[Code of Federal Regulations]
[Title 45, Volume 1]
[Revised as of October 1, 2001]
From the U.S. Government Printing Office via GPO Access
[CITE: 45CFR164.526]
[Page 722-724]
TITLE 45--PUBLIC WELFARE
SUBTITLE A--DEPARTMENT OF HEALTH
AND HUMAN SERVICES
PART 164--SECURITY AND PRIVACY--Table of Contents
Subpart E--Privacy of Individually Identifiable Health Information
Sec. 164.526 Amendment of protected health information.
(a) Standard: Right to amend. (1) Right to amend. An individual has
the right to have a covered entity amend protected health information or
a record about the individual in a designated record set for as long as
the protected health information is maintained in the designated record
set.
(2) Denial of amendment. A covered entity may deny an individual's
request for amendment, if it determines that the protected health
information or record that is the subject of the request:
(i) Was not created by the covered entity, unless the individual
provides a reasonable basis to believe that the originator of protected
health information is no longer available to act on the requested
amendment;
(ii) Is not part of the designated record set;
(iii) Would not be available for inspection under Sec. 164.524; or
(iv) Is accurate and complete.
(b) Implementation specifications: requests for amendment and timely
action. (1) Individual's request for amendment. The covered entity must
permit an individual to request that the covered entity amend the
protected health information maintained in the designated record set.
The covered entity may require individuals to make requests for
amendment in writing and to provide a reason to support a requested
amendment, provided that it informs individuals in advance of such
requirements.
(2) Timely action by the covered entity. (i) The covered entity must
act on the individual's request for an amendment no later than 60 days
after receipt of such a request, as follows.
(A) If the covered entity grants the requested amendment, in whole
or in part, it must take the actions required by paragraphs (c)(1) and
(2) of this section.
(B) If the covered entity denies the requested amendment, in whole
or in part, it must provide the individual with a written denial, in
accordance with paragraph (d)(1) of this section.
(ii) If the covered entity is unable to act on the amendment within
the time required by paragraph (b)(2)(i) of this section, the covered
entity may extend
[[Page 723]]
the time for such action by no more than 30 days, provided that:
(A) The covered entity, within the time limit set by paragraph
(b)(2)(i) of this section, provides the individual with a written
statement of the reasons for the delay and the date by which the covered
entity will complete its action on the request; and
(B) The covered entity may have only one such extension of time for
action on a request for an amendment.
(c) Implementation specifications: Accepting the amendment. If the
covered entity accepts the requested amendment, in whole or in part, the
covered entity must comply with the following requirements.
(1) Making the amendment. The covered entity must make the
appropriate amendment to the protected health information or record that
is the subject of the request for amendment by, at a minimum,
identifying the records in the designated record set that are affected
by the amendment and appending or otherwise providing a link to the
location of the amendment.
(2) Informing the individual. In accordance with paragraph (b) of
this section, the covered entity must timely inform the individual that
the amendment is accepted and obtain the individual's identification of
and agreement to have the covered entity notify the relevant persons
with which the amendment needs to be shared in accordance with paragraph
(c)(3) of this section.
(3) Informing others. The covered entity must make reasonable
efforts to inform and provide the amendment within a reasonable time to:
(i) Persons identified by the individual as having received
protected health information about the individual and needing the
amendment; and
(ii) Persons, including business associates, that the covered entity
knows have the protected health information that is the subject of the
amendment and that may have relied, or could foreseeably rely, on such
information to the detriment of the individual.
(d) Implementation specifications: Denying the amendment. If the
covered entity denies the requested amendment, in whole or in part, the
covered entity must comply with the following requirements.
(1) Denial. The covered entity must provide the individual with a
timely, written denial, in accordance with paragraph (b)(2) of this
section. The denial must use plain language and contain:
(i) The basis for the denial, in accordance with paragraph (a)(2) of
this section;
(ii) The individual's right to submit a written statement
disagreeing with the denial and how the individual may file such a
statement;
(iii) A statement that, if the individual does not submit a
statement of disagreement, the individual may request that the covered
entity provide the individual's request for amendment and the denial
with any future disclosures of the protected health information that is
the subject of the amendment; and
(iv) A description of how the individual may complain to the covered
entity pursuant to the complaint procedures established in
Sec. 164.530(d) or to the Secretary pursuant to the procedures
established in Sec. 160.306. The description must include the name, or
title, and telephone number of the contact person or office designated
in Sec. 164.530(a)(1)(ii).
(2) Statement of disagreement. The covered entity must permit the
individual to submit to the covered entity a written statement
disagreeing with the denial of all or part of a requested amendment and
the basis of such disagreement. The covered entity may reasonably limit
the length of a statement of disagreement.
(3) Rebuttal statement. The covered entity may prepare a written
rebuttal to the individual's statement of disagreement. Whenever such a
rebuttal is prepared, the covered entity must provide a copy to the
individual who submitted the statement of disagreement.
(4) Recordkeeping. The covered entity must, as appropriate, identify
the record or protected health information in the designated record set
that is the subject of the disputed amendment and append or otherwise
link the individual's request for an amendment, the covered entity's
denial of the request,
[[Page 724]]
the individual's statement of disagreement, if any, and the covered
entity's rebuttal, if any, to the designated record set.
(5) Future disclosures. (i) If a statement of disagreement has been
submitted by the individual, the covered entity must include the
material appended in accordance with paragraph (d)(4) of this section,
or, at the election of the covered entity, an accurate summary of any
such information, with any subsequent disclosure of the protected health
information to which the disagreement relates.
(ii) If the individual has not submitted a written statement of
disagreement, the covered entity must include the individual's request
for amendment and its denial, or an accurate summary of such
information, with any subsequent disclosure of the protected health
information only if the individual has requested such action in
accordance with paragraph (d)(1)(iii) of this section.
(iii) When a subsequent disclosure described in paragraph (d)(5)(i)
or (ii) of this section is made using a standard transaction under part
162 of this subchapter that does not permit the additional material to
be included with the disclosure, the covered entity may separately
transmit the material required by paragraph (d)(5)(i) or (ii) of this
section, as applicable, to the recipient of the standard transaction.
(e) Implementation specification: Actions on notices of amendment. A
covered entity that is informed by another covered entity of an
amendment to an individual's protected health information, in accordance
with paragraph (c)(3) of this section, must amend the protected health
information in designated record sets as provided by paragraph (c)(1) of
this section.
(f) Implementation specification: Documentation. A covered entity
must document the titles of the persons or offices responsible for
receiving and processing requests for amendments by individuals and
retain the documentation as required by Sec. 164.530(j).