Medical Records and the Law

Verifying Identity and Representations 239vacy policies and procedures, the entity’s compliance with those policiesand procedures, and the entity’s compliance with the requirementsof the Privacy Rule. 618 The covered entity must retain documentationof all complaints in written or electronic form for a period of six yearsfrom the date the documentation is created or the date it was last in effect,whichever is later. 619 Most covered entities would prefer that anindividual register a complaint with them rather than with a governmentenforcement agency. Thus, it would be advantageous to have acomplaint procedure that patients can easily understand and follow.If a person believes that a covered entity is not complying with thecompliance principles of the Enforcement Rule or with the requirementsof the Privacy Rule, he or she may file a complaint with the Secretaryof DHHS. 620 The complaint must be written but may be filedelectronically. It must also name the covered entity, describe the natureof its violation, and provide other information the Secretary may prescribe.621 Complaints must be filed within 180 days of when the personknew, or should have known, of the violation, but the Secretarymay waive this time limit if there is good cause to do so. 622 Instructionsfor filing complaints electronically or in writing are available on theCMS Web site. 623The right to file a complaint extends also to members of a coveredentity’s workforce, who may disclose PHI as part of a whistle blowerreport of improper conduct by the covered entity, although the PrivacyRule does not prescribe the precise manner in which the report is to bemade. 624Verifying Identity and RepresentationsHealthcare organizations and practitioners must use care in verifyingthat individuals requesting patient health information are who they say61845 C.F.R. § 164.530(d).61945 C.F.R. § 164.530(j).62045 C.F.R. § 160.306(a).621The specific information to be included is set forth on the DHHS Web site at http://answers.hhs.gov/cgi-bin/hhs.cfg/php/enduser/std_alp.php.62245 C.F.R. § 164.530(b).623http://www.cms.hhs.gov/hipaa/hipaa2/default.asp.62445 C.F.R. § 164.502(j)(1).