Privacy Officer's Roundtable

  • 1.  Authorization vs Request to send PHI

    Posted 12-02-2015 08:15 PM

    In section 524 (Access to PHI), in paragraph c3i and ii, it talks about the individual having access to PHI as well as the right to copy the PHI and send the PHI to an individual at their direction.  In order to send the PHI to another person, the patient must submit the request in writing including the name and where to send the information.  It doesn't require or reference an Authorization.

    Q1: Does this mean that any time a patient wants their PHI sent to themselves or someone else, they do not have to use an Authorization, but just submit their request in writing including: who is receiving the PHI, what is to be sent, and where to send it, and then sign the request?

    Q2: When would an Authorization be used?

    It's the end of the day, so maybe I'm confused.


    David Garrison CHC,MPH
    Compliance/Privacy Officer
    SCCE Membership

  • 2.  RE: Authorization vs Request to send PHI

    Posted 12-02-2015 08:27 PM

    Easy to get these two, separate but related items commingled or mixed up.  I am sure someone will post a clarification posting soon...if not...stay tuned.

    Frank Ruelas

    SCCE Membership

  • 3.  RE: Authorization vs Request to send PHI

    Posted 12-03-2015 07:49 AM

    I don't know about anyone else but we've seen an increase in patients (as directed by their attorneys), requesting "access" to their medical records and having us send them to their representative (aka their attorney).  The main reason we believe they are doing this is to avoid paying for the copies. 

    Tara McKibben CHPC
    Director HIPAA/Privacy Officer
    Susquehanna Health

    SCCE Membership

  • 4.  RE: Authorization vs Request to send PHI

    Posted 12-04-2015 09:42 AM

    Is this what you're talking about? The medical record fee scam? I'm also a Social Security attorney part time so I'm well aware of this. Someone recently posted this on one of the HCCA round tables. The gist is that the access is for the patient or their personal representative, not their attorney. Attorneys have to submit signed releases for medical records and pay and OCR is not going to listen to their whining.

    Brenda Manning, Esq., CHC, CHPC
    Compliance Office & Attorney
    R&B Solutions / Dennis Brebner & Assoc.
    Waukegan, IL 60085

    SCCE Membership