[Please label comments about this section with the subject: “Amendment or correction”]
This proposed rule would provide an individual with the right to request a covered plan or provider to amend or correct protected health information relating to the individual. A covered plan or provider would be required to accommodate requests with respect to any information that the covered plan or provider determines to be erroneous or incomplete, that was created by the plan or provider, and that would be available for inspection and copying under proposed § 164.514.
The first criteria that a covered entity would need to consider is whether the protected health information at issue is either erroneous or incomplete. The basic concept comes from the Privacy Act of 1974, governing records held by Federal agencies, which permits an individual to request correction or amendment of a record "which the individual believes is not accurate, relevant, timely, or complete." (5 U.S.C. 552a(d)(2)). We would adopt the standards of “accuracy” and “completeness” and draw on the clarification and analysis of these terms that has emerged in administrative and judicial interpretations of the Privacy Act over the last 25 years.
We are not proposing to permit correction on the basis of an individual's belief that information is irrelevant or untimely. The Privacy Act of 1974 imposes affirmative obligations on Federal agencies to maintain records with accuracy, relevance, timeliness, and completeness, and permits individuals to seek correction of records that do not meet that standard. The amendment and correction right complements and helps to enforce the agency obligation.
Our view is that the relevance and timeliness standards, while very appropriate for Federal agencies generally, would be difficult to impose by regulation upon health record keeping, which depends to a large extent on clinical judgment. The increasingly- recognized impact of lifestyle and environmental factors on health may, for example, motivate physicians to record information which appears irrelevant, but which may in fact serve as a diagnostic clue, or which may alert later users of the record to clinically relevant aspects of the patient's life. We invite comment on how any such standard might be structured to avoid interfering inappropriately with clinical judgment.
We also are concerned about the burden that requests for amendment or correction may place on covered plans and providers and have tried to limit the process to those situations where amendment or correction would appear to be most important. We invite comment on whether our approach reasonably balances burden with adequately protecting individual interests.
We note that for Federal agencies that are also covered plans or providers, the rule we are proposing would not diminish their present obligations under the Privacy Act of 1974, under which all four factors are bases for amendment and correction.
We propose to require a covered plan or provider to accommodate a request for amendment or correction if the plan or provider created the information in dispute.
We considered requiring covered plans and providers to amend or correct any erroneous or incomplete information it maintains, regardless of whether it created the information. Under this approach, if the plan or provider did not create the information, then it would have been required to trace the information back to the original source to determine accuracy and completeness. We rejected this option because we concluded that it would not be appropriate to require the plan or provider that receives a request to be responsible for verifying the accuracy or completeness of information that it did not create. We also were concerned about the burden that would be imposed on covered plans and providers if they were required to trace the source of any erroneous or incomplete information transmitted to them.
We would rely on a combination of three other requirements to ensure that protected health information remains as accurate as possible as it travels through the health care system. First, we are proposing that a covered plan or provider that makes an amendment or correction be required to notify any relevant persons, organizations, or other entities of the change or addition. Second, we are proposing that other covered plans or providers that receive such a notification be required to incorporate the necessary amendment or correction. Finally, we are proposing that covered plans or providers require their business partners who receive such notifications to incorporate any necessary amendments or corrections. See discussion in section II.F.4.c.iii. We are soliciting comments whether this approach would effectively ensure that amendments and corrections are communicated appropriately.
We are proposing that the right to request amendment or correction extend to all protected health information that would be available for inspection and copying under § 164.514. We would only require covered plans and providers to amend or correct that information maintained in a designated record set but would encourage the development of systems that would accommodate these types of changes for all data collections. For protected health information that is maintained solely by a business partner or that has been materially altered by a business partner, the covered plan or provider would need to make arrangements with the business partner to accommodate any requests.
This right would not be intended to interfere with medical practice, or modify standard business record keeping practices. Perfect records are not required, but instead a standard of reasonable accuracy and completeness should be used. In addition, this right would not be intended to provide a procedure for substantive review of decisions such as coverage determinations by payers. It would only affect the content of records, not the underlying truth or correctness of materials recounted therein. Attempts under the Privacy Act of 1974 to use this correction mechanism as a basis for collateral attack on agency determinations have generally been rejected by the courts. The same results would be intended here.
We are proposing that covered plans and providers be required to accommodate requests for amendment or correction for as long as the entity maintains the protected health information. We considered requiring covered plans and providers to accommodate requests for a specific period or defining a specific retention period. We rejected that approach because many laws and professional standards already designate specific retention periods and we did not want to create confusion. In addition, we concluded that individuals should be permitted to request amendments or corrections for as long as the information is maintained by the covered plan or provider. We are soliciting comments on whether we should include a specific duration requirement in this proposed rule.
We are proposing that a covered plan or provider would be permitted to deny a request for amendment or correction if, after a reasonable review, the plan or provider determines that it did not create the information at issue, the information would not be available for inspection and copying under proposed § 164.514, the information is accurate and complete, or if it is erroneous or incomplete, it would not adversely affect the individual.
In § 164.516, we are proposing that covered plans and providers be required to have procedures that enable individuals to exercise their rights to request amendment or correction, including a means by which individuals can request amendment or correction of protected health information about them. We considered whether this proposed rule should include detailed procedures governing an individual’s request. But as with the procedures for requesting inspection and copying, we are only providing a general requirement and permitting each plan or provider to develop procedures in accordance with its needs. Once the procedures are developed, the plan or provider would document them in accordance with section § 164.520 and include a brief explanation in the notice that is provided to individuals pursuant to section § 164.512.
We are proposing that the covered plan or provider would take action on a request for amendment or correction as quickly as the circumstances require, but not later than 60 days following the request. The justification for establishing a time limitation for amendment and correction is virtually identical to that provided for the time limitation for inspection and copying. We concluded that the entity should be provided with some additional flexibility in this context. Depending on the nature of the request, an amendment or correction could require significantly more time than a request for inspection and copying. If a covered plan or provider needed more than 30 days to make a decision, we would encourage, but not require, it to send an acknowledgment of receipt to the individual including an explanation of the reasons for the delay and a date when the individual can expect a final decision.
If a covered plan or provider accepts an individual’s request for amendment or correction, it would be required to make the appropriate amendments or corrections. In making the change, the entity would have to either add the amended or corrected information as a permanent part of the record or mark the challenged entries as amended or corrected entries and, if appropriate, indicate the place in the record where the amended or corrected information is located. Covered plans or providers would not be required to expunge any protected health information, but rather mark it as erroneous or incomplete.
We also propose in § 164.506(e) that entities include a contract requirement that when the covered plan or provider notifies the business partner of an amendment or correction, the business partner must make the necessary amendments or corrections to protected health information in its custody.
In § 164.516(c)(3), we are proposing that, upon accepting an amendment or correction, the covered plan or provider would be required to make reasonable efforts to notify relevant persons, organizations, or other entities of the change or addition. An entity would be required to notify such persons that the individual identifies, or that the covered plan or provider identifies as 1) a recipient of the erroneous or incomplete information, and 2) a person who:
We are concerned about the potential burden that this notification requirement would impose on covered plans and providers. We do not, however, anticipate that a significant number of requests would be submitted to any entity and therefore the need for such notifications would be rare. In addition, we determined that because health information can travel so quickly and efficiently in the modern health care system, the need for notification outweighed the potential burden. It is important to note that a reasonableness standard should be applied to the notification process -- if the recipient has not relied upon the erroneous or incomplete information to the detriment of the individual or if it is not foreseeable that the recipient will do so, then it would not be reasonable for the covered plan or provider to incur the time and expense of notification. If, however, if the incorrect information is reasonably likely to be used to the detriment of the individual, the entity should make every effort to notify the recipients of the information of the changes as quickly as possible.
In proposed § 164.516(c)(4), we would require a covered plan or provider to provide the individual with a written statement in plain language of the reason for the denial and permit the individual to file a written statement of disagreement with the decision to deny the request.
The statement prepared by covered plan or provider would be required explain the basis for the denial. The statement would include a description of how the individual may complain to the covered plan or provider as provided in § 164.518(d). The statement would include the name and number of the contact person within the plan or provider who is responsible for receiving complaints. The statement also would include information regarding filing a complaint with the Secretary pursuant to § 164.522(b)(1), including the mailing address and any forms that may be available. Finally, the statement would explain that the individual has the right to file a written statement of disagreement that would be maintained with the disputed information and the procedure for filing such a statement of disagreement.
If the individual chooses to file a statement of disagreement, then the covered plan or provider must retain a copy of the statement with the protected health information in dispute. The covered plan or provider could require that the statement be a reasonable length, provided that the individual has reasonable opportunity to state the nature of the disagreement and offer his or her version of accurate and complete information. In all subsequent disclosures of the information requested to be amended or corrected, the covered plan or provider would be required to include a copy of its statement of the basis for denial and, if provided by the individual, a copy of his or her statement of disagreement. If the statement submitted by the individual is unreasonably long, the covered plan or provider could include a summary in subsequent disclosures which reasonably explains the basis of the individual’s position. The covered plan or provider would also be permitted to provide a rebuttal to the individual’s statement of disagreement and include the rebuttal statement in any subsequent disclosures.
We considered requiring the covered plan or provider to provide a mechanism for appealing denials of amendment or correction but concluded that it would be too burdensome. We are soliciting comment on whether the approach we have adopted reasonably balances the burdens on covered plans or providers with the rights of individuals.
If a covered plan or provider receives a notification of erroneous or incomplete protected health information as provided in proposed § 164.516(d), we are proposing that the covered plan or provider or be required to make the necessary amendment or correction to protected health information in its custody that would be available for inspection and copying. This affirmative duty to incorporate amendments and corrections would be necessary to ensure that individuals’ protected health information is as accurate and complete as possible as it travels through the health care system.