HIPAA: OCR Guidance on Access to Records; Disclosure to Criminal Background Check System
January 22, 2016 | Strategic Insights for Ambulatory Care
Individuals have a general right to access their health information under the Health Insurance Portability and Accountability Act (HIPAA) privacy rule, including the right to review or copy the record, or to have a copy of their record sent to another individual, the U.S. Department of Health and Human Services' (HHS) Office for Civil Rights (OCR) clarified in recent guidance for providers. OCR notes that although providers may require a written request to obtain access and must take reasonable steps to verify the identity of the individual requesting access, they may not impose "unreasonable measures . . . that serve as barriers to or unreasonably delay" access. Examples of such measures include requiring an individual to physically come to the office, requiring use of an online portal to request records, or requiring use of a mailed form; any of these measures may be permitted by a provider, but none of them may be required.