Patients have six fundamental rights:
1. The right to receive a notice about the doctor's privacy policies.
This notice will be similar to the form credit card companies or banks currently send to customers, indicating specifically how they use their personal information. The notice must include information about patients' rights under HIPAA, including the right to access the information the doctor maintains about them and the right to complain if they feel their rights have been violated. Although the doctor does not have to obtain a patient's consent to use their personal health information for treatment, they must at least make a good faith effort to acquire the patient's acknowledgment that they received notice of the doctor's privacy policies. A copy of the acknowledgment should be kept in the patient's file.
2. The right to access the medical information that is maintained.
On request, the doctor may provide a summary of the patient records or the records themselves, but they must do so within a specified time period. If they provide a copy of records, they may charge the patient a reasonable price for reproducing them. There are some exceptions under which the doctor may deny patients access to their records. However, if this is done, the decision must be reviewed by another licensed professional whom they have designated in their privacy policies and procedures.
3. The right to limit the uses and disclosure of medical information.
This includes limitations that can cause significant practical problems. For example, a patient may not want their diagnosis of cancer disclosed to a payer out of fear the information could reach their employer. If they are estranged from their family, they may not want any information (e.g., their phone number) disclosed to their siblings. A patient could also refuse to allow the doctor to report data to their health plan for quality assurance purposes (which is otherwise protected under the definition of "operations" for which the doctor does not need consent). Although this is a patient's right under HIPAA, reporting such data is also a requirement of most managed care contracts. The doctor is not obligated to agree to patients' restrictions, nor must they care for patients whose restrictions would interfere with their treatment. If the doctor agrees to the restrictions, they must document them and abide by them. If they don't agree to them, the patient will either have to relinquish the request or look elsewhere for care. If the patient chooses the latter, the doctor will have to adhere to their basic common law responsibilities of non-abandonment.
4. The right to request amendments to the medical record.
The privacy notice the doctor gives to patients must specify how they should make requests to amend their records (e.g., in writing). The doctor may refuse such a request for several reasons, including that the patient's record is accurate and complete. However, the patient does have the right to appeal. If the doctor agrees to amend the patient's record, they must notify the individual and others to whom they have provided the information that it has been amended.
5. The right to revoke or limit authorization.
If the doctor's practice uses or discloses personal health information for any reason other than TPO, they must obtain a specific "authorization" from the patient. This is a form that states what information will be disclosed and how it will be done. Special rules apply for clinical trials or research data. Psychotherapy notes may only be disclosed subject to authorization. Parental access to minors' medical records will continue to be controlled by state law.
6. The right to an accounting of disclosures of PHI.
According to the privacy rule, patients can ask to see what disclosures have been made during the past six years only. .
