Medical Records and the Law

Verifying Identity and Representations 241The covered entity may rely on any of the following to verify the publicofficial or agent’s authority to obtain PHI:• A written or oral statement of the legal authority under which therequest is made• Any subpoena, warrant, order, or other legal process issued by agrand jury, court, or administrative tribunal 628In situations in which the Privacy Rule gives individuals an opportunityto object to the disclosure of their PHI, a covered entity willfulfill the verification requirements of the rule if it exercises its professionaljudgment. (See the discussion of the exercise of professionaljudgment earlier in this chapter.) If the covered entity is disclosing PHIto prevent a serious threat to health or safety, the entity will fulfill itsverification requirements if it acts in good faith. 629The Privacy Rule gives the Secretary of DHHS the authority to investigatethe alleged violation and, if a violation has occurred, to attemptto correct the problem through informal efforts. If the Secretaryand the covered entity cannot resolve the matter through these means,the Secretary may issue written findings of noncompliance, which maythen subject the covered entity to legal sanctions under HIPAA. 630(See the discussion of HIPAA sanctions in Chapter 11.)If a covered entity becomes aware of a violation, because a personhas filed a complaint with it or with the Secretary or from any othersource, the entity must take action to the extent possible to mitigate theharmful effects of the violation. 631 The requirement to mitigate appliesto violations by the covered entity or its business associates. To protectthe individual’s right to complain of violations, the Privacy Rule prohibitsa healthcare provider from requiring a patient to waive his or herright to file a complaint as a condition for the provision of healthcaretreatment, payment, enrollment in a health plan, or eligibility for planbenefits. 632 In addition, a covered entity may not retaliate against or intimidateany person for exercising his or her rights under the PrivacyRule or for testifying in an enforcement hearing. 63362845 C.F.R. § 164.514(h)(2)(iii).62945 C.F.R. § 164.514(h)(2)(iv).63045 C.F.R. § 160.312(a).63145 C.F.R. § 164.530(f ).63245 C.F.R. § 164.530(h).63345 C.F.R. § 164.530(g).