Public Health Law Map - Beta 5 - Medical and Public Health Law Site

ather than the entire record or unedited parts of the record. While this requirement
can be difficult to meet for paper records, it anticipates that most medical
information will eventually be managed electronically. Electronic records can be
segmented so that individuals only have access to the specific information that they
need. Individuals can be given the authority to add information to an electronic
record without giving them the right to read the record. This could allow a lab tech to
record that the blood was drawn for a test or to post the result of the test without
being given the right to read other sections of the record. Covered entities must also
document when information is released so that a patient can find out who has had
access to his/her medical information.
The major exception is that information that is released for patient care is not subject
to the minimum necessary standard. This exception is critical because most medical
records are still on paper. With traditional paper medical records, it is very difficult
to extract information for specific purposes. It would require that someone read
through and abstract the record, which would be prohibitively expensive and very
time consuming. Electronic medical records make it easier to limit access to parts of
the records, but it will be years before all routine care is based on electronic records.
Medical care providers need quick and simple access to the patient's medical
information. From a privacy advocate's perspective, however, this exception is a
major weakness of HIPAA because, as our earlier example illustrates, there are a lot
of people involved with medical information in contemporary hospital care.
Allowing all of them access to the full information creates many opportunities for
mistaken or malicious disclosures.
6. Patient Access to their own PHI
While it might seem obvious patients should be able to see their own medical
information, some states made it difficult for patients to get their records if the
medical care providers did not want to comply with a patient's request to see the
records. The HIPAA privacy rule makes it clear that patients do have a right to see
their records, with certain very limited exceptions for mental health records that
might injure the patient. HIPAA also allows the patient to ask that the record be
corrected if it contains mistakes. The right to ask for corrections or additions to the
records is important because medical records sometimes have mistakes in them
which can lead to injuries. make it impossible to get insurance reimbursement for the
care, and even make the patient uninsurable. The hospital does not have to change
the record if it disagrees, but it must record the patient's compliant.
If the patient is a minor or is legally incompetent, their legal representative or parent
has access to their PHI and must also authorize its release on behalf of the patient.
State law will control whether the incompetent patient has personal access to their
medical records. HIPAA generally follows state law rules on access to records by
minors, but there is some confusion as to the HIPAA requirements when the state
allows the minor to consent to care but also allows the parent access to the minor's
medical records.
357