NRPM: Standards for Privacy of Individually Identifiable Health Information. § 164.516 Amendment and correction.


(a) Standard: right to request amendment or correction.

(1) Right to request. An individual has the right to request a covered entity that is a health plan or health care provider to amend or correct protected health information about him or her in designated record sets of the covered entity for as long as the covered entity maintains the information.

(2) Grounds for denial of request. A covered entity may deny a request for amendment or correction of the individual’s protected health information, if it determines that the information that is the subject of the request:

(i) Was not created by the covered entity;

(ii) Would not be available for inspection and copying under § 164.514; or

(iii) Is accurate and complete.

(b) Standard: amendment and correction procedures. A covered entity that is a health plan or health care provider must have procedures to enable individuals to request amendment or correction, to determine whether the requests should be granted or denied, and to disseminate amendments or corrections to its business partners and others to whom erroneous information has been disclosed.

(c) Implementation specifications: procedures. The procedures required by paragraph (b) of this section must provide that the covered entity will:

(1) Means of request. Provide a means by which an individual can request amendment or correction of his or her protected health information.

(2) Time limit. Take action on such request within 60 days of receipt of the request;

(3) Request accepted. Where the request is accepted in whole or in part:

(i) As otherwise required by this part, make the appropriate amendments or corrections;

(ii) As otherwise required by this part, identify the challenged entries as amended or corrected and indicate their location;

(iii) Make reasonable efforts to notify:

(A) Persons, organizations, or other entities the individual identifies as needing to be notified; and

(B) Persons, organizations, or other entities, including business partners, who the covered entity knows have received the erroneous or incomplete information and who may have relied, or could foreseeably rely, on such information to the detriment of the individual; and

(iv) Notify the individual of the decision to correct or amend the information.

(4) Request denied. Where the request is denied in whole or in part:

(i) Provide the individual with a written statement in plain language of:

(A) The basis for the denial;

(B) A description of how the individual may file a written statement of disagreement with the denial; and

(C) A description of how the individual may complain to the covered entity pursuant to the complaint procedures established in § 164.518(d) or to the Secretary pursuant to the procedures established in § 164.522(b). The description must include:

(1) The name and telephone number of the contact person or office required by § 164.518(a)(2); and

(2) Information relevant to filing a complaint with the Secretary under § 164.522(b).

(ii) The procedures of the covered entity must:

(A) Permit the individual to file a statement of the individual’s disagreement with the denial and the basis of such disagreement.

(B) Provide for inclusion of the covered entity’s statement of denial and the individual’s statement of disagreement with any subsequent disclosure of the information to which the disagreement relates, provided, however, that the covered entity may establish a limit to the length of the statement of disagreement, and may summarize the statement of disagreement if necessary.

(C) Permit the covered entity to provide a rebuttal to the statement of disagreement in subsequent disclosures under paragraph (c)(4)(ii)(B) of this section.

(d) Standard: effectuating a notice of amendment or correction. Any covered entity that receives a notice of amendment or correction must have procedures in place to make the amendment or correction in any of its designated record sets and to notify its business partners, as appropriate, of necessary amendments or corrections of protected health information.

(e) Implementation specification: effectuating a notice of amendment or correction. The procedures required by paragraph (d) of this section must specify the process for correction or amendment of information in all appropriate designated record sets maintained by the covered entity and its business partners.