files typically comprise the designated record set of an insurer or benefit plan.   Psychotherapy notes, information compiled for court or administrative proceedings, and clinical laboratory information subject to the Clinical Laboratory Improvements Amendments of 1988 are exempt from the HIPAA patient access rules.     Other exceptions apply to correctional institutions, research records with the consent of the individual, and information obtained from sources other than a health care provider.  45 C.F.R. section 164.524.

The Health Information Technology for Economic and Clinical Health Act (HITECH) gives patients the right to obtain a copy of the information in an electronic format requested by the patient if the format is regularly producible.    If the patient is warned about potential security risks, electronic records may be transmitted via unencrypted email.  The covered entity must respond to a request for electronic records within 30 days of receipt of the request.    The covered entity may request one extension for an additional 30 days.    The patient may sign a written directive to transmit the electronic records to another clearly identified entity or individual, e.g.  another medical provider, an attorney or agent.

Covered entities may charge a flat fee capped at $6.50 or charge the actual allowable costs for complying with a request for electronic protected health information.   Actual costs include documented costs of labor, supplies (e.g. a USB drive or CD) and postage.   A covered entity may not charge a retrieval fee for electronic records.

Within 30 days of the request for records, the covered entity must inform the patient of acceptance or denial of the request.   Denials must specify the reasons for decision, explain the rights to review the denial, and describe the procedures to complain about the denial of the request.    A  determination that access to records is likely to harm anyone is subject to review by a designated licensed health care professional.    The covered entity must notify the patient in writing of the reviewing professional’s  decision.

Patients should review their medical records to ascertain the accuracy of the record.   Ask the covered entity, whether provider or insurer,  to amend the record to correct errors.    A response to the request for an amendment is due within 60 days, unless an additional 30 day extension is required for an explicit reason disclosed to the patient in writing.     Denials of a request to amend the record must be in writing.   The patient then has a right to submit a written disagreement, which must be added to the medical record.

Access to medical records helps patients and their agents to make well-informed decisions about medical care.    The HITECH Act removes financial obstacles to access to electronic records.

 

 

Filed Under: agent, health insurance, health law, HIPAA, privacy Tagged With: , , , , ,

HEALTH INSURANCE APPEALS

July 18, 2016 By

The Patient Protection and Affordable Care Act requires health insurance plans to explain the reason for denial of coverage and to provide both an internal and external process to review the decision.  Health insurance benefits cannot be reduced or terminated without prior advance notice and an opportunity for advance review.   Benefits must continue pending the appeal.

ERISA claims regulations, 29 C.F.R. section 2560.503-1 and regulations of the Department of Health and Human Services, 45 C.F.R. section 147.136 govern the claim decision and appeals process.  A denial of a claim for benefits must describe rules, guidelines, protocols and criteria supporting the decision.   If the Plan contends that treatment is medically unnecessary or experimental,  the decision must disclose the scientific or clinical basis for a denial of a claim.

The Plan must give Claimants at least 180 days to appeal a denial of health benefits.   Plans must provide an expedited procedure for urgent care appeals.  Upon request, the Plan must provide free of charge all documents relevant to the decision from which an appeal is taken, including codes for diagnosis and treatment and an explanation of the meaning of codes.  If the decision is based on a medical judgment,  the Plan must engage a qualified expert in the applicable field of medicine and disclose the identity of the expert to the Appellant.   The Appellant has a right to review the file and present evidence prior to the deadline for the decision on appeal.

A decision on a claim for urgent care is due within 24 hours of the presentation of the claim; a decision on appeal of the denial of urgent care is due within 72 hours of receipt of the appeal.   For non-urgent appeals, a decision is generally due within 60 days after receipt of an appeal.

Decisions on requests for pre-service authorization of benefits are due within 15 days of the receipt of the claim, although the time may be extended.  Decisions on appeal of a denial of pre-service authorization are due within 30 days of filing the appeal.

After the denial of an internal appeal,  the Appellant may request an external review of the internal plan decision.   The Appellant must have at least 60 days after the final internal appeal decision to request an external review as described in the decision.

The summary plan description, policy or other evidence of coverage provided to enrollees must describe the internal and external appeal procedures and the availability of assistance in the appeal process.    Appellants may appoint an attorney, health care provider or other representative to pursue the appeal.

A beneficiary of an ERISA plan sponsored by an employer or union may file a lawsuit to recover benefits under Section 502(a) of ERISA.   Beneficiaries of non-ERISA plans may file a lawsuit in state court.   The failure of a health plan to strictly comply with the regulatory appeal requirements subjects the decision to judicial review under the de novo standard.   A health care provider may bring a lawsuit to recover benefits if the patient assigned rights to the provider.

Filed Under: health insurance Tagged With: , , , , , , , , ,