HIPAA establishes the Right of Access, which allows patients to review their medical records, understand their health conditions, and make informed healthcare decisions. HIPAA also sets in place the exclusion of certain types of information to the Right of Access.
The purpose of the HIPAA Right of Access provisions
According to the HHS: "The regulations under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), which protect the privacy and security of individuals' identifiable health information and establish an array of individual rights with respect to health information, have always recognized the importance of providing individuals with the ability to access and obtain a copy of their health information."
The Right of Access provision provides patients the ability to see and get copies of their own medical records and health information from their healthcare providers, insurance companies, and other health-related entities. This right allows patients to stay informed about their health conditions, check their records for accuracy, and make well-informed decisions regarding their treatments. It also makes it easier for patients to share their health information with other doctors if they want a second opinion or need to switch providers.
See also: What are HIPAA Right of Access provisions?
Information excluded from HIPAA's Right of Access
Psychotherapy notes
These are detailed, personal notes taken by mental health professionals during counseling or therapy sessions. Unlike the rest of the medical record, psychotherapy notes focus on the therapist's impressions, feelings, and analysis of the session. They are kept separate from the patient's medical file to protect the intimate and subjective details of therapy sessions, which are considered highly confidential.
The exclusion of these notes from the Right of Access is meant to preserve the privacy of the therapeutic relationship and encourage open, honest communication between the therapist and the patient.
Information compiled for legal proceedings
This category includes any records or information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding. The rationale for this exclusion is to protect the integrity of legal processes and ensure that sensitive information gathered for these purposes is not prematurely disclosed. This can include documents prepared by attorneys, risk management, or compliance departments in anticipation of litigation or legal disputes.
Information not in the designated record set
Information not in the designated record set can include internal administrative records, business planning and development documents, and records used for quality assessment or improvement activities.
While they may contain health information, these records are not part of the official set of records designated for patient care and decision-making. The exclusion of such information from patient access is intended to protect sensitive business strategies, internal evaluations, and administrative functions of healthcare organizations.
See also: HIPAA Compliant Email: The Definitive Guide
Additional information that is subject to restricted access
If an individual is participating in a clinical trial or other research studies, access to related information might be temporarily suspended until the research is completed. This is to ensure the integrity of the research process and to prevent the release of preliminary data that could be misinterpreted.
Another common occurrence is when a portion of an individual's health information is not created or maintained by the covered entity (such as a healthcare provider or health plan), and the covered entity does not have ready access to it, this information might be excluded from access. For example, a specialist's notes that have not been incorporated into a hospital's record set.
See also: What are patient rights under HIPAA?
FAQs
Why can't patients access psychotherapy notes under HIPAA's Right of Access?
Psychotherapy notes are excluded because they contain personal observations by mental health professionals that are not required for patient care, diagnosis, or treatment.
Can patients access information about their treatment options under HIPAA's Right of Access?
Yes, patients can access most other types of health information, including their medical records, billing records, and any other documents used to make decisions about their healthcare, which can include treatment options.
Kirsten Peremore
